Our Eye Is on the SPARROW

We discovered a novel technique that takes advantage of MAC layer protocols in LTE and 5G, enabling long-range communication using other people's networks. This newly discovered vulnerability in the LTE/5G MAC layer protocol standard has the potential to affect other wireless broadband standards. The vulnerability enables unauthorized devices to anonymously exchange short messages over a service provider's infrastructure. While it wasn't particularly impactful in Wi-Fi networks, it becomes an important concern as cell coverage expands beyond a single room to larger distances.

The vulnerability exploits elements of initial messages establishing their links but before the unauthorized user can be authenticated with the network. As a result, an anonymous and unauthorized user can take advantage of base station broadcast signals to relay messages to another anonymous user within a cell coverage area.

Compared with known covert communication techniques, this is a new technique for unauthorized communication by exploiting the MAC layer (L2) of wireless access infrastructure rather than causing interference by directly accessing physical spectrum (L1) or using other layers of network protocol stack (L3-L7). According to the Wiley Online Library, a "medium access control (MAC) layer provides the radio resource allocation service and the data transfer service to the upper layer. As part of the data transfer service, the MAC layer performs procedures such as scheduling requests, buffer status reporting, random access, and hybrid automatic repeat request (HARQ)."

This vulnerability is formally called CVD-2021-0045, which we've nicknamed SPARROW. It has been responsibly disclosed in the GSMA Coordinated Vulnerability Disclosure program and recognized on the GSMA Mobile Security website.

Discovering SPARROW
As a senior researcher at Keysight ATI Research Center with a background in signal processing and wireless systems security, I envisioned the possibility of exploiting wireless broadcast resources of commercial telecom networks for data exfiltration while investigating methods for data exfiltration in 2020. I realized that there are many threat scenarios across the spectrum of network and Internet applications. Some of them go beyond the classic threat definitions used in the field of wireless security. I define a vulnerability as any opportunity to use a system beyond its intended application. Threat scenarios such as data exfiltration are what give special significance to finding and patching vulnerabilities in systems and standards.

The scenario of data exfiltration is a frequent research topic in cybersecurity. It's where malicious actors create covert communication schemes to leak sensitive information from compromised systems. So far, the best-known techniques exploit Internet applications and network protocols and the security industry has developed preventive measures to block these. Based on my understanding of wireless security, I began asking a key "what if?" question, which became a foundation for the discovery: "What if one exploits the MAC layer protocol of the commercial wireless access infrastructure for low-cost and power-efficient covert communication?"

Since commercial wireless signals are available virtually everywhere, exploiting them for data exfiltration can circumvent all existing preventive measures. I did not find any articles about exploiting wireless MAC layer (L2) protocols for covert communication. I attribute this lapse to different interpretations of covert communication across the research community. Cybersecurity researchers have generally focused their efforts on techniques exploiting protocols L3 to L7. In the context of wireless security, covert communication commonly refers to covert broadcasts using L1 radio signals. This includes L1 pirating radios that can exploit spectrum licensed to commercial networks. But what about L2?

The familiar 3GPP standard was my first research target. By February 2020, I could identify a vulnerability in the 3GPP TS 36.321 standard that affects both LTE and 5G networks. I dubbed the finding SPARROW. It allows anonymous low-power devices to exchange short hidden messages within a cell without attaching to the network. We then arranged a proof-of-concept scenario, together with an engineering team in Milan, Italy. That scenario was verified in December 2020.

The Danger of SPARROW
Here's why SPARROW is a real danger to critical facilities protected against other means of covert communication:

The notable exploitation scenarios include:

Here are the big takeaways: