IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Flaws in 4G and 5G could allow attackers to launch DoS attacks and track location

Researchers present their findings just as manufacturers gear up to launch wave of 5G-ready handsets

Businessman making a phone call via a 5G network

Academics have discovered three new vulnerabilities in 4G and 5G networks that could allow malicious actors to track a user's location as well as intercept phone calls.

A new set of attacks, outlined in a paper named 'Privacy Attacks to the 4G and 5G Cellular Paging Protocols Using Side Channel Information', exploits the paging protocol, a mechanism which notifies a phone about an incoming call or text message.

Starting and cancelling several calls within a short period of time could trigger a paging message, without notifying a device about an incoming call, which could allow an attacker to track somebody's location.

An attacker would also be able to hijack the paging occasion fixed by the design of 4G and 5G protocols, the time period where the handset polls for services, and pair this with identifiers, such as their phone number. This attack, dubbed Torpedo, could then allow an attacker to send spoof messages or block messages altogether.

Moreover, Torpedo allows malicious attackers to spring two further attacks on their victims, named Piercer and the ISMSI-Cracking attack. The former would allow an attacker to find a user's unique international mobile subscriber identity (IMSI) on the 4G network. The latter, meanwhile, could brute force the encrypted IMSI number for both 4G and 5G numbers.

"The cellular paging (broadcast) protocol strives to balance between a cellular device's energy consumption and quality-of-service by allowing the device to only periodically poll for pending services in its idle, low-power state," the researchers explained.

"For a given cellular device and serving network, the exact time periods when the device polls for services (called the paging occasion) are fixed by design in the 4G/5G cellular protocol.

"Our paper sheds light on an inherent design weakness of the 4G/5G cellular paging protocol which can be exploited by an attacker to not only obtain the victim's paging occasion but also to identify the victim's presence in a particular cell area just from the victim's soft-identity."

The weaknesses were discovered to reside with the networks of all four major telecoms suppliers in the US, and a spattering of firms in Europe and Asian countries, including three from Germany, four providers from Austria, and one in Iceland.

The findings are the latest in a series of security concerns with 5G networks that researchers have demonstrated, well in advance of 5G becoming rolled out on a mainstream basis. Another critical vulnerability in the upcoming 3G, 4G,  and 5G network protocols, outlined by academics at the start of the month, could enable the eavesdropping of calls.

The latest research into 5G network security also emerges as a host of manufacturers debut a fleet of 5G-ready devices at this year's Mobile World Congress (MWC). These include Huawei's 5G-ready 'foldable', dubbed the Mate X, as well as the Samsung Galaxy S105G.

Featured Resources

Accelerating healthcare transformation through patient-centred medtech solutions

Seize the digital transformation opportunities to streamline patient care and optimise patient outcomes

Free Download

Big payoffs from big bets in AI-powered automation

Automation disruptors realise 1.5 x higher revenue growth

Free Download

Hyperscaler cloud service providers top ten

Why it's important for companies to consider hyperscaler cloud service providers, and why they matter

Free Download

Strategic app modernisation drives digital transformation

Address business needs both now and in the future

Free Download

Most Popular

Empowering employees to truly work anywhere
Sponsored

Empowering employees to truly work anywhere

22 Nov 2022
Defra's legacy software problem 'threatens' UK gov cyber security until 2030
Business strategy

Defra's legacy software problem 'threatens' UK gov cyber security until 2030

6 Dec 2022
US seizes millions in stolen COVID relief funds by China-backed hackers
Policy & legislation

US seizes millions in stolen COVID relief funds by China-backed hackers

6 Dec 2022