Security challenges in the transition to 4G mobile systems in developing countries

Abstract

4 G mobile networks have evolved to meet the ever-increasing demand and requirements of users. 4 G will provide comprehensive IP solutions, allowing users to access voice, data, and streaming multimedia services at any time, from any location. Nonetheless, this transition will introduce new vulnerabilities and threats to service providers and customers. With the introduction of machine-to-machine (M2M) communication and the Internet of Things (IoT), malicious actors now have more attack ground. Attackers have an easier time sneaking into 4 G networks in developing countries because outdated and unprotected devices are still in use. Many startups and individuals did not invest in protecting their devices, owing to financial constraints and a lack of fundamental cyber security awareness. Because many network devices in developing countries are old and poorly protected, they could serve as a launching pad for perpetrators. This work thoroughly investigates and discusses fundamental security flaws in the 4 G network. These flaws could provide a path for malicious actors. Several factors exist in developing countries that expose them to perpetrators have been explained and elaborated on this work. Additionally, potential solutions to combat these issues are proposed.

Keywords:

• 4G
• VoLTE
• IoT
• Cybersecurity
• Broadband
• Wireless

Public interest statement

With higher bandwidths, better spectrum efficiency, and lower latency than legacy cellular networks, the 4 G/LTE network provides advanced services to its users. However, because of its all-IP-based heterogeneous architecture, it faces new security threats. Since the 4 G architecture makes the process easier, the proliferation of new access technologies has increased more than ever. This is a global trend, and developing countries are also benefiting from 4 G services. However, developing countries previously lacked basic security infrastructure, and the deployment of 4 G with its advanced services exacerbates the security challenge. Because the all IP trend brings internet world challenges to the 4 G network structure, the consequences become even more pressing. This work attempts to investigate the operational challenges that cyber criminals pose to developing countries and the world at large as a result of poor and under-protected network devices and a lack of skilled manpower to combat those perpetrators.

1. Introduction

In response to the rising demand for mobile broadband services, the 3rd Generation Project Partnership (3 GPP) has begun working on two parallel projects to provide higher data rates and better service quality (QoS). Long Term Evolution (LTE) and System Architecture Evolution (SAE), together refereed as 4 G, comprise and define the radio access network (RAN) and system core network, respectively. The wireless industry hopes to provide a packet-optimized, very efficient, better spectrum utilization, lower latency/delay, and many other benefits by using LTE/SAE (Akyildiz et al., 2010; Mihret & Haile, 2021).

4 G employs an all-IP-based flat architecture at the network layer. This aids in the provision of interoperability with existing technologies via various routes. Any network operator, whether a GPRS/EDGE operator or a non-3 GPP system operator, can join the 4 G network. As a result of its increased flexibility, many operators worldwide prefer it. As shown in Figure 1, various services and models will be available to provide seamless network connections, which is considered the true technical step-up of 4 G over 3 G. 4 G tries to meet customers’ ever-increasing demand by seamlessly integrating existing and new networks and services (Agrawal et al., 2015).

Figure 1. Seamless Connections of Networks (Khan et al., 2009).

Terminal and network heterogeneity are some of the key characteristics of 4 G that distinguish it from previous generations. While the former refers to various terminals with varying display sizes, energy consumption, portability, and complexity, the latter stems from the increasing proliferation of a variety of access technologies such as UMTS, WiMAX, Wi-Fi. Figure 2 depicts network heterogeneity with only a few network types. Because these heterogeneous networks have different data rates, coverage, latency, loss rate, power consumption, and other network characteristics, each is practically designed to support a different set of specific services and devices (Akyildiz et al., 2014; Kumar & Gandhi, 2018).

Figure 2. Heterogeneous Networks (Frattasi et al., 2006).

