Flaws in 4G and 5G could allow attackers to launch DoS attacks and track location

Academics have discovered three new vulnerabilities in 4G and 5G networks that could allow malicious actors to track a user's location as well as intercept phone calls.

A new set of attacks, outlined in a paper named 'Privacy Attacks to the 4G and 5G Cellular Paging Protocols Using Side Channel Information', exploits the paging protocol, a mechanism which notifies a phone about an incoming call or text message.

Starting and cancelling several calls within a short period of time could trigger a paging message, without notifying a device about an incoming call, which could allow an attacker to track somebody's location.

An attacker would also be able to hijack the paging occasion fixed by the design of 4G and 5G protocols, the time period where the handset polls for services, and pair this with identifiers, such as their phone number. This attack, dubbed Torpedo, could then allow an attacker to send spoof messages or block messages altogether.

Moreover, Torpedo allows malicious attackers to spring two further attacks on their victims, named Piercer and the ISMSI-Cracking attack. The former would allow an attacker to find a user's unique international mobile subscriber identity (IMSI) on the 4G network. The latter, meanwhile, could brute force the encrypted IMSI number for both 4G and 5G numbers.

"The cellular paging (broadcast) protocol strives to balance between a cellular device's energy consumption and quality-of-service by allowing the device to only periodically poll for pending services in its idle, low-power state," the researchers explained.

"For a given cellular device and serving network, the exact time periods when the device polls for services (called the paging occasion) are fixed by design in the 4G/5G cellular protocol.

"Our paper sheds light on an inherent design weakness of the 4G/5G cellular paging protocol which can be exploited by an attacker to not only obtain the victim's paging occasion but also to identify the victim's presence in a particular cell area just from the victim's soft-identity."

The weaknesses were discovered to reside with the networks of all four major telecoms suppliers in the US, and a spattering of firms in Europe and Asian countries, including three from Germany, four providers from Austria, and one in Iceland.

The findings are the latest in a series of security concerns with 5G networks that researchers have demonstrated, well in advance of 5G becoming rolled out on a mainstream basis. Another critical vulnerability in the upcoming 3G, 4G, and 5G network protocols, outlined by academics at the start of the month, could enable the eavesdropping of calls.

The latest research into 5G network security also emerges as a host of manufacturers debut a fleet of 5G-ready devices at this year's Mobile World Congress (MWC). These include Huawei's 5G-ready 'foldable', dubbed the Mate X, as well as the Samsung Galaxy S105G.