Cracking the 5G Fortress: Peering Into 5G's Vulnerability Abyss

Cracking the 5G Fortress: Peering Into 5G's Vulnerability Abyss

Speakers: Kai, PhD student, SynSec Lab at Penn State University; Yilu, PhD student, SynSec Lab at Penn State University

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=nPaSsM0eZbo

Overview

This talk, "Cracking the 5G Fortress: Peering Into 5G's Vulnerability Abyss," delivered by Kai and Yilu from Penn State University's SynSec Lab, addresses the critical security posture of 5G basebands—the essential components enabling devices to connect to 5G networks. Given 5G's pervasive deployment, not only for daily tasks like streaming and ride-sharing but also in mission-critical domains such as autonomous vehicles, smart factories, and power plants, the integrity of these basebands is paramount. A compromise in a 5G baseband can lead to severe consequences, including information leakage, phishing attacks, and service disruptions for individual users. More broadly, a compromised device could serve as an entry point for sophisticated attacks targeting the wider 5G network infrastructure, including base stations and core networks.

The researchers embarked on this project two years prior, driven by a lack of open-source 5G User Equipment (UE) testing frameworks and the nascent state of open-source 5G protocol stacks. Their primary motivation was to ascertain the security robustness of commercial 5G devices and to develop an automated methodology for testing them. The talk introduces 5G Base Checker, an innovative automated tool designed to identify security policy violations in 5G UE implementations. This framework leverages differential testing and automata learning to systematically uncover deviations from 5G specifications, highlighting potential vulnerabilities that could be exploited by malicious actors.

The significance of this research lies in its proactive approach to securing the foundational elements of 5G connectivity. By exposing vulnerabilities in widely deployed basebands and providing a framework for their automated discovery, Kai and Yilu contribute significantly to enhancing the overall security of the 5G ecosystem. Their findings underscore the urgent need for rigorous testing and adherence to protocol specifications by baseband manufacturers, ultimately aiming to safeguard the critical applications and user data that rely on 5G networks.

Background

▶ Watch: Talk introduction and 5G baseband security importance (0:00)

The advent of 5G technology has ushered in an era of unprecedented connectivity, characterized by ultra-low latency, massive capacity, and enhanced reliability. This has propelled 5G beyond traditional mobile communication into critical infrastructure sectors, including autonomous transportation, industrial control systems, and smart grids. The 5G baseband, a crucial hardware and software component within user equipment (UE) like smartphones, IoT devices, and embedded systems, is responsible for managing the intricate communication protocols with the 5G network. Its secure operation is fundamental to the trustworthiness of the entire 5G ecosystem.

Despite the critical role of 5G basebands, the research landscape two years prior to this talk presented significant challenges. There was a notable absence of open-source testing frameworks specifically designed for 5G UE, and existing open-source implementations of the 5G protocol stack were still in their early stages. This created a significant barrier for independent security researchers attempting to assess the security of commercial 5G devices. The inherent complexity and proprietary nature of baseband implementations further compounded this issue, making it difficult to gain visibility into their internal workings and identify potential vulnerabilities.

To understand the context of these vulnerabilities, it's essential to grasp a simplified 5G network architecture. A User Equipment (UE) (e.g., a smartphone) connects to a gNodeB (the 5G base station) via a radio interface. The gNodeB, in turn, connects to the 5G Core Network, which acts as the backbone. Key components within the 5G Core Network relevant to security include:

• Access and Mobility Management Function (AMF): Responsible for UE registration, connection management, mobility management, and crucially, managing security-related procedures such as authentication.
• Unified Data Management (UDM): A database storing user profiles and subscription data.
• Session Management Function (SMF): Handles the establishment and release of data sessions.
• User Plane Function (UPF): Responsible for forwarding user data packets and applying traffic rules (routing).

