Air interface
We checked the authentication policies and encryption algorithms configured on each vendor's equipment, looking for weak settings an attacker could exploit.
A leading radio access network operator in Northern Europe had just added 5G NSA and SA to a network that still ran 2G, 3G and 4G, with equipment from several vendors.
Ethon Shield tested its air interface, cell configuration and connections to the core, identified weak authentication and encryption policies, and documented every finding in a technical report with recommendations.
Three areas, all tested with affordable software-defined radio equipment to reproduce what a real attacker could attempt.
We checked the authentication policies and encryption algorithms configured on each vendor's equipment, looking for weak settings an attacker could exploit.
RAN nodes depend on precisely configured reference signals. A wrong setting can lead to denial-of-service attacks that affect the whole network, so we reviewed these configurations.
We studied the protocols linking the radio network to the core. They are essential for the network to work, and several carry known legacy vulnerabilities.
Weak authentication policies and encryption algorithms identified across vendors, giving the team a clear basis to strengthen its parameters.
Attack vectors on the air interface and the RAN–core connection analysed, so the operator could act on them before anyone exploited them.
Every finding, vulnerability and recommendation documented for the operator's technical team.
The operator is anonymised. Detailed findings and technical evidence are not published.
Talk to our team about an independent review of your radio network, its configuration and its connection to the core.
The Client
Our client is a leading RAN (Radio Access Network) operator in Northern Europe, dedicated to providing reliable connectivity across a diverse range of technologies, including 2G, 3G, 4G, and the new 5G networks.
The project involved a thorough assessment of the RAN network, operating under the premise that the core network could potentially act as an attacker.
The scope of the project included and analysis of diferent attack vectors such as the air interface or the connection between the RAN and the CORE networks
Our client had recently introduced the 5G NSA and SA technology to their RAN infrastructure, signifcantly expanding the attack surface and introducing new vulnerabilities that could be exploited by malicious actors.
The air interface has been a target for attacks, particularly since the emergence of open-source sofware tools. Researchers have identifed numerous attack vectors that pose risks to the integrity and availability of the infrastructure, necessitating a proactive approach to security.
To address these challenges, Ethon Shield implemented a unique methodology for conducting RAN security audits. Recognizing that the air interface is one of the primary attack vectors, our approach focused on several key areas:
All of these tests were conducted using affordable software-defined radio devices, which provided a realistic environment for simulating potential attacks. Through our dedicated efforts, we empowered our client to fortify their RAN network against emerging threats, ensuring robust and secure connectivity for their users. Our expertise in RAN security not only protects their infrastructure but also enhances their reputation as a trusted operator in the telecommunications industry.
Comprehensive Vulnerability Assessment: Ethon Shield’s team conducted a thorough analysis identifying potential weaknesses that could be exploited, by detecting weak authentication policies or encryption algorithms across various vendors within the infrastructure.
Signal Confguration and Management: RAN nodes require precise configuration of different reference signals which could otherwise lead to denial-of-service attacks affecting the entire network. We assessed these configurations to ensure they were secure and resistant to exploitation.
Protocol Security Analysis: We conducted an in-depth study of the connecting protocols between the RAN and the CORE network. Multiple telco protocols, while essential for reliable communication between the RAN and CORE network, has been associated with multiple legacy vulnerabilities that could be exploited by attackers.
