5GMap: Enabling external audits of access security and attach procedures in real-world cellular deployments

Abstract

In cellular networks, security vulnerabilities often arise from misconfigurations and improper implementations of protection mechanisms. Typically, ensuring proper security configurations is the responsibility of network operators. The tool described in this paper, called 5GMap, empowers legitimate subscribers, equipped with software-defined radios (Ettus B210 or X310), with innovative means and methodologies for auditing security configurations of the access networks they are connecting to. Specifically, 5GMap allows to evaluate negotiable ciphers, predictability of temporary identifiers (TMSI), resilience against disclosure of privacy-sensitive identifiers (IMSI, IMEI), and susceptibility to downgrade attacks. 5GMap achieves this by iterating access and attach primitives using either carefully crafted signaling messages requiring specific cryptographic configuration, as well as custom methodologies such as using predictable TMSIs and querying the network with non-standard signaling message sequences to detect potential departures from the expected protocol specification. Extensive testing over four mobile network operators and three virtual network operators reveals significant security and privacy issues: many networks allow unencrypted or even unauthenticated communication, TMSI randomness and IMSI concealment are not consistently ensured across all operators tested, and many other fine-grained concerns emerge among different operators. We believe that our findings highlight the usefulness of tools like 5GMap to assess (and ultimately improve, through responsible disclosure) the security posture of 4G and 5G cellular networks in the wild.