Synopsys: Reducing 5G attack surface and making good use of technology "double-edged sword"

New technologies are often a double-edged sword, bringing convenience but also creating new challenges. The same is true for 5G technology.

5G is 10 to 100 times faster than 4G connections. But speed isn't 5G's only selling point. The next generation of 5G cellular technology has 1,000 times the capacity of 4G and 10 times less latency.

Kimm Yeo, product marketing manager for software integrity and security at Synopsys, noted that the general public sees 5G as "an increase in mobile broadband speeds," but it is much more than that.

For users or enterprises concerned about security, 5G security still needs to be put first. Now fuzz testing is one of the important testing technologies to ensure 5G security.

Kimm Yeo said: "Defensics fuzz testing supports more than 250 different types of protocols, ranging from network protocol fuzzing to file formats, Web, API, device drivers, etc. Synopsys is one of the few vendors that can provide commercial fuzz testing tools of this level."

The significance and impact of 5G

5G will have a significant impact on convenience, privacy, and security.

It is predicted that 5G will grow from US$5.54 billion to US$668 billion from 2020 to 2026. In other words, the 5G industry will grow at an annual rate of 122%.

From the infrastructure and strategic implementation level, 5G has an impact on a range of application deployments, such as critical care surgery, intelligent monitoring and utility management, large-scale machine-to-machine communications (e.g., vehicle-to-vehicle), smart cities, and smart transportation.

The impact of 5G on people's lives is beyond imagination and covers a very wide range, including wearable devices, digital life, and entertainment.

"5G has played an indispensable role in China's fight against the COVID-19 epidemic, of which 5G live video and video surveillance are the most intuitive applications," said Guoliang Yang, senior security architect of Synopsys' Software Quality and Security Department. "5G live broadcast of the construction of the Huoshenshan and Leishenshan hospitals attracted hundreds of millions of netizens to serve as 'cloud supervisors.' In addition, 5G is also used in remote consultations."

How to build 5G security

With tools like Defensics fuzz testing, security can be built into 5G from an early stage.

In addition to 3G/4G LTE cellular and wireless networks, Defensics Fuzz Testing recently released a 5G Test Suite and an Enhanced 3G/4G Test Suite for use by enterprises building 5G network equipment and infrastructure, as well as operators planning to roll out equipment and services that support 5G networks.

By adopting intelligent negative testing methods, users can input countless random, malformed information to test the robustness and security of systems, applications, and services before they are released. Fuzz testing can discover any unknown vulnerabilities and zero-day attacks, which can lead to product recalls, brand damage, lawsuits, etc., requiring a lot of manpower and material resources for repairs and replacements.

Companies leading 5G

Companies participating in 5G training mainly include global network equipment and service providers. This means that products and infrastructure are needed to support their businesses. Equipment manufacturers, chip companies, and related industries such as cloud/edge computing are also expected to consider supporting 5G technology in the near future.

5G security and standards

Any new generation of technology has certain risks and uncertainties. Moreover, the standards for 5G are not mature enough. Then there is security. Higher connectivity means a larger attack surface. 5G will have more security risks than current cellular technologies.

Yang Guoliang said: "5G security needs to be considered at multiple levels, including the communication security of the 5G network itself, which is composed of terminals and networks, and the security of upper-layer applications carried by the 5G network. At the beginning of the design, the reliability and security of the network should be fully considered so that the security architecture can be improved day by day."

In recent years, Synopsys has discovered many potential vulnerabilities in 4G LTE. Synopsys recently released a white paper that mentioned that Korean researchers had used fuzz testing to discover 36 security vulnerabilities in the network.

As connectivity increases and all devices become intelligent, the attack surface will become larger and attacks will be more difficult to predict and prevent.

How to reduce the 5G attack surface

The main attack surfaces include:

Ÿ Cyber-physical systems, which may be targets of attack and espionage

Telecommunications networks using specialized equipment are more likely to be attacked by malware

Ÿ Internet of Things Digital System

We need fuzz testing for negative testing. Fuzz testing involves inputting a large amount of random data into the test object. The goal is to crash the system, device, or service, thereby exposing unknown vulnerabilities. Synopsys has partnered with major network communication equipment and service providers to conduct fuzz testing.

Kimm Yeo concluded: “Security issues have become a top priority for policymakers. They recognize that the risks of 5G will be higher and there are many unknowns. In this state of unknown, fuzz testing can play a key role.”