At the heart of 4 G networks are IP technologies for session control, mobility management, etc. It enabled a new generation of IP-based services, which interoperates with other wireless telecommunication networks. Network operators will thus be able to offer multimedia services to their subscribers. A 4 G network allows for more data transmission, which allows for voice and video calling, file transmission, internet surfing, online TV, viewing high definition video, playing online games, and much more (Krasniqi et al., 2018).

The 4 G core network has been integrated with other networks such as the Internet, resulting in additional vulnerabilities and easy access for malicious attackers via the Core Network Servers. While 1 G and 2 G networks were vulnerable to Single Infrastructure cyberattacks, 3 G and 4 G networks are also susceptible to Cross Infrastructure cyberattacks (Vachhani,).

Cellular network security architecture has evolved over time. Eavesdropping on conversations by intruders and other fraudulent activities were common issues in 1 G (first generation) wireless networks (Zhang & Fang, 2005). Authentication algorithms in 2 G GSM (Global System for Mobile Communications) were not very strong. Brute force attacks on a SIM card may reveal the master security key (Shin et al.,). The authentication mechanism in 3 G wireless (3GPP-based) was improved to become a two-way process. Mutual authentication was achieved by both the mobile device and the network. Furthermore, 128-bit encryption and integrity keys were used to increase security. Finally, mechanisms for ensuring the freshness of the cipher/integrity keys were implemented. As a result, if a security key is compromised or broken, the damage is limited to the time the key is valid—rather than having long-term consequences (Asmare et al., 2022; Horn & Howard, 2000; Putz & Schmitz, 2000).

Additional security enhancements were introduced in 4 G LTE. Further layers of abstraction were added, for example, in terms of the unique identifiers (ID) for an end-mobile device (UE). In 2 G, a single unique ID was used on the SIM card; in 3G and later 4 G LTE, temporary ID and further abstraction were used, resulting in smaller windows of opportunity for identity theft. Another mechanism for increasing security in 4 G was the addition of secure signaling between the UE and the MME (Mobile Management Entity; Bargh et al., 2007).

During the transition from 1 G to 4 G, security protection has made significant advances. However, 4 G LTE, faces even more cyber threats than 3G. Since the Internet protocol will be the core protocol to provide all services of 4 G, this fundamental shift reverses the previous trend in telecom protocols, which were closed and thus served as a barrier to entry for attackers. In contrast, Internet technologies are open and well known to attackers, and there are numerous techniques for searching for vulnerabilities in them and numerous tools for easy exploitation (Vachhani,). Because IPV4 is still widely used in 4 G systems, it provides a plethora of loopholes and methods for a perpetrator to conceal his or her true identity and location. Online identities and servers are simple to conceal. Multiple servers can be used to mask and redirect packet flows and connections, allowing machines from innocent organizations to be used as a launchpad for cunning attackers. (Deibert et al., 2009; Bikos & Sklavos, 2012; Cao et al., 2013; He et al., 2018; Park & Park, 2007; Seddigh et al.,) examined various aspects of LTE security threats. In (Cao et al., 2013), LTE network security was discussed in detail, with six aspects of vulnerabilities thoroughly examined. The aspects covered were system architecture, access procedure, handover procedure, IP Multimedia Subsystem (IMS) security, Home eNodeB (HeNB) security, and Machine Type Communication security. The vulnerabilities in 3GPP Authentication and Key Agreement (AKA) are summarized in (Park & Park, 2007), and the occurrence of malicious worms, viruses, and Voice over LTE (VoLTE) threats is indicated. Seddigh et al. (Seddigh et al.,) categorized security threats into layers. They stated that interference and scrambling attacks at the physical layer could affect LTE/LTE-A. It also examined attacks at the Media Access Control (MAC) layer, such as location tracking, bandwidth stealing, Denial of Service (DoS), and other security issues. Furthermore, this survey summarized security issues at higher layers. Bikos and Sklavos (Bikos & Sklavos, 2012) expand on LTE/LTE-A security by discussing ciphering algorithms and integrity methods. While researching current encryption and authentication techniques, they discovered flaws in LTE/LTE-A security algorithms and procedures. (He et al., 2018) provides a comprehensive and organized summary of LTE/LTE-related attacks. To determine and detect network attacks and to assess network security, security measurements were performed using real-time data.

