How to assess
cellular network vulnerabilities

If there’s anything the past year has taught us is that connectivity is critical to business continuity. Not only businesses but governments and infrastructure services rely increasingly on cellular connectivity to enable distributed working and the digital transformation of legacy systems.

As the dependence on cellular networks increases, so does its attractiveness to malefactors and cybercriminals. Add to that the growing proliferation of IoT devices, and the ever-expanding 5G network coverage? It becomes very clear why now, more than ever, it’s up to mobile connectivity providers to mitigate these threats to both private and public cellular networks under their care.

What is a cellular network vulnerability assessment?

A cellular network vulnerability assessment is a process that lists and rates the severity of every type of cellular network vulnerability that may threaten a specific network. 

A mobile network operator can (and should) offer possible solutions for mitigation to their private cellular network clients. These tools can be used to reduce both the risk and the severity of a security event.

6 Reasons why you need to assess cellular network vulnerability

Assessing a cellular network’s security is the first step to take on the path to protecting any cellular network from bad actors and bad practices. Today, critical infrastructure and services (such as power and water utilities) are becoming increasingly dependent on stable and secure cellular connectivity. It can often be about more than just money – sometimes human lives can be at risk when cellular connections and the IoT devices on them are left unprotected.

The explosion in IoT across industries and applications is hardly the only reason for the need for regular assessment of cellular network vulnerability. As the past year has shown – reliable remote connectivity is key to business continuity.

1. Maintain network stability & uptime

Understanding which pieces of software, hardware, and infrastructure may be vulnerable. Lets you identify and address issues before they become problems. This will help limit network downtime and disruption of service to the absolute minimum, even in case of a security event.

2. Avoid costly cybersecurity breaches

The potential repercussions from an unexpected attack. Being aware of the threats and preparing for them may help you avoid operation costs, lost business, and other damages.

3. Secure Intellectual Property

A data breach resulting from a cellular network vulnerability may lead to a public leak of Intellectual Property and personally-identifying information. This can trigger government oversight, fines, and customer remediation.

4. Protect your brand reputation

An attack on your cellular network or those of clients can negatively damage your company’s reputation in the eyes of existing and prospective customers. This can be especially impactful if hacks and breaches happen frequently, like in the case of T-Mobile.

5. Ensure regulatory compliance

Depending on your current jurisdiction, there may be regulatory demands your cellular network must comply with according to local stature. For example, radio frequencies a private network operates on must be part of the licensed spectrum. This means that a misconfiguration or attack may land you a fine or worse.

6. Prepare an upgrade path

Outdated cellular software protocols and obsolete hardware may be vulnerable beyond repair (no longer patched or supported). By assessing existing network infrastructure and connected devices, you can determine the types of vulnerabilities you may have to address and the upgrade path required to mitigate risks.

How to assess cellular network vulnerability: methodologies & approaches

The approach to vulnerability assessment of cellular networks depends on the type of network and its applications. While new deployments face certain threats, old legacy systems may present different vulnerabilities. It’s important for cellular service operators to take them into consideration and take steps to assess and evaluate threats.

A reliable cellular network requires a risk assessment plan for every type of network security event. Whether it’s hardware, software, or infrastructure – you must map-out the likelihood of an event disrupting normal operations. Moreover, you will need to plan what equipment and personnel are required to quickly restore connectivity.

How to assess vulnerabilities in cellular network infrastructure

Understand the flaws in the Signaling System 7 protocol

The potential dangers of the SS7 protocol cannot be understated. This ancient protocol underlying 2G and 3G cellular networks and even used by some 4G networks for SMS messaging and establishing calls? Is currently the most significant attack vector threatening cellular network security. 

With user-location tracking, eavesdropping, SMS message interception, and even service cut-off exploit lurking out in the wild? If your network relies on the SS7 protocol, it is recommended that you adhere to GSMA security recommendations and constantly monitor SS7 traffic for suspicious activities. In addition, you should employ in-house or third-party solutions that detect and mitigate these attacks in real-time.

Monitor the Diameter Signaling Protocol

The diameter signaling protocol is used by 4G and 5G networks to coordinate data among different network elements. This protocol has known vulnerabilities that can be used to amplify a denial of service attack. 

This vulnerability originates from the Diameter Signaling Protocol’s inability to distinguish between fake and legitimate traffic. The vulnerability has been known since 2018 and no fix is in sight. As of this writing, Real-time network monitoring for suspicious behavior is the only known mitigation for this issue.

