16 ms·
If 5G Is So Important, Why Isn’t It Secure?
- whatshisface 8y agoThe USG has a bad history when it comes to "aiding" telecommunications security[0]. Historically they have prioritized making sure things are weak against their own attacks over making sure things are secure against other attacks (and, of course, from the perspective of a private citizen the government's attacks may well be malicious.) [0]https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Clipper_chip
- xxpor 8y agoI realize he's writing to a general audience here, but I hope he writes a more technical version of what the heck he's talking about here. 5G is basically L1. IMO most of the security should happen at higher layers, for practical implementation reasons as well as flexability. For how long it's going to be around, anything built into the protocol will probably be broken at some point, and since it's L1 it's extremely hard to fix.
- est31 8y agoI definitely don't want anyone to tap into my phone calls or SMS. And I also don't want carriers to sell the data they collect about me, or have insecure infrastructure so that it can be obtained by criminals. It's not that I'm not giving them any money, they shouldn't sell my data.
- dullgiulio 8y agoAgreed, but it can be done at higher layers. Just use some secure app instead of SMS and phone calls. The carrier should not be able to know much about you, except some vague metadata (an histogram of the amount of data you exchanged with some IPs.)
- bdamm 8y agoThis is a common and incorrect misconception. The network needs security, as does the applications running on it. These are different security layers, and cannot be provided together. With an insecure network, even if your applications are secure, then bad actors (government, company, whoever) have a much easier time attacking your phone directly. Perfectly secure applications and an insecure network leaves your phone open to attack from nearby radios. If we assume your applications are all perfectly secure, and your phone software and hardware are also all perfectly secure, then that leaves abuse of the network as a tool to affect denial of service, spying on presence meta-data, and not limited to the carrier. But of course there are no perfectly secure applications, nor any perfectly secure phones. So keep in mind that the weak network greatly expands the attack surface from which bad actors can mess with your phone. This isn't a problem solved with layer-7 security.
- kstenerud 8y agoSince the infrastructure is beholden to governments, one must assume that the data link layer is compromised.
- shittyadmin 8y ago> The carrier should not be able to know much about you, except some vague metadata (an histogram of the amount of data you exchanged with some IPs.) And your approximate location at all times due to their triangulation capabilities. Not much you can do about that one though.
- gruez 8y ago>Agreed, but it can be done at higher layers. Just use some secure app instead of SMS and phone calls. But then you lose the whole network of SMS/phone numbers. You can probably get all your friends & family to contact you using whatsapp/fb messenger (or if you try really hard, signal), but good luck convincing your bank. Your phone calls with your bank/broker probably contains more sensitive information than your phone call with your friends/family.
- est31 8y ago
- zamadatix 8y ago5G includes it's own MAC layer, would you say Wi-Fi and Ethernet shouldn't have included encryption/security layers?
- richardwhiuk 8y agoEthernet doesn't have encryption or security layers.
- shittyadmin 8y agoIs this article just implying that because security isn't regulated the network is insecure? Or has some legitimate vulnerability been found here? Seems very politicized too.
- leevlad 8y agoI was hoping to see at least some hints as to why the security of 5G is flawed in its current state. The only argument I seem to parse out of this is what you stated. Note that the author is Tom Wheeler - former chairman of the FCC. It does seem to be a 100% political piece rather than anything to do with the tech.
- diffeomorphism 8y agoI get that it is an opinion piece, but claiming that autonomous cars need 5G or that these cars would be remote controlled (so not autonomous at all and useless in a tunnel) makes this article just sound horribly uninformed.
- aaaaaaaaaab 8y agoAutonomous cars need internet access to display relevant ads to the passengers.
- Dirlewanger 8y agoWhy? It's the truth. Tesla is already connected to cellular networks. Once 5G really takes off, what makes you think manufacturers aren't going to race to have the first autonomous vehicle connected via 5G? There will be whole marketing campaigns revolving around that very thing.
- _underfl0w_ 8y agoI believe the parent was trying to point out the inconsistencies in calling something "autonomous" yet still saying that it's incapable to doing things without a cell connection.
