“Manufacturers are at the forefront of IIoT deployment, preparing with 5G to harness the power of ubiquitous connectivity to drive greater speed, security, and efficiency. But with new technology come new threats that add to legacy challenges,” explains Yohei Ishihara, security evangelist at Trend Micro. “As the report warns, many are stuck in a loop, unable to afford the downtime needed to patch critical system vulnerabilities that could otherwise be exploited. Fortunately, our extensive research also highlights multiple mitigations and best practices for securing smart factories of today and tomorrow.”
The report identifies several key entry points for attackers to compromise a core 4G/5G network:
- Servers that host basic network services: selection of vulnerabilities and weak passwords on these standard x86 COTS servers.
- Virtual machines (VMs) or containersThey can also be exposed if the latest patches are not applied quickly.
- Re-infrastructured: Devices are often overlooked during patching cycles.
- Base stationsThey also contain firmware that needs to be updated from time to time.
Once an attacker gains access to the main network from any of these entry points, they will attempt to move laterally, intercepting and altering network packets. By targeting industrial control systems (ICS) in smart manufacturing environments like the test center, attackers could steal sensitive data, sabotage production, or demand a ransom from organizations.
Of the 11 demonstrated attack scenarios, one of the most potentially damaging involves targeting Microsoft Remote Desktop Protocol (RDP) servers, which are commonly used by field and IT engineers. Upgrading to 5G does not automatically protect RDP traffic, so attackers could exploit this access to download malware and ransomware or directly hijack industrial control systems. RDP v10.0 is the most secure version and may offer some protection against these attacks, but again, upgrading can be challenging for organizations.
Among the recommendations made in the report to secure 4G/5G campus networks are the following:
VPN or IPSec to secure remote communication channels, including remote sites and base stations;
Application layer encryption (HTTPS, MQTTS, LDAPS, encrypted VNC, RDP v10, and secure industry protocols such as S7COMM-Plus);
EDR, XDR, or MDR to monitor attacks and lateral movement within the campus and containerized core network;
Proper network segregation with VLANs or SDN;
Immediate patching, whenever possible, of servers, routers, and base stations; and
Anomaly detection products, such as Trend Micro Mobile Network Security, that are compatible with the campus network and provide a robust way to isolate unlisted device/SIM pairs.
The creation of a mobile network in an enterprise environment involves both end users and various stakeholders, including service providers and integrators. Furthermore, private 4G/5G networks are large-scale infrastructures with a long lifespan, making them difficult to replace or modify once built. Therefore, implementing "security by default" is essential to identify and mitigate security risks at the design stage.