Despite the fact that the preceding studies examined security threats and potential attacks in many aspects of LTE, they lack a thorough discussion of the effects of individual subscriber cyber activity and property, particularly in developing countries where cyber-related laws are weak and network devices are poorly protected. In such under-protected countries, the introduction of new technologies creates more vulnerable points as well as wider weak spots for perpetrators. Furthermore, the inherent design flows in 4 G networks, combined with the continued use of poorly protected network devices and careless users, will increase the security risk. And it is widely accepted that a system’s security is only as strong as its weakest links. In this paper, we discussed the effects of poor infrastructure and lack of basic cyber knowledge on the security of 4 G networks.

The following are the objectives of this study.

• Introduce fundamental security flaws discovered in 4G networks that were not encountered in previous generations.

• Explain the various types of fundamental threats that are the root causes of many basic security issues in developing countries.

• Describe the various types of factors that have contributed to developing countries’ security vulnerability.

2. Fundamental security issues in 4 G architecture

The deployment of 4 G networks in developing countries significantly impacts security. Older generations of wireless networks, which are now widely deployed in developing countries, are more vulnerable to cyberattacks (Shaik et al., 2015). As technology advances toward broadband networks, cyber-threats evolve in nature and magnitude. Which, in turn, promotes the implementation of various forms of abuse. Better network quality will attract new and valuable users, but it will also provide opportunities for criminals (Kshetri, 2019). The inclusion of IoT in 4 G packages exposes even more vulnerable points than before, making achieving a secure networking environment more challenging. If successful attacks are carried out in today’s interconnected world, the entire global economy could suffer a devastating blow.

Each of the main LTE components can be targeted by a variety of hacks. User Equipment (UE), Evolved UMTS Terrestrial Radio Access Network (E-UTRAN), and Evolved Packet Core (EPC) comprise the LTE network architecture. Attackers target not only individual components but also the communication between them by exploiting vulnerabilities in the protocols. Because of design flaws, authentication parameters can be easily brute forced and Internal protocols that are not configured with integrity safeguards invite a variety of attack scenarios. For example, on-path attacks that result in eavesdropping or data modification, undetected fraudulent activity, denial-of-service, and much more (Shaik et al., 2015).

Figure 4 depicts a comprehensive summary of the classification of attacks on the LTE network based on its network framework. Significant attack types have been illustrated in the access network, core network, IP Multimedia Subsystem (IMS), and user equipment. These attacks infiltrate and cause harm by utilizing various parts of the network infrastructure and methods. And the infiltration is made possible by many weak points in the interaction between LTE network entities.

Figure 3. Attacks on a mobile network (Macaulay, 2013).

As previously stated, the introduction of 4 G and the changes it brings with it allow for unique variations and opportunities for attackers when compared to previous generations, and these variations can be broadly classified into the following scenarios.

3. Wireless APN flooding

Compared to previous generations, 4 G has a larger bandwidth, which means cybercriminals will have a larger attack surface. Unless aggressive countermeasures are implemented, these abusive activities will consume a significant portion of the new bandwidth and crimp network performance. The wireless architecturally private network (APN), which connects mobile devices in 4 G networks, could be overwhelmed by an attacker who has installed automated probing and scanning software, as shown in Figure 3. A core bandwidth could be quickly monopolized if this happened, enslaving multiple devices and crimping network performance. Attacks can degrade service levels by consuming the “last mile” of scarce wireless capacity (Macaulay, 2013; Oğul & Baktır, 2013).

Figure 4. Various types of attacks on LTE Network (Shaik et al., 2015).

