AdaptiveMobile Security Details Security Flaw in 5G Core Network Slicing

AdaptiveMobile Security has publicly disclosed details of a major security flaw in the architecture of 5G Network Slicing and virtualized network functions.

The fundamental vulnerability has the potential to allow data access and denial of service attacks between different network slices on a mobile operator’s 5G Network, leaving enterprise customers exposed to malicious cyberattack. The issue has the potential to cause significant security risks to enterprises using network slicing and undermine operators’ attempts to open up new 5G revenues. The probability of attack is only currently low due to the limited number of mobile operators with multiple live network slices on their networks.

AdaptiveMobile Security is working in conjunction with the GSMA, operators and standards bodies to address the issue and update architectures to prevent exploitation.

Network slicing allows a mobile operator to divide their core and radio network into multiple distinct virtual blocks that provide different amounts of resources and prioritisation to different types of traffic. One of the most innovative aspects of 5G, network slicing will let operators provide portions of their core networks for specific vertical customer use cases such as automotive, healthcare, critical infrastructure and entertainment. As a result the network is opened up to many partners and sliced into use cases and vertical specific blocks.

In its research, AdaptiveMobile Security examined 5G core networks that contain both shared and dedicated network functions, revealing that when a network has these ‘hybrid’ network functions that support several slices there is a lack of mapping between the application and transport layers identities.

This flaw in the industry standards has the impact of creating an opportunity for an attacker to access data and launch denial of service attacks across multiple slices if they have access to the 5G Service Based Architecture. For example, a hacker comprising an edge network function connected to the operator’s service based architecture could exploit this flaw in the design of network slicing standards to have access to both the operator’s core network and the network slices for other enterprises. The impact being that the operator and their customers are exposed and risk the loss of sensitive location data – which would allow user location tracking, the loss of charging related information and even the potential interruption to the operation of the slices and network functions themselves.

“5G is driving the mobile industry into adopting the technology and techniques of the IT world to increase efficiency and improve functionality. However, while laudable, there needs to be a wider mindset change. When it comes to securing 5G, the telecoms industry needs to embrace a holistic and collaborative approach to secure networks across standards bodies, working groups, operators and vendors,” said Dr. Silke Holtmanns, Head of 5G Security Research at AdaptiveMobile Security.

The outcome of the research has been shared with the GSMA in line with the standard co-ordinated vulnerability disclosure process. AdaptiveMobile Security is investigating if the currently defined 5G standards’ mechanisms will be sufficient to stop an attacker and in doing so, uncovered three main attack scenarios based on the flaw which cannot be mitigated according to today’s specified technology:

- User data extraction – in particular location tracking

- Denial of service against another network function

- Access to a network function and related information of another vertical customer

“As more of the core network moves to the cloud and an IT-based architecture, so more suitable hacking tools become available for hackers,” Holtmanns continued. “Currently, the impact on real-world applications of this network slicing attack is only limited by the number of slices live in 5G networks globally. The risks, if this fundamental flaw in the design of 5G standards had gone undiscovered, are significant. Having brought this to the industry’s attention through the appropriate forums and processes, we are glad to be working with the mobile network operators and standards communities to highlight these vulnerabilities and promote best practice going forward.”