In my last article on Government Technology Insider, I looked at private 5G networks and why they’re increasingly used across the U.S. government and military to extend low-latency, high-bandwidth, highly scalable connectivity to the tactical edge for an ever-expanding ecosystem of connected devices, network-enabled sensors, and other endpoints. I also explored how misconceptions about the security of 5G networks and a lack of knowledge about the security features that exist – or don’t exist – inherent within 5G networks are leaving organizations vulnerable to cyberattacks.
This is particularly troubling because government agencies and organizations within the U.S. Department of War (DoW) often deploy their own private 5G networks to carry highly sensitive, mission-critical data and communications between the edge and senior decision-makers back home. It’s also troubling because Advanced Persistent Threat (APT) groups sponsored by some of America’s largest adversaries have proven they can hack 5G networks and remain undetected for extended periods.
Two APT groups that immediately spring to mind are Salt Typhoon and Volt Typhoon – groups many experts believe are tied to China and have been responsible for several high-profile breaches that should worry government agencies and the DoW.
Silent but Deadly
Many different government agencies and cybersecurity experts attribute both Salt Typhoon and Volt Typhoon to the Chinese Government. They’re state-sponsored threat actors, and they are incredibly sophisticated in their tactics and their capabilities.
However, they operate with different agendas in mind. Salt Typhoon focuses on telecommunications networks in the U.S., which they penetrated, established persistence, and began exfiltrating call metadata, text messages, and other personal information. Volt Typhoon is a different group that targets critical infrastructure, such as utilities, water systems, ports, and other essential government resources and services.
Both Salt Typhoon and Volt Typhoon entered America’s consciousness approximately two or three years ago when their presence on these networks was detected. Both organizations had different targets and missions, but they were similar in many ways. Both attacked their targets through external-facing IT systems, including routers, firewalls, and unpatched gateways. They were not exploiting any telecom or utility-specific vulnerability. And both managed to “live off the land.” This means they conducted functions and activities that were natural or normal for the network instead of running exploits or deploying malware – making it nearly impossible for network defenders to see their activities and flag them as suspicious or malicious.
What these two APT groups managed to do was impressive and terrifying. They stayed completely under the radar for years while having complete “run of the roost” in these networks. While inside these networks, these two APT groups were trading Secure Shell (SSH) keys and creating new ones, creating new Linux accounts, and even creating Generic Routing Encapsulation (GRE) tunnels for command-and-control traffic.
They had access to everything, and what they could do within those networks was limited only by their own imaginations.
A Cautionary Tale
I reference Salt Typhoon and Volt Typhoon because they’re incredible illustrations of two important points that government agencies and the DOW need to keep in mind when building and securing their own, private 5G networks:
- Our peer and near-peer adversaries have the proven capability to attack 5G networks, with Salt Typhoon having done it successfully to some of America’s most advanced and secure networks run by leading telecom companies.
- Critical infrastructure, including water and electrical utilities and telecom networks, is clearly fair game for our largest adversaries, which Volt Typhoon’s attacks make incredibly clear.
This should concern government agencies and military organizations deploying private 5G networks because of what a breach of these networks could enable an APT group to do.
A breach of private 5G networks that keep the systems and devices that run America’s critical infrastructure connected could be devastating – enabling malicious actors to shut off power, sabotage water supplies, or even disable essential transportation routes or hubs. A breach of a private 5G network connecting mission-critical sensors and devices on the battlefield could reveal troop locations or movements to an adversary and even enable it to replace accurate intelligence with “spoofed” intelligence, which could cause blue-on-blue incidents or otherwise negatively impact military operations.
As we discussed in our last article, the burden of ongoing upkeep and maintenance of a private 5G network rests entirely on the shoulders of the agency or organization that deployed it.
To reiterate, Salt Typhoon and Volt Typhoon weren’t exploiting 5G specific vulnerabilities or deploying innovative zero day attacks against the underlying networks they targeted. They were exploiting known vulnerabilities that had been exposed and were supposed to have been (or should have been) patched.
If a government agency or a military organization deploys any network, it falls on them to conduct key security activities such as segmenting the network, ensuring visibility for connected devices and consistently updating and patching all systems to mitigate the risk of malicious actors and APT groups trying to exploit vulnerabilities.
The organization deploying these private 5G networks is responsible for conducting key security activities such as segmenting the network, enabling visibility for connected devices, and ongoing patch management and deployment to thwart malicious actors and APT groups trying to exploit vulnerabilities.
But that isn’t easy. Especially today, in the age of artificial intelligence (AI).
Thanks to new AI tools, APT groups and other malicious actors can now rapidly and easily identify vulnerabilities and begin exploiting them. Often this is accomplished by chaining together several low to medium severity vulnerabilities and putting together a never before seen critical exploit.
The result is that government agencies and military organizations deploying their own private 5G networks will now likely see increases in vulnerability announcements from their vendors, as well as the commoditization of advanced attack capabilities. Thanks to AI, APT groups are just too fast – exploiting vulnerabilities and generating new exploits often before organizations have the time and opportunity to address these new attack vectors.
This is exactly why government and military organizations need to build their private 5G networks with a security-led approach, prioritizing security and deploying it closer to the edge. In my next article on Government Technology Insider, I’ll look at what it means to build security-led networks and the tools and technologies that can enable government agencies and military organizations to build hardened, secure networks.
To learn more about how private government 5G networks can be compromised by APT groups, click HERE.
A seasoned network engineer with two decades of experience helping companies and organizations architect and secure their networks, Mitch Rappard currently serves as the Director of Wireless Solutions at Palo Alto Networks.