Making devices on 4G LTE networks more secure

CHAMPAIGN, Ill. — By 2020, the number of 4G LTE connections is expected to reach 2.8 billion, thanks to higher communications capabilities and a growing appetite for online services and resources.

However, the security of these devices and the networks that connect them haven’t evolved as quickly, which poses a significant threat to multiple aspects of critical infrastructure across a wide range of industries. Dr. Guanhua Yan, in collaboration with the Critical Infrastructure Resilience Institute, is creating a new methodology that would help make 4G LTE networks—which are embedded in the daily operation of everything from healthcare to transportation—more secure and reliable. CIRI, a multi-university initiative led by the University of Illinois at Urbana-Champaign, is a Department of Homeland Security Center of Excellence.

Dr. Guanhua Yan (left) works in his lab with graduate students Yunus Kucuk (middle, studying deep learning for cyber security, and Zhan Shu (right, studying dynamic malware analysis).

“Mobile devices are the center of our everyday lives, so a network failure could impact millions of people,” says Dr. Yan, assistant professor of computer science at Binghamton University and Internet infrastructure and simulation expert. “Because everything from toothbrushes to automobiles to mobile phones are part of the Internet of Things (IoT), a hacked device can be used to attack other systems and create extensive damage. We want to learn more about 4G LTE mobile communication networks and device vulnerabilities so that we can stay ahead of people with bad intentions.”

The security risks posed by vulnerable individual devices have been documented in several industry reports and in the mainstream media. In October 2016, Dyn, a company that provides a significant portion of the US Internet’s backbone, was overwhelmed by the Mirai botnet. The attack infected and overtook a host of IoT devices and left millions of Americans without Internet access for days by flooding many popular American websites with junk site traffic.

“IoT devices are susceptible because authentication is weak and their passwords are often changed very infrequently, if at all,” says Dr. Yan. “The Mirai botnet attack is just one example of the challenges we’re facing with 4G LTE devices. SMS flooding and man-in-the-middle attacks are other tactics commonly deployed by hackers.”

Yan and his research team are poised to dive into the breach and develop new testing methods to address these challenges. According to Yan, research on the security of LTE systems is still in its infancy.

One of the unique aspects of Dr. Yan’s project, titled LEFT: An LTE-Oriented Emulation-Instrumented Fuzzing Testbed, is that it will use a systematic means of uncovering new methods of attacking devices. To do this, the research team will develop a “fuzzing” testbed, which is a research method that is very effective at uncovering vulnerabilities at the system level. The testbed will efficiently generate a series of mutated input variants to learn what crashes the system.

This is an unexplored approach for studying the resilience of LTE systems. Fuzzing research was done on 2G networks and devices—though not on a very large scale—but it has not been conducted on 4G LTE devices. Yan’s team will use an emulation approach, which allows them to mimic a cell phone device through a custom software package.

“Dr. Yan’s project contributes to CIRI’s research thrust focusing on the role of communication in critical infrastructures,” says CIRI Director David Nicol, the Franklin W. Woeltge Professor of Electrical and Computer Engineering at Illinois. “He is expanding our understanding of LTE networks and devices within the critical infrastructure landscape with work that has potential to shape how the mobile communications industry views device vulnerability. His work will contribute to the security of mobile communication infrastructure so that we can prevent potential damage to the larger network caused by an individual hacked device.”

This project is process oriented and targeted, which will result in the development of new software. Dr. Yan has already held preliminary conversations with several big names in the mobile communications industry who potentially are interested in leveraging this software.