Readers of a certain age will remember GPRS: Old insecure tech from turn of millennium still haunts 5G networks

Long-standing vulnerabilities in older wireless broadband standards will continue to dog new 5G networks, despite efforts to improve network security, a new report has claimed. Researchers with Positive Technologies say that a legacy standard known as GPRS Tunneling Protocol (GTP) is the culprit behind security issues that …

[fidodogbreath]

"Most of the issues with GTP protocol relate to roaming networks because operators use a 'friendly' model – which assumes all of the users accessing their networks as legitimate and authorised and that attackers will not appear in their network," Novikov explained.

Since there are no threat actors looking to monitor or disrupt cellular comms, that seems like a perfectly reasonable security posture. Ditto for continuing to rely on SS7.

[anthonyhegedus]

Why the sudden need to fix this for 5G networks?

[Anonymous Coward]

All your networks are borked by us

If this is a problem, this "announcement" is several generations too late.

Since others have commented on why it shouldn't be a problem (basically because GPRS shouldn't be part of the security stack solution) I can only assume that this is a PR effort.

[Anonymous Coward]

Re: All your networks are borked by us

At least, that is what would ideally happen. Mobile networks being what they are, the transition to 5G will be incremental and, in the meantime, that means backwards compatibility is needed with 4G and earlier standards, where GTP transmission remains highly vulnerable.

It is trivial for a reasonably well resourced attacker to bung up 5G coverage with a bit of jamming to force phones to fall back to earlier protocols like 2G, which makes just fixing 5G on its own a bit pointless.

I can't see 2G being switched off for a couple of decades. Older people who find a smartphone fiddly tend to still have 2G/3G phones, as do lots of tourists in the UK. It is still widely used in rural areas (i.e. that part of the country that isn't London) because of its better coverage at very low signal strengths. 2G is also used in many embedded machine-to-machine applications, and 2G/3G is mandated for smart meters and the EU's eCall car crash system. Smart meters have a minimum life of 15 years.

[Joe W]

Understatement

"and we're not likely to get standalone 5G for several years."

you mean decades, right?

Yeah, ElReg is British....

[Anonymous Coward]

Tag the paid articles yo

Hmmm, how much were El Reg paid by Positive Tech to get its readers to hop on over and hand over their email addresses?

Either PT don’t understand the threat model for GTP, or they’re looking to sell some cruft. It’s a signalling and adaptation layer. It was never intended to provide security anymore than the Ethernet frames carrying my TLS packets to my banking app were.

If you’re using GTP over an insecure network you use IPSec. You don’t rewrite an entire spec (whilst clearly having little knowledge what it intends to and is required to accomplish). Jesus H chuffing Christ...

Believe me - the risk in telco ain’t GTP. You wanna pop some CNI go look at the management plane and see all the shitty home brew FTP, telnet, HTTP junk full of bugs.

[Lorribot]

The reality of putting making things easy for teh customer and short term simplicity over long term security. Oh idiot 5G developers that didn't realise that they woudl have to interact with other Gs.

This should have all been sorted for 4G and there should be no old 2G or 3G around any more and the Government or OFCOM should be sorting this mess out. The statem "In short, 5G security protections only work when 5G is running alone, and we're not likely to get standalone 5G for several years." is so laughable, 2G will still be there in 10 years because the carriers have no reaso to get rid of it and every reason to keep it, especially in rural areas where coverage is poor.

[Yet Another Anonymous coward]

Yes, just spend a year rolling out N+1G masts everywhere you have a NG mast.

Then tell everyone that at the end of the year you are turning off the NG and they better all have new phones that use N+1G.

ps how is that converting to metric thing from 1970 going? Finished yet?

[Mike 16]

Ironically

we are already at (or past) the point that the only "remotely likely to be secure" messaging might be via GPRS. That is, one can get GPRS "modems" (or whatever they are called) simple enough to be used by (older or hobby) devices with a low probability of being "pre-compromised" by various TLA and commercial entities. If your security endpoints are not outside you communications endpoints, you have no real expectation of security or privacy.

Just keep in mind that you already have no expectation of metadata privacy either, unless you are doing old-school dead-drops and hiding messages in Anonymous Coward Reg comments.

[Jamie Jones]

Re: Ironically

"Just keep in mind that you already have no expectation of metadata privacy either, unless you are doing old-school dead-drops and hiding messages in Anonymous Coward Reg comments."

I think that is a bit far-fetched....

Sane posters to El Reg just need tin-foil-hats to hide revealing their activities!

[Mike 16]

Re: Ironically

Mmmm, Bacon!

[DropBear]

Well, you know what happens when your old smartphone suddenly kicks the bucket and you're forced to fall back to your previous Symbian S60 smartphone (that incidentally was capable at doing literally _every_ _single_ _thing_ your "modern" smartphone could do) that just happens to still be working...? Well, for one, you WILL NOT connect to any webpages whatsoever considering they all transitioned to https in the interim, which your hopelessly-out-of-date-both-by-cyphers-and-certificates old phone will absolutely refuse to have anything to do with. Yes, even a simple Google search. Except... until you try wap.google.com WHICH WILL STILL WORK AND DELIVER YOU SEARCH RESULTS. Yes, motherfucking WAP. Yes, in 2020. Cower at the might of legacy tech, ye fucking mortals...

[Jamie Jones]

Yeah, my Nokia E6 is rendered useless for the web just due to an out of date TLS implementation. Shame...