5G network flaws could be abused to let hackers spy on your phone

News
By published

Flaw could allow an attacker to take over your phone via 5G

Telecommunication tower or Mobile phone tower with 5G cellular network . Global connection and internet network concept.on city background.
(Image credit: Shutterstock / Sakorn saenudon)

5G basebands could be exploited by attackers to allow them to send fake messages to your contacts, or even hand over your credentials using a very real-looking website, experts have warned.

Unveiled at the Black Hat cybersecurity conference, a research group from Pennsylvania State University presented their vulnerability sniffing tool 5GBaseChecker.

Latest Videos From

“Totally silent” attack 

The researcher team, comprised of Kai Tu, Yilu Dong, Abdullah Al Ishtiaq, Syed Md Mukit Rashid, Weixuan Wang, Tianwei Wu, and Syed Rafiul Hussain, made their tool available to search for vulnerable Samsung, MediaTek and Qualcomm basebands, which are used by a number of popular phone manufacturers, including the likes of Google, Motorola and Samsung.

Among the possible avenues of attack from the fake base station, Tu highlighted a circumstance in which an attacker could potentially send a very real looking message from a friend to the victims phone opening up the potential for convincing phishing messages to be delivered from a supposedly credible source.

Tu states that once the phone connected to the fake base station, “the security of 5G was totally broken. The attack is totally silent.”

Another potential method of attack using a fake base station could be redirecting the target phone to a fake, but very real looking website such as a social media site or email login, and then stealing the credentials used to log in. To add further sting to the attack, the base station could also be used to downgrade the target phone to 4G, making it easier to snoop on the device.

So far, most of the vulnerabilities discovered in the basebands have been patched by the manufacturers, with spokespeople for both Samsung and Google telling TechCrunch that the flaws in their devices were now patched.

More from TechRadar Pro

Benedict Collins
Benedict Collins
Senior Writer, Security

Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security.

Benedict provides detailed analysis on state-sponsored threat actors, APT groups, and the protection of critical national infrastructure, with his reporting bridging the gap between technical threat intelligence and B2B security strategy.

Benedict holds an MA (Distinction) in Security, Intelligence, and Diplomacy from the University of Buckingham Centre for Security and Intelligence Studies (BUCSIS), with his specialization providing him with a robust academic framework for deconstructing complex international conflicts and intelligence operations, and the ability to translate intricate security data into actionable insights.