Exploiting GSM/2G Weaknesses for Downgrade Attacks

1. The "Original Sins" of 2G/GSM Security

The security of the second-generation (2G) Global System for Mobile Communications (GSM) standard was not designed with the robust, adversarial mindset common in your field of web security. Conceived in the 1980s, its architecture contained two fundamental flaws that we will explore, both of which were, to some extent, intentional design choices.

Flaw 1: The Authentication Gap

In a secure connection, both parties should verify each other's identity. For example, in TLS, your browser verifies the server's certificate, and the server can optionally verify a client certificate. This is mutual authentication. 2G/GSM lacks this.

Please read the following section of the "Evolutionary Analysis of Cellular Network Security" article, which describes this critical flaw.

As you just read, the core issue is that the network authenticates the phone, but the phone does not authenticate the network. Your phone implicitly trusts any cell tower that broadcasts the correct network identifier (PLMN ID) and offers a strong signal. This opens the door for a classic Man-in-the-Middle (MitM) attack, where an attacker can set up a rogue base station (an IMSI Catcher) and trick nearby phones into connecting to it.

Flaw 2: Weak and Broken Encryption

The second major flaw is the encryption used to protect the confidentiality of calls and messages over the air. The primary cipher, A5/1, was developed in secret—a practice now widely understood to be poor "security by obscurity."

This next reading explains the history and eventual downfall of GSM's encryption.

The key takeaways are:

• A5/1, the "stronger" version, had its effective key length reduced from 64 to 54 bits by a flawed key generation algorithm, making it vastly easier to brute-force.
• A5/2 was an even weaker, export-grade version.
• By 2010, rainbow tables and open-source software made it possible to crack A5/1 encryption in minutes using commodity hardware.

In short, 2G provides a communication channel where an attacker can easily impersonate the network and, once a device is connected, listen in on everything.

2. The Downgrade Attack: Forcing Modern Phones into the Past

Now, we connect these 2G weaknesses to modern networks. A downgrade attack is precisely what it sounds like: an attacker forces a target's device to abandon a secure 4G or 5G connection and fall back to an insecure 2G one.

This short video provides an excellent high-level overview of the concept.

The attack flow leverages the two flaws we've discussed:

1. Impersonation: An attacker broadcasts a fake 2G cell tower signal that is stronger than the legitimate 4G/5G signals in the area. They might also actively jam the 4G/5G frequencies to make the 2G signal the only viable option.
2. Forced Connection: Because of 2G's unilateral authentication, the victim's phone cannot verify the tower. It sees a strong signal for its home network and connects automatically.
3. Eavesdropping: Now that the phone is on the attacker-controlled 2G network, the attacker's base station can instruct the phone to use the weak A5/1 encryption or even no encryption at all (A5/0). The attacker can then intercept and decrypt calls and SMS messages in real time.

This diagram illustrates the principle. While it shows a downgrade from 4G to 3G, the mechanism of using a "Reject" message to trick the phone into seeking an older generation network is a common technique.

The P1 Security blog provides a very concise explanation of this problem.

This sequence diagram shows a more detailed view of the final eavesdropping stage of an attack on GSM, after a downgrade has occurred.

3. The Insecure Backbone: SS7

While the radio interface (the "air") has its flaws, the core network of 2G and 3G relies on a protocol suite called Signaling System No. 7 (SS7). Developed in the 1970s for a small club of trusted, state-owned telephone companies, SS7's security model is based entirely on this trust, which has not aged well. Understanding SS7 helps paint a complete picture of the insecure foundation that downgrade attacks revert to.

This video gives an excellent and engaging explanation of SS7, its vulnerabilities, and why it's still relevant.

The video demonstrates that even without a radio-level downgrade attack, if an attacker gains access to the SS7 network, they can perform powerful attacks like call interception and location tracking. When a phone is forced onto a 2G/3G network, it becomes fully subject to the vulnerabilities of both the air interface (A5/1) and the core network (SS7).

Conclusion

In this lesson, we've established why the security of older cellular generations remains a pressing concern. Even with a modern 5G phone, the need for backward compatibility can be exploited to force it onto a network designed in a different era with a fundamentally broken security model.

Key Takeaways:

• 2G/GSM's core flaws are unilateral (one-way) authentication and weak, broken encryption (A5/1).
• Unilateral authentication allows attackers to create rogue base stations (IMSI Catchers) that modern phones will trust and connect to.
• A downgrade attack is a MitM attack where a rogue base station forces a device off of a secure 4G/5G network and onto an insecure 2G network.
• Once downgraded, the attacker can leverage 2G's weak encryption to eavesdrop on calls and SMS.
• The underlying SS7 core network for 2G/3G has its own severe vulnerabilities, compounding the risk.

Preview of the Next Lesson:

Downgrade attacks are a powerful way to defeat modern security by avoiding it entirely. However, they are not the only way to attack a 4G network. In our next lesson, we will focus on a vulnerability within LTE itself, without needing to downgrade to 2G. Our next learning outcome will be to describe how subscriber identifiers (IMSI, IMEI) can be captured in LTE by exploiting pre-authentication signaling.