Exploits & Vulnerabilities
Private 5G Security Risks in Manufacturing Part 3
We can see signs of increased activity in areas of business that use 5G around the world. 5G technology will usher in new personal services through smartphones, and it will also play a large part in industry.
Save to Folio
The option of Private 5G lets private companies and local governments have their own telecom infrastructures. However, the "democratization of communications" entails its own risks that have not yet been made clear. To identify these risks, Trend Micro performed tests using an environment modeled after a steelworks with 5G equipment. In this third installment, we will describe the four penetration routes and three signal interception points identified in these tests, and we will discuss attack scenarios that exploit these weaknesses.
Trend Micro carried out a field test to shed light on the potential security risks involved with implementing Private 5G. We investigated the potential for cyber attacks using a testbed modeled after a steelworks. The three highlights of our experiment are as follows:
- An open Private 5G system has four possible penetration routes.
- There are three signal interception points in the core network.
- The core network can be used as a springboard to attack the manufacturing site.
Let's look at each one in more detail below.
Four penetration routes
It is imperative to understand that if an organization migrates to open options for the hardware and software that make up the core network and radio access network, this configuration bears the same risk for vulnerabilities as an open IT environment. Recently, many companies are building PoCs with a view to implementing a full-scale Private 5G configuration going forward. However, only a rare number of cases include cyber security in the list of items to verify. Owing to the nature of the general-purpose servers and open-source software that make up the Private 5G network, the infrastructure could house severe vulnerabilities if due thought is not given to security when installing the network. If the manufacturing environment is deeply intertwined with the mobile communication system, it may not be easy to apply patches since the manufacturing site may prioritize availability as a matter of policy. As such, it is crucial to watch out for potential vulnerabilities.
① CN hosting server
As Private 5G grows more and more mainstream going forward, we can expect organizations to use general-purpose servers to host their core networks with the aim to cut costs. We also used a regular x86 server to host the core network in our field test. As the trend toward open infrastructure continues, it is imperative to be vigilant of potential vulnerabilities being exploited in the core network hosting server. This is a crucially important area with respect to building the core network environment in a Private 5G configuration, considering that we are seeing an increase in both users and vulnerabilities in Linux OS.
② VM/Container
It is also imperative to consider the vulnerabilities in containers and other virtualized environments. At Trend Micro, we are aware of a type of attack called "container escape" in which the attacker can go through the container to infiltrate the host server. Container technology will play a big role in 5G core networks, and container images are largely made up of open-source packages such as SQL database engines and programming languages. As such, these packages require the same kind of precautions for code that was downloaded from an external source: Looking up who made the libraries, and reviewing the code to make sure it is not malicious. Considering that it is crucial to work closely with the system integrator when building a Private 5G configuration, the user organization (and asset owner) must proactively request the system vendor and integrator to implement security measures in the container environment.
③ Network infrastructure
Another avenue for infiltration is the network infrastructure, including routers and firewalls. Private 5G solutions use switches, routers, and other networking equipment in the core network. It is crucial to manage and mitigate vulnerabilities in this equipment just like for any regular IT system.
④ Base station
Base station security research still has a way to go at the moment, but we found some vulnerabilities with our tests. We escalated these vulnerabilities with the vendor, who said that this issue could only be found in the model sold for testing and not in the regular product. However, verification environments often include important documents and intellectual property, so it is crucial to secure the same level of security for equipment in the verification environment as in the production environment. In any case, we strongly recommend that the owner of the base station carries out penetration tests on site, and to check that the base is sufficiently protected and that there are no similar vulnerabilities in the production environment.
These are the four potential penetration routes that we identified in our research. These vulnerabilities in Private 5G configurations may not necessarily be exposed on the Internet for cyber attackers to access, though it is crucial to remember that vulnerabilities and attack methods can be shared widely as infrastructure becomes more open.
Three signal interception points
Once an attacker has got into the core network through one of the routes described above, they will go to the next phase: Intercepting and tampering with data. In our test, we identified three interception points within the user plane that processes user data (Fig. 2).
The first point is the link between the core network and the Internet (marked with a 1 in the figure). This is the backhaul that connects the core network to the outside. The second point is where the SGW and PGW talk to each other (marked with a 2 in the figure). This is the point between the serving gateway for user data and the packet data network gateway that connects to external network. The third and final point is between the base station and the core network (marked with a 3 in the figure). This is where data comes from user equipment into the user plane. Data can be intercepted or tampered with if it is sent between any of these points as plaintext without encryption.
This risk can be effectively mitigated by choosing a protocol with encryption, or by implementing IPsec or a VPN. Either way, IT administrators need to remember that 5G systems do not support encryption by default.
If an attacker manages to use one of these interception points, they can start their attack on the manufacturing site.
Six attack methods
In our research, we identified a total of six methods for attacking the manufacturing site (Table 1).
The first three methods in the table bring physical damage by tampering with user data in the core network. As such, these three require particular attention out of the six methods that we identified in our research. The fourth and fifth methods, "DNS hijacking" and "remote desktop exploits" do not directly result in physical damage, but they can be used to steal confidential information or escalate privileges. The sixth method, "SIM swapping," targets user equipment. SIM cards are a new asset that IT administrators need to manage as they are unique to mobile communication systems. For this reason, we advise administrators to implement strategies that mitigate malicious SIM card use.
Next, let's look at one possible attack scenario—disabling alerts by Modbus/TCP hijacking—to find out how much damage can actually occur when these attack methods are employed maliciously.
Attack scenario: Disabling alerts by Modbus/TCP hijacking
The schematic for this scenario is given in Fig. 3. Here, the aim is to impair the manufacturing process. The attacker can exploit a vulnerability in the core network's host server to get inside the core network.
The attacker then uses the network as a springboard to send an illegitimate command through Modbus/TCP to the PLC associated with a temperature control valve. This causes the valve to malfunction, so part of the steel-making process gets set to a higher temperature than normal. This in itself affects the manufacturing process, but the attacker does not stop here. They can pull a trick in the core network to spread the damage even further.
Strict temperature control is imperative at a steelworks, so the on-site temperature is continually monitored by sensors. This temperature information is sent to the HMI. If the data received by the HMI deviates from the prescribed range, an alert is issued from the HMI. However, the attacker uses the core network as a springboard to intercept the packets from the sensor and rewrite the temperature values so they appear to be within the normal range. The signal tampered with by the attacker is sent to the administrator's HMI. This effectively disables the alert. The manufacturing site could be getting extremely hot at this point, but the administrator will not realize this, and so both the manufacturing process and products suffer damage.
This covers the four penetration routes, three signal interception points, and six attack methods that we identified in our field test. Next time, for the final installment in this series, I will discuss defensive strategies that organizations should take in light of these results, and I will describe "Security by Design" and "Seamless Joint Defense" that serve as key concepts for these strategies.
YOHEI ISHIHARA
Security Evangelist,
Global IoT Marketing Office,
Trend Micro Incorporated
Graduated from the Department of Criminology, California State University, Fresno. Joined Trend Micro after experience with sales and marketing at a hardware manufacturer in Taiwan, and SIer in Japan. Collaborates with researchers worldwide to collect and provide threat information, with a focus on factory security, 5G, and connected cars. Works as a Security Evangelist to think about cyber risks in light of social conditions, and to raise awareness about security issues as a form of geopolitical risk.