4. Mobile to mobile attacks

The design of 4 G is entirely IP-based, so devices, including mobiles, can exchange data traffic directly within the wireless APN without passing directly through the core network via tunnels, as previous generations did. This improves network performance by reducing traffic in the IP core network. However, mobile-to-mobile (Mob2Mob) attacks are possible because mobile devices communicate. Because this increases the likelihood of a compromised mobile device simultaneously targeting and scanning a large number of other, nearby mobile devices, consuming massive amounts of spectrum (Weichbroth et al., 2020).

The compromise could come from a variety of sources. According to a study on Android phones, hackers secure APK code without breaking an app’s cryptographic signature, transforming any application into a malicious Trojan, utterly undetected by the app store, phone, or the user, and depending on the type of application; a hacker can exploit the vulnerability for anything from data theft to the creation of a mobile botnet (Macaulay, 2013). Furthermore, Independent Security Evaluators (ISE) set out to evaluate the level of security provided by 13 popular wireless routers discovered that almost all of them had critical security vulnerabilities that could be exploited by a remote adversary, resulting in router compromise and unauthorized remote control (Macaulay, 2013; Weichbroth et al., 2020).

Expenses will skyrocket if improvements and investments in enhanced security, LTE base stations, backhaul networks, and other areas are implemented. Furthermore, increasing the number of these elements raises operating costs while unintentionally increasing management complexity, which is more difficult in developing countries due to the small number of LTE customers (Macaulay, 2013).

5. Attacks via compromised eNodeB/ Femtocell/ microcell

While virtualization technology can increase equipment utilization while lowering capital and operating costs, it may also introduce vulnerabilities that attackers can exploit. If successfully attacked via a security flaw in the commercial hypervisor or operating system of application (radio) software, a virtualized eNodeB in the 4 G network may fail. Worse, it may serve as a launchpad for attacks on the underlying network management infrastructure. Each Femtocell loss reduces service availability for multiple users (Oğul & Baktır, 2013).

Although the network generally protects the management infrastructure, it still needs to maintain open connections to serve its users. If an attacker gains access to a trusted device, such as an eNodeB, the attacker will navigate to many other internal devices (such as the management infrastructure). Once inside the network infrastructure, attackers have numerous options for disrupting services or causing outages resulting in reduced revenue and customer dissatisfaction (Macaulay, 2013).

6. Machine to machine fragility

Nowadays, many machines generate massive amounts of data, and these machines are capable of collecting and processing data to perform a variety of tasks. When different machines share data for their operation, they become smarter and have more information to make better decisions. These devices include not only human-managed devices such as desktops and smartphones, but also semi-automated and fully-automated devices that control physical outcomes such as traffic lights, pipeline pressure sensors, electrical grids, and water utilities, among others. These devices are occasionally called “machine-to-machine” (M2M) networking devices. Because they used limited, dedicated networks that were not connected to a public network, these fixed-function devices were traditionally built with little regard for security (Imani et al., 2018; Macaulay, 2013).

Most field-based sensors have limited resources, such as little memory and a slow CPU, making installing firewalls or even basic security capabilities difficult, if not impossible; this exposes these sensors to vulnerability scanners and attackers through simple network probing, which could have negative consequences by destabilizing controllers. In some cases, these devices run legacy operating systems that are unpatched. The design of most modern M2M systems and devices does not consider operating in the Internet’s hostile environment. When attacked, these devices may fail to function correctly if not completely shut down, and they may also find it difficult to recover quickly. Unintentional service disruptions can lead to costly emergencies and, in extreme cases, could cause loss of life (Imani et al., 2018; Macaulay, 2013).

7. VOLTE service assurance

Even though the VOLTE infrastructure is not accessible via the Internet, mobile devices that have subscribed to voice services from the service provider must access the VOLTE infrastructure from any location. Because numerous pre-paid accounts and phones can now be easily acquired and topped up from random kiosks, restricting VOLTE service access to those labeled “Friendly” or recognized subscribers is extremely difficult. As a result, the VOLTE infrastructure will be vulnerable to various attacks. Multiple VOIP attacks have evolved over time via the Internet and can be used effectively against VOLTE (Li et al., 2015).

