Researchers Identify 84 Flaws in 4G and 5G Core Networks, Including Session Hijacking

Discovery of Core Network Vulnerabilities

A study by researchers at Singapore's Nanyang Technological University has revealed 84 security vulnerabilities within 4G and 5G core networks. These flaws, detailed in a paper titled "Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis," affect the signaling interfaces of LTE/5G core networks.

Impact and Affected Implementations

Successful exploitation of these vulnerabilities could lead to denial-of-service (DoS) attacks and session hijacking, allowing an attacker to take control of a user's network session. The study specifically examined two LTE implementations (Open5GS and OpenAirInterface) and five 5G implementations (Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF) across the GTP-C and PFCP core signaling protocols.

Root Cause: Implicit Trust Errors

The researchers identified a common root cause for these vulnerabilities: implicit trust between core network functions. This issue, codenamed implicit trust errors (iTrue), arises from a pattern of blind trust among cellular network components, coupled with weaknesses in their interfaces. This allows external actors to exploit these flaws for malicious activities if the interfaces become reachable over the internet.

Cloud-Native Transition and Attack Surface Expansion

Historically, cellular core networks relied on physical isolation to secure interfaces. However, the shift to cloud-native deployments has made this trust model fragile and expanded the attack surface. This transition allows adversaries to potentially access previously internal interfaces, increasing the risk of exploitation.

Detection Methodology

To detect these iTrues, the study developed iFinder, an LLM-assisted multi-agent system. iFinder summarizes known flaws, categorizes them into detection patterns, and uses this information to discover new iTrues in core network implementations. Identified weaknesses include a lack of validation for message format, message semantics, and resource availability, as core network components often blindly act on messages from internal peers.