New guidelines on adopting an Open Radio Access Network architecture have been released by the Cybersecurity and Infrastructure Security Agency and the National Security Agency, SecurityWeek reports.
Aside from facilitating increased interoperability, virtualization, artificial intelligence-enabled intelligence, cloudification, and innovation, Open RAN also presents new security issues for mobile network operators, according to the general-purpose document.
"By nature, an open ecosystem that involves a disaggregated multi-vendor environment requires specific focus on changes to the threat surface area at the interfaces between technologies integrated via the architecture," said CISA and the NSA.
MNOs have also been urged by the federal agencies to deal with security issues stemming from vendor components and open source software utilization. The document has also recommended addressing distributed denial-of-service attacks and other cloud infrastructure concerns pertaining to Open RAN.
"As standards are developed and adopted by equipment manufacturers, software developers, integrators, and mobile network operators, these security considerations may be mitigated through the adoption of standards and industry best practices," said the document.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.