# 5G Security Threat Assessment in Real Networks
## 7 Test Results and Mitigation in Real Networks  
**Test Results.** Different vulnerabilities were found for each mobile carrier, which was verified due to differences in software packages depending on equipment manufacturers. Table 7 shows vulnerabilities found for each mobile carrier, where \"O\" means vulnerable.  
Figure 11: Testing environment for 5G security threat assessment.  
Figure 10: Testing procedure of LTE Fuzz for 5G security threat assessment.  
**Measures.** When counting the same vulnerabilities found in different mobile carriers as one, the total number of problems found is three in RAN section and five in CN section. As shown in Table 8, measures could be taken with equipment SW patch or changing configuration setting for a total of 5 cases, while standardization or a countermeasure system is required for the remaining three cases. As a result, the main challenges in this paper are RRC Connection DoS, NAS Ciphering Spoofing, and SIP Spoofing, which cannot be taken with SW patch or changing config-uration of network components. The standardization is underway to address these threats, but this process takes much time to address.  
Additionally, although the threat of UE IP depletion was not found in an actual network, it is the most basic attack that can be tried on 5G NSA core network with EPC scanning. Thus, a detection method through IDS or IPS was suggested rather than standardization.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Index** & **Test Case** & **Operator A** & **Operator B** & **Operator C** \\ \hline TC. R1 & RRC Connection DoS & O & O & X \\ \hline TC. R2 & RRC Security mode command & X & O & X \\ \hline TC. R3 & RRC Connection reconfiguration & X & O & X \\ \hline TC.C-CP1 & NAS Integrity Spoofing & O & O & O \\ \hline TC.C-CP2 & NAS Ciphering Spoofing & O & O & O \\ \hline TC.C-CP3 & NAS Security mode command & O & O & X \\ \hline TC.C-CP4 & NAS Attach accept & O & O & X \\ \hline TC.C-UP1 & EPC Scanning & X & O & X \\ \hline TC.C-UP2 & UE IP Depletion & X & X & X \\ \hline TCC.C-UP3 & Targeted Create Session Request & X & X & X \\ \hline TC.C-UP4 & Delete Session Request & X & X & X \\ \hline TC.C-UPS & SIP de-Register Request & X & X & X \\ \hline TC.C-UP6 & SIP Bye Request & X & X & X \\ \hline TC.C-UP7 & SIP Message Request & X & X & X \\ \hline TC.C-UPS & MMS Request & X & X & X \\ \hline \hline \end{tabular}
\end{table}
Table 7: Test result and vulnerability disclosure.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Test Case** & **Root Cause** & **Vulnerability Mitigation** \\ \hline RRC Connection DoS & Design Flaw & Security Guide \\ Standardization \\ \hline RRC Security mode command & Implementation Flaw & eNB Software PKG Patch \\ \hline RRC Connection reconfiguration & Implementation Flaw & eNB Software PKG Patch \\ \hline NAS Integrity Spoofing & Implementation Flaw & MME Configuration alteration \\ \hline NAS Ciphering Spoofing & Design Flaw & Security Guide \\ \hline NAS Security mode command & Implementation Flaw & MME Software PKG Patch \\ \hline NAS Attach accept & Implementation Flaw & MME Software PKG Patch \\ \hline EPC Scanning & Design Flaw & Intrusion Detection System \\ \hline \hline \end{tabular} \({}^{1}\) Patching the carrier’s equipment or standardization with ITU by discussing with 3 GPP are in progress for identified vulnerabilities.  
\end{table}
Table 8: Vulnerability mitigation \({}^{1}\).