Researchers Uncover Security Flaws in 5G Basebands at Black Hat Conference

A team of researchers from Pennsylvania State University has revealed significant security vulnerabilities in 5G basebands, the processors that enable mobile phones to connect to networks. Their findings, presented at the Black Hat cybersecurity conference in Las Vegas, indicate that these flaws could allow hackers to covertly infiltrate devices and conduct surveillance. The researchers utilized a custom analysis tool named 5GBaseChecker to identify vulnerabilities in basebands manufactured by Samsung, MediaTek, and Qualcomm, which are integrated into devices from brands like Google, OPPO, OnePlus, Motorola, and Samsung. The research team, including assistant professor Syed Rafiul Hussain and student Kai Tu, demonstrated how they could deceive phones into connecting to a fake cell tower, enabling them to launch attacks. Tu emphasized the severity of their findings, stating that the security of 5G was "totally broken" during their tests. The silent nature of the attack allows hackers to impersonate trusted contacts, sending phishing messages or redirecting victims to fraudulent websites to harvest sensitive information. Additionally, the researchers discovered that they could downgrade a victim's connection from 5G to older protocols, such as 4G, facilitating easier eavesdropping on communications. Following the presentation, the researchers reported that most vendors had addressed the vulnerabilities. Samsung confirmed it had issued software patches, and Google also acknowledged that the issues had been resolved, while MediaTek and Qualcomm did not respond to inquiries regarding the matter.