- hexane360 8y agoI don't really blame them, because I've seen it as part of pretty much every 5g promotional material I've seen.
- howard941 8y agoIn my industry (it's one of the businesses that are involved in NEMA) the use cases touted for 5g are vehicle-to-vehicle and vehicle<>infrastructure although I think 5g's going to prove too expensive and Dedicated Short Range Communications (DSRC) will predominate.
- dullgiulio 8y agoThe author does not seem to understand the engineering background. Security should not be trusted on such a low layer of the network stack. No matter which attacker we want protection against, the points to secure are client and server, not the middle-boxes. This is one of the well known reasons HTTP/2 is implemented by browser vendors only on a secure channel. Here we are talking about implementing security in hardware (bad idea: hard to upgrade as security requirements and practices chage) at a very low level (at data link layer). If this is to skip security at higher levels of the stack, you have to trust all hardware vendors and operators worldwide. If we don't, we can as well communicate on an insecure channel: that's what modern TLS provides. Of course to get all users to use only secure channels is a lot of work, it's just that there is no easier alternative that provides this same result. Granted, the author might have something else in mind: he might want communication to be safe only against some parties, but not others.
- lgierth 8y agoI agree that the security of communication between endpoints mustn't be trusted to the lower layers, but this is only the application layer. The network itself needs to be secured just as well -- thinking especially of SS7 and BGP and the likes here.
- dullgiulio 8y agoGood point. With BGP you can cause a denial of service. But again, TLS should reduce the risk to just that and nothing worse (intercepted/counterfait information.)
- bdamm 8y agoThis isn't just about preventing denial of service. It's also about preventing direct attacks to your phone's base-band controllers. It's also about reducing the leverage attackers have to manipulate weak applications.
- tptacek 8y agoThe error here is in think of security as something you have or don't have. But of course, it doesn't work like that. Security is an economic problem. You deploy countermeasures to raise the cost of an effective attack beyond what rational or realistic attackers will be willing to pay. What does that mean for SS7? It's a little tough to say: you have to peel off all the layers above and below it and factor out the security they provide, and then map what's left to attacks that are meaningful to realistic attackers. All this is to say, the kind of security most people think about when they discuss 5G and SS7 security --- universally trustworthy cryptographic secure channels --- is not a good fit. I tend to think the same thing about BGP (vis a vis global signing schemes like RPKI), but I recognize that I'm an oddball in that regard.
- peterwwillis 8y ago> It was 4G that gave us the smartphone. Smartphones existed since the early 2000's, well before the first 4G deployment in 2009. From the Smartphone wikipedia entry: "The first iPhone also faced criticism for not supporting the latest 3G wireless network standards, but was praised for its hardware and software design, and its June 2007 release was met with heavy demand"
- DeonPenny 8y agoThe iPhone was late to 3G, 4G, texting multiple people, and a lot more. Apple has always taken a very wait and see approach.
- rhizome 8y agoAnd who can blame them, what with the whole "US 4G is 3.5G" issue. US cell advances always seem to have caveats and market-confusing details.
- qlm 8y agoI have had 4g disabled for years as I’ve found it somehow slower and significantly less reliable than 3G, across multiple devices. I can stream music and watch YouTube videos just fine. This is on O2 (UK). Maybe I need a new network.
- amaccuish 8y agoI'm on O2 too and it's garbage. I can't wait till my contract is up to switch. I often have full signal but nothing will load, whilst mates on Three or EE are fine. When it does work, it's so slow. And it's not a local thing either, it's everywhere I go.
- marcusjt 8y agoInteresting, post above yours says O2 and Vodafone share network, and I'm on Vodafone but rarely if ever have issues.
- 8y ago
- karolusrex 8y agoI was expecting a discussion around the safety around 5G, as there is no scientific consensus around whether 5g is actually harmful to humans. https://www.jrseco.com/european-union-5g-appeal-scientists-warn-of-potential-serious-health-effects-of-5g/ https://www.jrseco.com/european-union-5g-appeal-scientists-w...
