# 5G Security Threat Assessment in Real Networks
## 4 Security Challenges
### 6 Types of Core Network Security Threats  
1. **Type.C1. Information Leak**: Information on 5G NSA core networks can be largely divided into information on EPC equipment to process the data and information on IMS equipment to provide various services. Because EPC equipment communicates using GTP protocol and IMS equipment communicates using session initiation protocol (SIP) protocol, the attacker can select a protocol suitable for the desired information. GTP protocol is divided into GTP-C used between core network equipment, and GTP-U that delivers data traffic in the user terminal through a tunnel between the base station and PGW. In order to find out the IP information of the EPC equipment, the attacker can use a packet injection method that loads an echo request, GTP-C message for health check between core network equipment, on the data payload to send. When running Android debug bridge (ADB) command in Android terminal using a program called Packit, a packet is created, and when sending the packet to the IP band identified through Tracert in tethering status, the GTP-C packet is injected and transmitted to the mobile communication network. PGW checks this and sends echo response, where the attacker can identify that the source IP of that message is PGW IP [24]. 2. **Type.C2. IP Depletion**: The packet injection method described earlier to provoke information leak threat is called GTP-in-GTP, and the attacker can deplete IP Pools allocated to terminals in the core network through the same method. While GTP-C echo request that plays a role of ping is used to acquire IP for core network equipment, GTP-C Create Session Request is injected and sent to the core network to allocate the IP to the terminal. The attacker can increase the terminal number in the create session request sequentially so that PGW allocates multiple IPs. If PGW allocates all of available IPs, create session requests from normal terminals would be rejected, and all of terminals accessing that core network could not communicate [24]. 3. **Type.C3. DoS**: An attacker can send an attach-request message continuously to access the 5G NSA network by configuring multiple terminals as botnets and repeating airplane mode on/off. This may cause excessive traffic load on a certain mobile carrier's core network. One attach request can create maximum eight GTP-C messages, which brings 8 times the amount of traffic to the CN function in the core network in proportion to one malicious manipulation done by the attacker [25]. 4. **Type.C4. NAS Manipulation**: Of NAS protocol messages for signaling between terminals and core network, attach-request messages used in the initial attaching step do not have their ciphering or integrity guaranteed. Therefore, an attacker can install a rogue base-station near the victim to steal and manipulate those messages. In particular, an attach request-message has UE network capability field that can set ciphering or integrity for all data received or transmitted by the terminal. An attacker can manipulate values in EEA that is a field to transmit ciphering algorithm selected by the terminal, and EIA that is a field to transmit integrity verification algorithm selected by the terminal, within the UE network capability field. 3 GPP technical specification (TS.) 33.401 defines the essential use of integrity verification algorithm in terminals but defines the selective use of ciphering algorithm. In fact, the test results conducted by Ruhr university in Germany in 2019 on five European countries and 12 carriers showed that four of 12 carriers do not even allow the use of integrity that must be used [6]. 5. **Type.C5. Eavesdropping**: Voice communication on a 5G network uses IMS network and initiates session through SIP protocol according to 3 GPP standard. Therefore, security in SIP protocol is very important and done mainly through internet protocol security (IPSec) security associations (SAs).