# 5G Security Threat Assessment in Real Networks
## 8 Countermeasures and Future Work
### Countermeasures through Standardization
A malicious attacker infiltrates between a victim's UE and a base-station, manipulates an access request message including a request for ciphering and integrity verification normally sent from the terminal into ciphering disabled and integrity unverified access request message, and sends it to a normal base-station. 5G core network equipment (MME) forms a non-ciphering channel with the UE according to the ciphering disable request which is manipulated message differ from the original message sent by the UE, even though ciphering enable is the default. This problem occurs because the 3 GPP standard does not incorporate integrity authentication procedure to check the forgery of the initial message prior to mutual authentication stage, which results in non-ciphering communication caused by manipulated non-ciphering and integrity-unverified UE messages. Two threats can arise from this, and the first one is the manipulation of message content. There are vulnerabilities or risks where malicious attackers can modulate the messages sent from a victim's terminal as they wish. This is because the standard does not define any integrity verification procedure to check whether the access request message sent by a terminal during the first access to the communication network has been manipulated or not. The second is eavesdropping on communications. Due to a ciphering disable request within the modulated initial access message, communication between the terminal and 5G network will be formed as a non-ciphering channel, which allows all wireless communications to be intercepted by a malicious attacker, and personal information and location information contained in the exchanged messages to be exposed. An attacker can disable ciphering settings between the victim's terminal and the core network using a fake base-station to use the victim's data or tap the contents of the message. We implemented an algorithm to detect this and conducted detection performance tests. By analyzing the ciphering fields in NAS protocol messages between terminals and core networks, it is possible to set ciphering bypass channels or determine whether they are non-standard terminals. First, arranging the ciphering bypass channel to detect cases where the EEA in the UE network capability field is set as full-cipher (EEA0) when a terminal accesses 5G NSA network. Secondly, although the change of UE Capability in Replayed UE network capability settings on the terminal can be confirmed for non-standard terminals, a case that completes NAS security complete step without rejecting NAS security complete step can be detected. As a result, a plan is in place to standardize guides for a security system to detect these NAS non-ciphering channels. **Eavesdropping (SIP spoofing). ** Because eavesdropping caused by SIP spoofing is possible when the IPSec is lifted, it is necessary to guide voice communication ciphering settings between terminals and the 5G network to be managed by the mobile carrier's network instead of being processed according to the terminal function (selective application is required in the network for IPSec unsupportive terminals). If the IPSec setting of the 5G voice service is determined by the terminal function, malicious users may attempt multiple attacks by exploiting their terminal settings. Additionally, we need efforts for raising awareness to publicize the risk of leaking the details of communication when attackers maliciously modulate messages and engage in non-ciphering communication between the terminal and 5G network. The applicable section for IPSec is defined as local policy in 3 GPP, but a review is necessary regarding making it mandatory at the 3 GPP standard level. Accordingly, we tried a vulnerability report on the above issues to 3 GPP and discussed these issues through a collaborative mobile carrier at SA3 e-meeting in November 2020. Although it is difficult to induce any change in the standards right now, improvements need to be suggested consistently to combat 5G security threats.