Before a UE can access services (like internet browsing or calls), it must register with the 5G Core Network. This involves several security procedures:

1. Radio connection establishment with the gNodeB.
2. Authentication procedure: The core network verifies the UE as a valid user.
3. Security Mode Command (SMC) procedure: Establishes ciphering and integrity protection for subsequent communications.
4. AS security activation: Activates Access Stratum (AS) security, ensuring that communications between the UE and the network are both ciphered (confidentiality) and integrity protected (tamper-proof).

These security measures are designed to prevent unauthorized access, data interception, and tampering. However, the complexity of the 5G protocol, coupled with diverse vendor implementations, creates a fertile ground for subtle security flaws. The researchers' work aimed to systematically uncover these flaws, driven by the understanding that a robust and secure 5G baseband is non-negotiable for the future of critical applications.

Key Findings

▶ Watch: Motivation for 5G security research and talk outline (2:00)

The research yielded a significant discovery of 13 distinct vulnerabilities across a broad spectrum of 5G devices. The team tested 17 different devices from five major baseband vendors: MediaTek, Samsung Exynos, Qualcomm, Unisoc, and HiSilicon. In a testament to the pervasive nature of these issues, the vulnerabilities were also identified in two different open-source 5G stack implementations, indicating that the problem is not confined to proprietary systems but can arise from the complexities of protocol interpretation and implementation across various development environments.

These 13 vulnerabilities were categorized into three primary types of flaws:

1. Acceptance of Invalid Security Header Types: The 5G protocol specifies various security header types that dictate the security context (e.g., whether a message is integrity protected or ciphered). The researchers found that some baseband implementations would incorrectly accept messages with security header types that were not valid for the current communication state or context. This could bypass intended security mechanisms.
2. Acceptance of Message Types in Invalid States: The 5G control plane protocol is inherently stateful, meaning that only a specific subset of messages should be accepted in any given state of the communication protocol (e.g., during registration, authentication, or session establishment). Several baseband implementations were found to accept messages that should have been rejected based on the current protocol state, opening doors for unexpected behavior or manipulation.
3. Mishandling of Information Elements: Information Elements (IEs) are fields within 5G messages that convey specific data or parameters necessary for protocol operation. The research revealed instances where baseband implementations mishandled these IEs, either by processing malformed ones or by accepting IEs that were inappropriate for the message type or context. This mishandling could lead to parsing errors, unexpected state transitions, or even memory corruption.

The exploitation of these flaws led to four critical types of impact:

1. Information Leak: Attackers could exploit vulnerabilities to monitor user traffic between the phone and the base station. This includes inferring sensitive browsing habits or other online activities, compromising user privacy and potentially enabling further targeted attacks.
2. Phishing Attacks: By setting up an attacker-controlled fake base station and exploiting baseband vulnerabilities, an attacker could send phishing SMS messages directly to a victim's phone. This allows impersonation of trusted entities, such as government agencies, to trick users into revealing sensitive information or performing malicious actions.
3. Downgrade Attacks: Attackers could craft specific messages to force a victim's phone to downgrade its connection from a more secure 5G network to less secure 4G or even 3G radio connections. This makes the user susceptible to well-known vulnerabilities prevalent in older generation networks, eroding the enhanced security promised by 5G.
4. Denial of Service (DoS): Exploiting these vulnerabilities allowed attackers to interrupt a user's service for a significant period. By causing the baseband to crash or enter an unrecoverable state, attackers could prevent users from accessing network services, leading to disruptions in critical communications and applications.

These findings highlight a systemic issue in 5G baseband implementations, underscoring the gap between protocol specifications and their practical realization across diverse vendor ecosystems.

Technical Deep Dive

▶ Watch: Overview of 5G network architecture (UE, GNodeB, Core) (2:40)

To systematically uncover the vulnerabilities in 5G basebands, the researchers developed an automated testing framework called 5G Base Checker. The core intuition behind this tool is differential testing. Since all 5G devices are designed to implement the same 3GPP protocol specifications, any significant difference in their behavior when presented with identical input sequences suggests a non-compliance with the standard in at least one of the devices. This non-compliant behavior then serves as a proxy for identifying potential security violations.

