While the prospect of 5G networks has the wireless industry eyeing faster, more reliable and more capable cellular coverage, there’s also reason to be concerned about security risks, writes Network World’s Patrick Nelson.
These concerns for 5G stem from the lack of security measures being adopted in new 5G standards, according to Nelson. Meanwhile, numerous research studies have also discovered potential for “Man in the Middle” attacks on future terahertz-based 6G networks.
Scientists from ETH Zurich, University of Lorraine/INRIA and the University of Dundee conducted a formal 5G authentication analysis and found criminals will be able to intercept 5G communications and steal data because, “critical security gaps are present,” The gaps are present partly because security goals are not specific enough and 3GPP standards “lack precision” according to the researchers.
Another unrelated report from researchers at Brown University, Rice University and University at Buffalo revealed scientists have found serious vulnerabilities in 5G’s successor—terahertz data communications networks, which are expected to be used for 6G.
Given 6G networks are not expected for at least a decade, 5G security issues remain are the more pressing concern for the time being. Especially since technology such as self-driving vehicles, Internet of Things (IoT) devices and industrial control systems could benefit from 5G, according to Dr. Saša Radomirovic, senior lecturer of computing in the School of Science and Engineering at the University of Dundee.
“(5G) has been promised to be faster and more secure than previous networks, but we’ve found that it isn’t as secure as hoped,” Radomirovic said.
Radomirovic went on to say Tamarin, his academic groups’ automated security protocol verification tool, revealed critical security goals were not a part of 3GPP’s 5G AKA key exchange protocol.
“We find that some critical security goals are not met, except under additional assumptions missing from the standard,” his academic group wrote in its report that was published in June and recently updated.
The report explained the standard did not provide for things such as “mutual authentication requirements and agreement properties on the established key” despite the fact that 5G networks use an Authenticated Key Exchange protocol. Without these measures in place, attackers could set up secure channels with previously issued 5G security keys, according to researchers. They are currently working with 3GPP to address the issues, according to Nelson.
While 6G networks could be years away, they are still being researched and up until recently, there was a belief that terahertz frequencies are too small to intercept. The assumption is all it would take to prevent such an interception is a “Man in the Middle” receiver placed in a terahertz beam to eavesdrop, block the entire transmission and be detected right away. However, research has shown that assumption is incorrect.
“We show that undetected eavesdropping in the terahertz realm is easier than most people had assumed,” Brown University School of Engineering professor Daniel Mittleman said in a release. Mittleman also said that placing an object like a flat piece of metal at the edge of the beam has allowed his team to scatter parts of the beam and intercept data.
“(It) leaves a sliver of signal for an attacker to work with without casting a detectable shadow on the receiver,” the researchers say.