- gruez 8y agosince when is "secure" ever associated with "healthy"?
- heinrich5991 8y agoIn German, the words for "secure" and "safe" are the same. 5G being safe doesn't sound too far from 5G being healthy.
- OJFord 8y agoEven in this context? They're synonyms in English in some contexts, (e.g. 'I feel safe/secure here') just not this one.
- deleted 8y ago[deleted]
- artificialLimbs 8y agoCame here to see if anyone was going to post about this. Saw this today. https://needtoknow.news/2019/01/michigan-state-senator-says-acceptable-level-of-5g-radiation-has-been-rigged-by-telecom-industry-and-is-huge-health-hazard/?fbclid=IwAR3ehEMZFqbK4yMW0A9a9CqK8C8x8LvdG30UbcnjZhzggxI2KGCSAVdgW3o https://needtoknow.news/2019/01/michigan-state-senator-says-...
- drb91 8y agoThe nytimes opinion section is a trash fire these days.
- ConceptJunkie 8y agoThese days?
- scotty79 8y agoIs 5G so important?
- some_random 8y agoYes
- scotty79 8y agoWhy? It's just faster and I already can stream video and play realtime games on 4g. What are other more demanding applications?
- obmelvin 8y agoBy that logic, why did we need 4g? Depending on your frame of reference 3g was fast enough to stream videos. Point being, there will always be uses for higher bandwidth and lower latency even if you don't need it yourself.
- abledon 8y agoprobably enterprise reasons and less personal consumer.
- reshie 8y agoprogress. is it better to have to much or too little? with more room to grow there is more posibilities.
- Jonnax 8y ago
- okl 8y agoI find nothing in the article that shows 5G is not secure. It is a blatant appeal to increase FCC's power and funding. Shame on the NYT for publishing unsubstantiated position papers written by a political operator ("By Tom Wheeler, Mr. Wheeler is a former chairman of the Federal Communications Commission.") under a misleading headline.
- obmelvin 8y agoTom Wheeler actually proved himself to be quite independent during his tenure at the FCC. Many (myself included) expected him to act similarly to how Ajit Pai is now given Mr. Wheeler's previous industry experience. Personally, I feel that he generally advocates for policies to benefit consumers.
- tzs 8y agoYou should look deeper. Wheeler has had an interesting career. At one time he was head of the main cable industry trade group, back when cable was trying to be David to the TV network's over-the-air Goliath. This was when cable was just about video, because cable internet had not yet been invented. Later, he was head of the main cellular and wireless trade group, when they were the newcomers for both voice and data, against the big wired telecommunications companies. These past positions had a lot of people worried when he was appointed FCC chairman, over concern that he would favor industry. What most observers failed to notice was both of those positions were at times when their respective industries were the upstarts, going against established monopolies or near monopolies, trying to bring competition and wider services to consumers. In other words, he represented those industries at a time when being pro-cable or pro-wireless, respectively, was being pro-consumer. When he was at the FCC, several decades after his association with the cable industry, and about a decade after his association with the wireless industry, when the interests of those industries and consumers had diverged, he tended to go with the consumer side. The cable and wireless companies were definitely not fans of Wheeler's FCC actions, fighting in court against almost everything he did. In the 20 or so years between the job representing the cable industry and the job representing the wireless industry, he was a founder or major executive in several companies, including at least one that failed due to lack of net neutrality. Some of these companies have been telecommunications related, but some had nothing to do with that (e.g., one is in aerospace components, and one or more have been in banking). He's also a former director of PBS and was chairman and president of the National Archives Foundation. He's combined his interest in American history and telecommunication in a well reviewed book about the Civil War called "Mr. Lincoln's T-Mails: How Abraham Lincoln Used the Telegraph to Win the Civil War" [1]. Dismissing him as merely a "political operator" seems rather shallow. [1] https://www.amazon.com/gp/product/0061129801/ https://www.amazon.com/gp/product/0061129801/
- amaccuish 8y ago> It was 4G that gave us the smartphone I remember using my trusty BlackBerry back with 2G. The first iPhone launched with just 2G. If you want to talk about the general rise of the smartphone, then it would be about 3G.