The challenge in applying differential testing to 5G control plane protocols, especially in an over-the-air testing environment, is the stateful nature of the protocol. Randomly generating input sequences would be highly inefficient and time-consuming due to the slow nature of over-the-air communication and the vast state space. To overcome this, 5G Base Checker employs automata learning techniques to synthesize Finite State Machines (FSMs) that model each device's protocol behavior.

The 5G Base Checker framework comprises three main components:

1. StateSynth: This module is responsible for synthesizing the FSMs for each 5G UE implementation under test.

• Input: A set of 5G UE implementations (the devices being tested).
• Output: A set of corresponding FSMs, each representing the observed behavior of a device.
• Methodology: StateSynth utilizes a novel hybrid and collaborative learning technique to significantly improve the efficiency of FSM learning. Instead of learning each device's FSM independently, this collaborative approach likely shares insights or common states identified across devices, accelerating the overall process. The FSMs are constructed sequentially for all target devices.

1. DevScan: Once the FSMs are constructed, DevScan takes over to identify deviations.

• Input: All extracted FSMs from the StateSynth module.
• Process: DevScan reduces the problem of finding behavioral differences to a model checking problem. It checks the property: "given the same input message sequence, do two (or more) FSMs produce different outputs?" A different output indicates a deviation.
• Algorithm: To ensure comprehensive capture of all unique deviations, DevScan incorporates a graph traversal algorithm. This means it can identify multiple paths or sequences of messages that lead to the same vulnerability or deviation, providing a more complete picture of the attack surface.

1. DevLyzer: The final component, DevLyzer, is designed for triaging the identified deviations and determining their security implications.

• Process: Initially, all deviations are marked as "unresolved." DevLyzer picks an unresolved deviation and presents it to a security expert for manual analysis.
• Expert Role: The security expert consults the 5G specifications (3GPP standards) to determine the correct behavior for the given input sequence that caused the deviation. Based on this, the expert writes one or more Linear Temporal Logic (LTL) properties. LTL is a formal language used to specify properties of sequences of states, making it ideal for defining correct protocol behavior over time.
• Automation: DevLyzer then uses these LTL properties to automatically triage a set of similar deviations. This iterative process continues, with the security expert adding more LTL properties as new types of deviations are encountered, until all identified deviations are triaged and categorized as either specification violations or underspecified behaviors.

The 5G control plane message structure is fundamental to understanding the flaws. Messages typically consist of:

• RRC (Radio Resource Control) message: Handled between the phone (UE) and the base station (gNodeB).
• NAS (Non-Access Stratum) message: Encapsulated within RRC messages and handled between the phone (UE) and the 5G core network.
• Message Type: Identifies the purpose of the message (e.g., Registration Request, Authentication Request).
• Security Header Type: Controls the integrity protection and ciphering algorithms applied to the message. Incorrect handling here is a key vulnerability.
• Information Elements (IEs): Specific data fields within messages that carry parameters for protocol functions. Mishandling of these is another source of vulnerabilities.

By systematically learning device behaviors, comparing them, and formally verifying deviations against specifications, 5G Base Checker provides a robust and efficient way to uncover deep-seated vulnerabilities in complex 5G baseband implementations.

Demo / Proof of Concept

▶ Watch: Key 5G core functions and security registration process (4:00)

The talk featured two compelling end-to-end vulnerability exploitation demonstrations, showcasing the practical impact of the discovered flaws. These demos leveraged a sophisticated attacker setup comprising Software Defined Radios (SDRs) and open-source 5G network components.

The attacker's lab setup included:

• SDR Hardware: USRP B210, a widely used platform for wireless research.
• Open-source 5G Stack Implementations:
• Open Air Interface (OAI): Served as the attacker's fake gNodeB (base station).
• Open5GS: Served as the attacker's fake 5G Core Network.

1. 5G AKA Bypass Attack

This attack demonstrates a complete bypass of the 5G Authentication and Key Agreement (AKA) procedure, leading to an unsecure connection and enabling various malicious activities.

