"5G Networks Are Worryingly Hackable"
Microsoft and NEC have recently expressed concerns about the security and possible rapid adoption of critical 5G technologies. German security researchers have also now backed up the industry's fears. Karsten Nohl, the founder of Berlin-based Security Research Labs, described how his team breached live 5G networks in a series of red teaming exercises at a hacker conference in the Netherlands. He says that in most cases, they were able to gain control of the network, potentially allowing them to steal customer data or disrupt operations. The hacks were possible because of poorly configured cloud technology, which is becoming increasingly important in 5G networks. According to Nohl, many telecommunications companies lack experience in protecting such systems. His team discovered the failure of operators to apply basic cloud security techniques that could help mitigate hacks. The push toward Open Radio Access Networks (RANs), virtualization, and cloudifcation provides 5G operators with more options and functionality, but it also moves them into the unfamiliar role of system integrator, with responsibility for securing the whole supply chain. Nohl's team found that it was easy to penetrate the networks they tested mostly due to poorly configured containers, which are software packages that contain an application as well as everything needed to run it (i.e., code, software libraries, and configuration files) so that it can run on any hardware. Containers are an important component of the cloud because they enable various applications from different companies or departments to run alongside each other on the same servers. Containers are supposed to be isolated from one another, but if they are not properly configured, it is possible to break out and gain access to other containers, or even control of the host system. Nohl and his team discovered several misconfigured containers that allowed them to do just that. This article continues to discuss the vulnerability of 5G networks to hacking.