New 5G protocol vulnerabilities allow location tracking
The mobile phone industry has failed security and privacy with every single technology for over 40 years.<p>Every single layer, and every single generation, is broken.<p>Example: The encryption has been home-grown in every generation, and every generation has been broken. They keep reinventing their own shit, even though EVERYONE knows you DO NOT DO THAT.<p>Another example: The backbone of cross-operator traffic has ZERO authentication. If you&#x27;re lucky it has ACLs on IP addresses. (and if you thought BGP hijacking on <i>the internet</i> was lax and unmonitored...)<p>Another: The GTP protocol on this network has a &quot;high security&quot; mode, where it only allows clients who set the &quot;yes, I&#x27;m authenticated&quot; bit in the header. Yes, really. A bit.<p>And operationally like half the nodes in phone networks have a password of &quot;letmein&quot;, &quot;password&quot;, or &quot;Secret&quot; (capital &#x27;s&#x27;, very high security).<p>I&#x27;ve seen companies accidentally log in to their competitors nodes, because the both used &quot;letmein&quot; as password!<p>There is NO POSSIBLE WAY anyone can be this incompetent. I give the benefit of doubt, but we&#x27;re approaching half a century of EVERY SINGLE THING, standards, implementation, policies, and operations, being completely broken. At what point can we say for certain that this is malice, this is deliberate backdooring of all phone infrastructure?