Attack Steps:

1. Fake Base Station Setup: The attacker sets up a fake base station (using USRP B210 and Open Air Interface) and a fake 5G Core (Open5GS).
2. Luring the UE: The fake base station broadcasts signals that lure a legitimate UE to attempt to register with it.
3. Registration Request Interception: The victim UE sends a legitimate Registration Request message to the fake base station.
4. Forged Registration Accept: Instead of performing the standard authentication procedure, the attacker immediately sends a forged Registration Accept message back to the UE. Crucially, this message is crafted with security header type four.

• Violation 1 (Security Header Type): According to 5G specifications, a Registration Accept message with security header type four should be both ciphered and integrity protected with a new 5GS security context. However, the attacker sends this message in plain text, exploiting a vulnerability where the specific baseband accepts an unencrypted message that should have been encrypted.
• Violation 2 (Protocol State): Security header type four is typically reserved for the Security Mode Complete message, which is sent from the phone to the network after security mode activation. Sending it in a Registration Accept from the network to the phone is a protocol state violation.

1. Consequence of Bypass: Because the UE accepts this malformed Registration Accept message, the crucial authentication and security mode command procedures are effectively bypassed. No secure connection (ciphering or integrity protection) is established between the phone and the network. All subsequent communications are therefore in plain text and vulnerable to modification.
2. PDU Session Establishment: To grant the victim UE internet access, the attacker then exploits another vulnerability. The UE sends a PDU Session Establishment Request. The attacker responds with a PDU Session Establishment Accept message, again with security header type four, which the vulnerable UE accepts in plain text.
3. RRC Reconfiguration Vulnerability: To fully enable data plane connectivity, the attacker encapsulates the entire NAS packet (containing the PDU Session Establishment Accept information) into an RRC Reconfiguration message. This RRC Reconfiguration message includes a specific information element, DRB to add mod list, which is critical for establishing a data radio bearer.

• Violation 3 (Plain Text RRC Reconfiguration): This RRC Reconfiguration message, especially with the DRB to add mod list IE, should not be accepted in plain text after a supposed security mode command. However, the exploited baseband accepts this message unencrypted.

1. Attack Outcome: As a result, the victim UE establishes a data connection through the attacker's fake base station, completely unaware that its traffic is unencrypted and unprotected. The demo vividly showed the victim able to watch YouTube videos without any warning from the UE, demonstrating a complete compromise of confidentiality and integrity.

• Impact: The attacker can infer which websites the user is browsing (information leak) and even modify DNS packets to launch DNS hijacking attacks, redirecting the user to phishing websites or distributing malware.

2. Phishing SMS Injection

Building upon the success of the 5G AKA Bypass Attack, the researchers demonstrated how an attacker could inject phishing SMS messages.

Attack Steps:

1. Post-AKA Bypass: After the 5G AKA Bypass attack successfully establishes an unsecure connection, the attacker's fake base station has control over the communication.
2. Downlink NAS Transport: The attacker sends a Downlink NAS Transport message to the victim UE. This message is crafted to contain a phishing SMS.
3. Impersonation: Since the connection is unsecure and the attacker controls the network, they can spoof the sender identity. The demo illustrated how an attacker could impersonate a government agency to send a highly convincing phishing SMS to the user.

These demonstrations underscore the severe real-world implications of the discovered vulnerabilities, ranging from passive surveillance to active manipulation and impersonation, all stemming from fundamental protocol implementation flaws in 5G basebands.

Defensive Implications

▶ Watch: Automated 5G baseband testing tool and AKA bypass demo (6:00)

The findings from "Cracking the 5G Fortress" present significant implications for all stakeholders in the 5G ecosystem, demanding a multi-faceted approach to bolster security.