Protect from APN Flooding

To prevent your APN from flooding by malicious actors, degrading service quality for legitimate users? You can use IP reputation-based blocking and real-time traffic monitoring for malicious activity.

Use a DNS blacklisting service

A DNS blacklisting service can be used to protect network users from accessing known sites used by scammers and hackers to infect vulnerable devices.

Defend against SIM swapping/porting

SIM swapping is becoming an ever-increasing vulnerability for both mobile operators and their customers. To defend your cellular network from SIM swapping attacks, you must implement policies and solutions that prevent unauthorized switching or porting of SIM cards.

Protect Edge Equipment

Equipment such as towers at the edge of your network may be publicly accessible and susceptible to physical intrusion. By recognizing this danger and implementing intrusion detection capabilities, compromised equipment can be detected quickly and taken offline.

Consider the Source

Consider the security, reliability, and stability of your equipment manufacturers and software vendors. Whether it’s software, hardware, or infrastructure? You must use reputable sources in your cellular network in order to protect against backdoors, ensure long-term reliability, and maintain access to security updates. 

Understand the risks of a poorly maintained network

Firmware patches for network equipment and software security updates are released regularly. When these patches are released to the public, it makes it easier for hackers to find unpatched software or hardware to exploit. Make sure your network software and equipment are constantly and consistently updated with the latest security patches.

Apply 5G software-defined network updates

5G is still a new protocol. Worldwide roll-out is still in its infancy for both devices and network operators. As such, there is a limited history of attacks. However, the 5G protocol was designed around software-defined networking, which means that as software, it is very flexible and can be updated quickly to add new features. 

On the other hand, with more features, it’s more exposed to software vulnerabilities and must constantly be updated with the latest patches and firmware updates.

Close holes with penetration testing

One of the best ways to assess unknown network vulnerabilities, vulnerabilities you may not have even considered, is to hire a professional penetration testing service. A professional penetration testing team can test and evaluate every aspect of a cellular network, from edge devices to core network functionality.

Securing IoT devices on Private Cellular Networks

A relative newcomer to the world of wireless cellular connectivity is the IoT device. IoT devices on public and private cellular networks are growing in numbers, while presenting new security challenges to cellular network operators and users alike.

IoT devices with cellular connectivity introduce additional attack vectors to already vulnerable devices. On most such devices, there is no firewall to block external connections. IoT device manufacturers rarely focus on security, and the extended range of cellular networks opens up long-distance hacking opportunities.

Know your network

To better protect a cellular network, you must first map out the types of devices connected to it. According to a Gartner IoT Security survey, only 30% of enterprise network managers were confident about Things (devices) on their network and only 44% had an IoT security policy in place. Even respondents who initially thought they had no IoT devices on their network quickly realized they had, on average, 8 different classes of IoT devices already in-use on their network. 

Create an IoT security policy

To prevent unauthorized devices from being used on your private cellular network, an IoT security policy must be put in place. The policy needs to cover the device class and models allowed on the network and how to configure each device with additional security using strong passwords and encrypted transport protocols.

Understand Bad Applications

Users may try running applications on the network that may compromise network security. By allowing only approved applications and services on the network level, you can limit exposure to a small subset of approved applications.

Utilize 5G technologies

Beyond fixing security issues discovered in previous generations, 5G introduces a new network slicing feature. Network slicing is used to segment cellular users into sub-networks, providing different levels of service and access to each subnet. This feature can be used to add an additional layer of security to a private cellular network.

Comply with regulations

Make sure your network is operating within regulatory constraints. Operating outside of local ordinances (e.g. operating on illegal frequencies, using unauthorized equipment, etc) can result in fines, shut-down order, and even criminal liability in some cases.

Governments may require cellular networks to comply with governmental risk assessment plans, to the point of classifying critical network events as life-threatening, requiring an immediate response. Make sure you are aware of local ordinances and verify that your organization has the personal and technology required to respond to a government-mandated action within the specified time-frame.

Additionally, some governments require limiting dependency on non-local hardware and software vendors, leading to a block or cap on the number of foreign devices and services used by national cellular networks. Even further restrictions may apply when using foreign devices in core and sensitive services.

Summary

Older generations of cellular technology are inherently vulnerable due to flaws in protocols and older equipment that is no longer actively maintained. Only by understanding the risks affecting all cellular networks can you begin to plan how to protect them. This includes, among others, monitoring network traffic for unusual behavior, and utilizing 5G networking with a clear understanding of the underlying technology.