# 5G Security Threat Assessment in Real Networks
## 4 Security Challenges
### 5 Types of RAN Security Threats  
1. **Type.R1. Information Leak**: Information leak involves threats such as paging sniffing and IMSI cracking. Paging sniffing is a method of passive scanning all kinds of information by exploiting the broadcasting of paging messages transmitted from wireless base stations to terminals. The attacker can install a software defined radio (SDR) device that can receive radio frequency (RF) signals near the target victim and find out the victim's SAE-temporary mobile subscriber identity (S-TMSI) or paging cycle. Additionally, the attacker can calculate paging frame index (PFI) using the identified paging cycle and reduce the number of candidates for the victim's IMSI to 8 at most using the calculated PFI. The attacker sends IMSI paging where the 8 IMSI candidates are inserted to the victim and observes the responses to intercept the victim's IMSI [21]. 2. **Type.R2. User DoS**: Radio resource control (RRC) connection DoS, RRC reject DoS, and RRC release DoS are available for target-type user DoS. Among them, RRC connection DoS is a security threat using the victim's S-TMSI that was found through the aforementioned information leak attack. Unlike the core network, wireless base stations do not have authentication procedures for terminals, which can be exploited to continuously interfere with the victim's wireless access. The attacker inserts the victim's S-TMSI value into the RRC connection request message used in wireless access by the terminal, and sends the message to the base-station accessed by the victim. On this occasion, the base-station disconnects the victim's RRC connection but makes RRC connection with the attacker, which is disconnected in the course of attempting security setup from the attacker's terminal. After this, it would not be a problem if the victim's terminal made a normal RRC connection successfully, but the attacker keeps sending the manipulated RRC connection request message and the victim will not be able to get the service continuously [5]. 3. **Type.R3. Base-Station DoS**: A typical case of target-type network device DoS in a wireless network is a wireless base-station resource depletion. At the time of the first RRC connection, the terminal performs Random Access that creates a random ID and sends RRC connection request. An attacker can exploit this to attempt RRC connection and transfer even NAS attach request using the victim's IMSI. When requesting authentication and waiting for the response in the core network, the attacker can perform Random Access again, repeat the above process, and keep increasing the number of RRC connection in the base-station [5]. 4. **Type.R4. Eavesdropping**: In principle, eavesdropping on wireless networks is impossible due to AS security settings between terminals and base stations. However, there can be a case that involves extracting AS Security Keystream and decoding. Voice traffic in mobile communication consists of real-time transport protocol (RTP) protocol, which is delivered using a voice bearer, unlike a data bearer in wireless sections. Because quality of service (QoS) must be guaranteed, a voice bearer is not a default bearer but a dedicated bearer where a separated QoS class identifier (QCI) is applied. A total of 4 elements are used when creating keystream for ciphering in AS security procedure: count, direction, length, and bearer ID. Three of these four elements, except bearer ID, do not act as critical variables in creating the keystream. In particular, bearer ID (DRB ID) is allocated when a base-station creates voice bearer, and a manufacturer's base-station may have a problem of allocating the same DRB ID within the same RRC connection. In order to exploit this problem, an attacker keeps the victims' ciphered voice communication using a sniffer. Not long after the victims' calls are ended, the attacker attempts to make a voice call to one of the victims, and keeps the plan-text and cyber-text of the call using a sniffer when the call is made.