- IOT_Apprentice 8y agoWell, first off, is there a way to get stingrays broken such that they would be identified as rogue base stations and locked out as untrusted? If not, then hello to being compromised. Not that it would stop the NSA, but at least 3rd party or rogue states would not be able to deploy them if this could be achieved.
- LukeShu 8y ago> "It was 4G that gave us the smartphone." The iPhone was released in June 2007, more than 3 years before the first LTE phone was released in November 2010. The iPhone wasn't the first smartphone, but it did kick off the smartphone boom. And it did it without even 3G; the original iPhone only supported 2G (despite widespread, but not universal, rollout of 3G in the USA).
- thepangolino 8y agoThe first Iphone didn't even have 3G.
- LukeShu 8y agoYes, I said that.
- a-dub 8y agowhat applications, exactly, are waiting in the wings for more mobile bandwidth? i can already stream video in both directions... i think i'd prefer more innovation in terms of security and privacy rather than more bandwidth that nobody really knows what to do with...
- waynecochran 8y agoThe new Congress should use its oversight power to explore just why the administration has failed to do to protect against that risk, ... New York Times, grammar, really?
- aportnoy 8y agoSlightly off topic, but I wonder how much net savings (% world GDP?) would we have if there was no need to secure our communications. At least some energy and time would be saved as a result, comms would be faster.
- logifail 8y agoI wonder how many (security-related) jobs would be lost as result?
- kstenerud 8y agoIt's not secure because any widely rolled out physical layer is by definition compromised. All infrastructure in a country is beholden to that country's government, and that will never change. Any attempt to put encryption into a widely used physical layer will fail, because no committee will agree on an effective implementation that actually works (governments WILL subvert any committee). Governments will insist upon backdoors or sniffers, and hardware has the disadvantage of being in one physical place, easily targeted by a government. The physical layer is compromised, and always will be.
- stunt 8y agoWe haven't built anything flawless so I'm not sure if it is fair to blame anyone for building something that might not be secure without any evidence. No matter who is going to lead 5G technology, The service provider will have full control as they already have. They will be still able to do everything that they are doing already. So we will have our domestic controls and it is secure it that sense. Perhaps, What we might not have is having our backdoors to have the same powers in all other countries around the world.
- zw123456 8y agoAlmost any wireless link will be subject to man in the middle attacks by nature, in my view. If you can sniff the medium, you eventually can probably find a way to intercept it. Wired connections are more secure, or perceived to be so because the assumption is that sniffing the medium is more difficult, which is generally true because someone would have to physically make a connection (unauthorized) to your cable and the assumption is that it would be detected (perhaps). It's just a lot easier to sniff your channel over the air. 5G can be implemented on any piece of spectrum, sub-1Ghz, mid-Ghz or so called mm-wave. One thing about mm-wave that makes it "more cable like" is the highly directional nature. 5G that is being deployed on mm-wave bands (e.g. 28Ghz) have extremely small beam widths due to the use of Phased Array antennas. This makes it much more difficult to "sting-ray". or at least is more easily detected. Having said all this... everyone should always keep in mind that whatever wireless network you are on, GSM, CDMA, HSPA, LTE, Wifi, 5G whatever, you cannot count on the phy layer for protection.
- hxsvui 8y agoTo me, it's absolutely unclear what the author is actually talking about. Should telcos be responsible for monitoring the devices in their network? Mobile networks provide Internet access with all the risks associated to the Internet. But the radio access is reasonably secure, if we compare with public WiFi. It's encrypted, authenticated and the operators are more trustworthy than the random person that puts up an Access-Point with years-old firmware. (the operators have something to loose here)
- Aloha 8y agoIf you put the security in the baseband, you're stuck with whatever you put in there for many decades, if you put it in higher level protocols, you're probably not.