The findings are part of a new Vulnerabilities in LTE and 5G Networks 2020 report published by London-based cybersecurity firm Positive Technologies last week.
"This paper encompasses the results of security assessments performed during the 2018–2019 timeframe on behalf of 28 telecom operators in Europe, Asia, Africa, and South America."
Called the GPRS Tunnelling Protocol (GTP), the affected Internet Protocol (IP)-based communications standard defines a set of rules governing data traffic over 2G, 3G, and 4G networks.
It also forms the basis for GPRS core network and its successor Evolved Packet Core (EPC), thus making it possible for users to keep connected to the Internet while moving from one place to the other.
"The GTP protocol contains a number of vulnerabilities threatening both mobile operators and their clients," the company said, "As a result, attackers can interfere with network equipment and leave an entire city without communications, impersonate users to access various resources, and use network services at the expense of the operator or subscribers."
The main flaw stems from the fact that the protocol does not check for the subscriber's actual location, thereby making it difficult to verify if the incoming traffic is legitimate.
A second architectural issue resides in the manner subscriber credentials are verified, thus allowing bad actors to spoof the node that acts as an SGSN (Serving GPRS Support Node).
More concerning is the potential for fraud and impersonation, wherein the attacker leverages a compromised identifier to use mobile Internet at the legitimate user's expense.
In an alternate scenario, a malicious actor can hijack user session data containing relevant identifiers (e.g., phone number) of a real subscriber to impersonate that individual and access the Internet.
"These attacks can also be used by a dishonest MNO to create roaming traffic, with the MNO (falsely) charging another operator for non-existent roaming activity of that operator's subscribers," the report said.
"On all tested networks, it was possible to use mobile Internet at the expense of both other subscribers and the operator."
With 5G networks making use of EPC as the core network for wireless communications, Positive Technologies said they are equally vulnerable to spoofing and disclosure attacks.
It added that every tested network was susceptible to denial of service against network equipment, therefore preventing valid subscribers from connecting to the Internet and resulting in disruption of mobile communication services.
"Mass loss of communication is especially dangerous for 5G networks, because its subscribers are IoT devices such as industrial equipment, Smart Homes, and city infrastructure," the researchers said.
To mitigate the security issues, the firm is urging operators to carry out whitelist-based IP filtering at the GTP level, in addition to following GSMA security recommendations to analyze traffic in real-time, as well as take actions to block illegitimate activity.
"Security must be a priority during network design," the report concluded. "This is truer now than ever before as operators begin to tackle construction of 5G networks."
"Attempts to implement security as an afterthought at later stages may cost much more: operators will likely need to purchase additional equipment, at best. At worst, operators may be stuck with long-term security vulnerabilities that cannot be fixed later."