For 5G Baseband Vendors (e.g., MediaTek, Samsung Exynos, Qualcomm, Unisoc, HiSilicon), the primary defensive implication is the urgent need for stricter adherence to 3GPP specifications. The discovered vulnerabilities, particularly those related to accepting invalid security header types, messages in incorrect states, and mishandling information elements, point to implementation flaws rather than specification weaknesses. Vendors must:

• Implement robust state machine validation to ensure that messages are only processed if they conform to the expected protocol state.
• Perform thorough input validation on all incoming messages, strictly rejecting those with invalid security header types or malformed information elements.
• Conduct comprehensive security audits and fuzz testing on their baseband firmware before deployment, potentially integrating automated tools like 5G Base Checker into their development and quality assurance pipelines.
• Prioritize rapid patching and deployment of firmware updates to address discovered vulnerabilities, ensuring a clear communication channel with network operators and device manufacturers.

Network Operators also bear a responsibility in mitigating these threats. While they don't directly control baseband implementations, they can:

• Monitor for anomalous network behavior, such as sudden downgrades of UE connections from 5G to 4G/3G, or attempts by UEs to establish connections with unencrypted traffic where ciphering is expected.
• Implement robust intrusion detection systems within their core networks to identify and block suspicious traffic patterns originating from potentially compromised UEs or fake base stations.
• Collaborate closely with baseband vendors to ensure timely deployment of security patches and to understand the risks associated with various UE models on their network.
• Consider deploying enhanced authentication mechanisms or network-side checks that could detect deviations from expected security procedures, even if a UE's baseband is compromised.

For End Users, while direct action against baseband vulnerabilities is limited, awareness is key:

• Be wary of unsolicited SMS messages, especially those that impersonate government agencies, banks, or other trusted entities. The phishing SMS injection demo highlights the ease with which such messages can be delivered.
• Keep device software and firmware updated to ensure any security patches from vendors are applied.

More broadly, the research underscores the importance of open-source development and security research in the 5G domain. The lack of open-source testing frameworks and nascent open-source protocol stacks created a blind spot that this research helps to address. Continued investment in and collaboration around open-source 5G tools and reference implementations can foster transparency, accelerate vulnerability discovery, and ultimately lead to more secure commercial products. The methodology employed by 5G Base Checker—differential testing, automata learning, and LTL property-based triaging—provides a blueprint for how future 5G security validation should be conducted, moving beyond mere compliance checks to proactive vulnerability hunting.

Key Takeaways

• 5G Basebands are Critical and Vulnerable: The 5G baseband, a core component in all 5G devices, is a significant attack surface. Flaws in its implementation can lead to severe security breaches impacting user privacy, service availability, and critical infrastructure.
• Automated Differential Testing is Effective: The 5G Base Checker tool demonstrates that differential testing combined with automata learning is an efficient and scalable approach to automatically identify protocol-level vulnerabilities in complex, stateful 5G baseband implementations.
• Widespread Vulnerabilities Across Major Vendors: The research uncovered 13 vulnerabilities across 17 devices from five major baseband vendors (MediaTek, Samsung Exynos, Qualcomm, Unisoc, HiSilicon) and two open-source 5G stacks, indicating a systemic challenge in adhering to 5G specifications.
• Severe Impacts from Protocol Flaws: The identified flaws—accepting invalid security headers, messages in incorrect states, and mishandling information elements—can be exploited for information leakage, phishing attacks, downgrade attacks, and Denial of Service (DoS), with real-world implications.
• Demonstrated End-to-End Exploitation: The 5G AKA bypass attack and phishing SMS injection demos illustrate how attackers can establish unsecure connections, monitor traffic, hijack DNS, and send spoofed messages by exploiting baseband weaknesses, even allowing a victim to browse the internet through an attacker-controlled network without warning.
• Urgent Need for Enhanced Security Practices: Baseband manufacturers must prioritize rigorous adherence to 3GPP specifications, implement robust state machine validation, perform thorough input validation, and integrate automated security testing frameworks into their development lifecycle to build more resilient 5G devices.

About the Speaker(s)

The talk was presented by Kai and Yilu, both PhD students from the SynSec Lab at Penn State University. Their research focuses on the critical area of 5G security, specifically investigating the vulnerabilities within 5G user equipment baseband implementations. Their work, including the development of the 5G Base Checker tool, highlights their expertise in network protocol analysis, automated security testing, and the practical exploitation of communication system vulnerabilities.