The Client
Our client is a leading RAN (Radio Access Network) operator in Northern Europe, dedicated to providing reliable connectivity across a diverse range of technologies, including 2G, 3G, 4G, and the new 5G networks.
The project involved a thorough assessment of the RAN network, operating under the premise that the core network could potentially act as an attacker.
The scope of the project included and analysis of diferent attack vectors such as the air interface or the connection between the RAN and the CORE networks
Our client had recently introduced the 5G NSA and SA technology to their RAN infrastructure, signifcantly expanding the attack surface and introducing new vulnerabilities that could be exploited by malicious actors.
The air interface has been a target for attacks, particularly since the emergence of open-source sofware tools. Researchers have identifed numerous attack vectors that pose risks to the integrity and availability of the infrastructure, necessitating a proactive approach to security.
To address these challenges, Ethon Shield implemented a unique methodology for conducting RAN security audits. Recognizing that the air interface is one of the primary attack vectors, our approach focused on several key areas:
All of these tests were conducted using affordable software-defined radio devices, which provided a realistic environment for simulating potential attacks. Through our dedicated efforts, we empowered our client to fortify their RAN network against emerging threats, ensuring robust and secure connectivity for their users. Our expertise in RAN security not only protects their infrastructure but also enhances their reputation as a trusted operator in the telecommunications industry.
Comprehensive Vulnerability Assessment: Ethon Shield’s team conducted a thorough analysis identifying potential weaknesses that could be exploited, by detecting weak authentication policies or encryption algorithms across various vendors within the infrastructure.
Signal Confguration and Management: RAN nodes require precise configuration of different reference signals which could otherwise lead to denial-of-service attacks affecting the entire network. We assessed these configurations to ensure they were secure and resistant to exploitation.
Protocol Security Analysis: We conducted an in-depth study of the connecting protocols between the RAN and the CORE network. Multiple telco protocols, while essential for reliable communication between the RAN and CORE network, has been associated with multiple legacy vulnerabilities that could be exploited by attackers.
