Are major communication systems vulnerable?
- Communication networks are vulnerable to cyber-attacks despite the trust placed in operators.
- Current 5G communication standards have improved with regards to 4G, notably with the 5G AKA protocol, which strengthens phone identifier protection and mobile device location.
- Risks remain, however, particularly via roaming networks; malicious attackers can intercept information by masquerading as legitimate mobile networks.
- Government proposals to remotely monitor devices are also regularly put forward, notably to combat terrorism or child pornography.
- These measures do raise ethical questions though and include the risk of false positives, possible political abuse and lack of transparency.
We use our mobile phones today for a host of reasons: to telephone, send text messages, exchange images or shop online. To do this, we need to connect to the communications network (which transmits information between different devices and systems). This network is prey to attack, however. “Rogue (or fake) base stations” for example, take advantage of the confidence we have in network operators and other service providers to weaken security.
“With each new generation of mobile communications, changes are made to security protocols,” explains Jannik Dreier. “The problem is that most of the protocols that exist today date back to the introduction of digital telephones, but security guarantees have, of course, moved on greatly since then.”
One of the changes brought about by the switch to 5G concerns privacy protection. To secure communications, the device and the network must be able to authenticate each other when they connect. During the connection and exchange (of data, speech or images), however, the user’s identity and location as well as the content of the exchange must be kept confidential. A communications protocol called Authentication and Key Agreement (AKA) has been used to achieve this since the 3G standard was introduced. This means that messages are encrypted thanks to a key exchanged during connection.
Improved, but not perfect, data protection
Today’s 5G communication standard is therefore based on the 5G AKA protocol1. This new protocol has considerably improved phone identifier protection compared with 4G technology and, in particular, has solved a problem previously exploited by IMSI (International Mobile Subscriber Identity) interceptors. With these devices, the IMSI of a mobile phone card could be intercepted to determine where a mobile device was located – and therefore track a user. How could this be done? By simply listening in to transmissions between the mobile phone and the mobile network antenna – the IMSI being sent unencrypted. This is no longer possible with 5G AKA.
“Although this part of the protocol has been improved now, the protocol as a whole is far from perfect,” warns Jannik Dreier. “It’s as if we’ve just ‘plugged a hole’. If we were to reformulate this protocol and start from scratch, as it were, we would build it completely differently. That’s often the case in technology.”
“While the connection between a telephone and the antennae (base stations) is protected, the problem is that the data is no longer protected on the wired network,” he explains. The network and the operator are trusted entities, and this trust creates a potential vector for eavesdropping, surveillance or even direct attack. “The use of equipment from China, in particular, has been the subject of much debate, because a ‘hidden door’ could be used for espionage or outright to create a sort of ‘red button’: if pressed, the network and all communicating devices would immediately stop functioning.”
Another problem: mobile phone networks allow us to use our phones in roaming mode by connecting to a network other than that of our native operator (when we are abroad, for example2). The danger here: an attacker could make us think that our phones are roaming and set up a rogue base station, that is, a malicious device used to mimic a legitimate mobile network base station. As communications are only protected up to the fake station, the attacker is, in principle, able to intercept and monitor all traffic passing through it. Unfortunately, today’s smartphones are not very well equipped to warn us of such attacks because they easily accept roaming connections. Importantly, these are not always clearly visible to the user (who, moreover, does not suspect anything untoward because he may not even be abroad).
Rogue base stations can also be used for other purposes – for example (and with the help of mobile network operators), by the police and intelligence services for fighting crime or for surveillance purposes. In addition to telephone conversations and messages, service providers can track all other types of content passing through the fake base station.
Surveillance of electronic devices: protecting against crime or restricting freedoms?
Security is not limited to the network, but also to phones themselves, particularly with the use of end-to-end encrypted communications, such as those used in applications like Signal and WhatsApp. If we protect communications from end to end, each end of the transmission naturally becomes a target for attack, for both criminals and governmental services alike.
This is why propositions for remote monitoring of devices are regularly put forward, especially in the fight against terrorism and child pornography3. “But there are problems,” explains Jannik Dreier. “From a technical point of view, these approaches will necessarily affect the security of communications networks and systems for the population as a whole because they require that all devices be scanned, not just those that we suspect.”
Proposals to combat child pornography, for instance, are essentially based on comparing images with a database of known images or on artificial intelligence (AI) trained on these images. This unavoidably leads to “false negatives”, that is, images that should be detected but which aren’t. Worse still, there is the risk of “false positives”: people could be accused of a crime they did not commit because an image was wrongly identified as being pornographic by AI.
There will inevitably be a large number of these misclassifications if all images on all devices are scanned. “We also know that modifications undetectable to the naked eye can be applied to an image and that these can be misclassified by AI. We can therefore imagine attackers modifying images in this way and sending them to targets who will then be wrongly identified as being in possession of child pornography content.”
There is also a more political type of danger. “Once such an infrastructure is in place, it could then be used for other purposes and, ultimately, and especially in non-democratic countries, for repression.
“It is also important to note that we don’t know exactly how these infrastructures work because the detection algorithms behind them are not in the public domain,” he adds. “That is a problem: we wouldn’t then know on what basis we’ve been incriminated. There would be a lack of transparency. Such a strategy creates unprecedented capabilities for user surveillance and control with potentially drastic consequences for democracy in Europe and around the world.”
“We place far too much trust these days in operators and their equipment, something that introduces inherent weaknesses. Unfortunately, this situation not going to change any time soon, because it’s not financially attractive for operators,” he says. As a result, things could become even worse in the future: “If we are not able to rebuild these architectures from scratch, in a model that is less reliant on operators, we need to correct the known shortcomings. Some of these may be easy to repair, thanks to the use of end-to-end protection solutions, for example, but not others. There will never be a perfect solution.”
