A successful attack against the 5G network could disrupt critical infrastructure, manipulate sensor data, or even cause physical harm to humans.
RSA CONFERENCE — San Francisco — While 5G security is not new as a topic of conversation, emerging attack vectors continue to come to the fore. Deloitte & Touche researchers have uncovered a potential avenue of attack targeting network slices, a fundamental part of 5G’s architecture.
The stakes are high: Not just a faster 4G, the next-generation 5G network is expected to serve as the communications infrastructure for an array of mission-critical environments, such as public safety, military services, critical infrastructure, and the Industrial Internet of Things (IIoT). They also play a role in supporting latency-sensitive future applications like automated cars and telesurgery. A cyberattack on that infrastructure could have significant implications for public health and national security, and impact a range of commercial services for individual enterprises.
At the heart of any 5G network is a flexible, IP-based core network that allows resources and attributes to be assembled into individual “slices” — each of these network slices is tailored to fulfill the requirements requested by a particular application. For instance, a network slice supporting an IIoT network of sensors in a smart-factory installation might offer extremely low latency, long device battery life, and constricted bandwidth speed. An adjacent slice could enable automated vehicles, with extremely high bandwidth and near-zero latency. And so on.
Thus, one 5G network supports multiple adjacent network slices, all of which make use of common physical infrastructure (i.e., the radio access network, or RAN). Deloitte collaborated on a 5G research project with Virginia Tech to explore whether it was possible to exploit 5G by compromising one slice, then escaping it to compromise a second. The answer to that turned out to be yes.
“Throughout our journey with Virginia Tech, our objective was uncovering how to make sure that appropriate security is in place whenever a 5G network is put in for any type of industry or any customer,” Shehadi Dayekh, a specialist leader at Deloitte, tells Dark Reading. “We saw network slicing as a core area of interest for our research, and we set about discovering avenues of compromise.”
Achieving Lateral Movement Via Network Slicing
Abdul Rahman, associate vice president at Deloitte, notes that attacking one slice in order to get to a second could be seen as a form of container escape in a cloud environment — in which an attacker moves from one container to another, moving laterally through a cloud infrastructure to compromise different customers and services.
“When we look at the end-to-end picture of a 5G network, there’s the 5G core, and then the 5G RAN, then there are the end devices and the users after the end devices,” he says. “The core has really evolved to a point where a lot of the services are essentially in containers, and they’ve been virtualized. So there may then be a similar [attack-and-escape] process where we’re able to influence or affect a device on network slice two from a device or a compromise within network slice one.”
The research uncovered that an initial compromise of the first network slice can be achieved by exploiting open ports and vulnerable protocols, he explains. Or, another path to compromise would involve obtaining the metadata necessary to enumerate all of the services on the network, in order to identify a service or a set of services that may have a vulnerability, such as a buffer overflow that would allow code execution.
Then, to achieve “slice-escape,” “there are capabilities in the wireless space to emulate tons of devices that can join networks and start causing some stress on the core network,” Dayekh says. “It’s possible to bring in some scanning capabilities to start exploiting vulnerabilities across slices.”
A successful attack would have a number of layers and steps, and would be non-trivial, Deloitte found — but it can be done.
From a real-world feasibility perspective, “it’s really dependent on how much money is spent,” Dayekh says, adding that cyber attackers would likely make an ROI calculation when weighing whether an attack is worth the time and expense.
“It’s about how serious [and hardened] the network is if it’s a mission-critical network, and how serious the target application is,” he explains. “Is it an application for, say, shelf replenishment or cashier-less checkout, or is it a military or government application?”
If the attacker is a well-funded advanced persistent threat (APT) interested in mounting destructive attacks on, say, an automated pipeline, the approach would be more convoluted and resource-intensive, Rahman adds.
“This sets the stage for a bad actor that utilizes advanced recon and surveillance-detection techniques, to minimize on the blue side being seen,” he says. “You utilize observation to determine avenues of approach and key terrain while ensuring concealment. If we’re going to recon a network, we want to do it from a place where we can scan the network and obfuscate our reconnaissance traffic amongst all the other traffic that’s there. And they’re going to build this network topology, aka an attack graph, with nodes that have metadata associated with enumerative services around what we would like to attack.”
Real-World Risk
When it comes to potential outcomes of a successful attack, Rahman and Dayekh used the example of a campaign against an industrial sensor network for a smart-factory application.
“Ultimately, we can deploy malware that can actually impact the data that’s gathered from those sensors, whether it’s temperature, barometric pressure, its line of sight, computer vision, whatever that may be,” Rahman notes. “Or it may be able to occlude the image or maybe only send back a portion of the results by manipulating what the sensor has the ability to see. That could potentially cause false readings, false positives, and the impact is huge for manufacturing, for energy, for transportation — any of those areas that depend on sensors to give them near-real-time outputs for things like health and status.”
The Internet of Medical Things (IoMT) is another area of concern, due to the ability to directly impact patients using remote health services such as kidney dialysis or liver monitoring, or those who have a pacemaker. Read more: https://bit.ly/3MrGebT
You can also read this: CISA Publishes 5G Security Evaluation Process Plan