There are thousands of known attacks against VOIP protocols, ranging from capturing administrative privileges to denial-of-service attacks. The impact on consumer and business voice services and emergency services that support police, fire, and medical resources can be highly disruptive and dangerous, resulting in regulatory issues. Because VOLTE traffic is contained mainly within the wireless APN, carriers require specialized monitoring equipment to detect attacks as they move from the 4 G infrastructure to the VOLTE service infrastructure (Li et al., 2015; Macaulay, 2013).

8. Content and media delivery

According to Cisco, video content accounts for more than half of all data transmitted over the Internet. The main contributors to such a high rate are paid-for content and media, such as movies or video/music-on-demand features of the 4 G broadband ecosystem, which provide additional revenue to service providers. Making video and music available through localized portals linked directly to the wireless APN can provide performance and variety that “over the top” services accessed via the Internet cannot (Hao et al., ; Macaulay, 2013). As with VOLTE, unauthorized access and denial-of-service attacks can jeopardize expected revenue from broadband media services. These attacks will degrade services and lower subscription and adoption rates. Carriers should expect attackers to disrupt content delivery systems during peak hours. Internet criminals, hacktivists, and other malicious parties are skilled at launching attacks during significant events such as World Cup matches, elections, or royal weddings. Furthermore, a complete disruption of a broadcast service will be far more visible than a large number of usually unrelated dropped calls. Subscribers who paid a premium to watch a major sporting event will quickly vent their rage on social media, eventually harming the company’s reputation and may reduce subscriptions and long-term adoption of new services (Hao et al., ; Macaulay, 2013).

9. Types of cyber-threats for developing countries

It is essential to research and analyze primary threats in developing countries since any vulnerability could be a springboard for global digital infrastructure attacks. Today, we can consider several such issues: China has the most botnet-forming IoT devices (Symantec,). Significant botnet activity hit Brazil aiming at network traffic destined for Brazilian banks (Cimpanu, 2017). Ethiopia has been subjected to a cyberattack by an Egyptian-based actor known as “the Cyber Horus Group,” which aims to put significant “economic, psychological, and political pressure on Ethiopia” over the completion of the Grand Ethiopian Renaissance Dam on the Nile River (Allen,). These attacks demonstrate the increasing influence of cyber threats on the security of developing countries.

Governments frequently establish and implement cyber-security technical controls years after the country has gone digital. This structural and framing void jeopardizes the security of many countries and creates weak points for cybercriminals known as ’hollow diffusion’ (Kshetri, 2010). Cybercriminals research and exploit existing weaknesses in developing countries. They also carry out attacks on other territories, including developed states, using the infrastructure of developing countries. This pattern is expected to continue. The following are some of the most severe security flaws that must be addressed.

10. Cyber espionage

Espionage or cyber spying is a type of cyberattack in which an unauthorized user sniffs sensitive or classified data or intellectual property for various reasons such as economic gain, competitive advantage, political purposes, or even religious belief and nationalism. In general, it can be defined as an intelligence-gathering method that is not publicly available and employs either human agents or advanced technological means (Deibert et al., 2009). The primary motivation for these attacks is monetary gain, but they can also be used in conjunction with military operations or as an act of cyber terrorism or cyber warfare. Cyber espionage disrupts public services and infrastructure, and it may also result in fatalities. The consequences become severe when it becomes part of a more extensive military or political campaign (Deibert et al., 2009).

The theft of intellectual property and confidential business information; sensitive business information theft, as well as the possibility of stock market manipulation; opportunity costs, such as service and employment disruptions, and other similar unhealthy practices will decrease trust in online activities and additionally encore cost of network security, insurance, and cyber-attack recovery, while the reputation of the hacked company suffers as a result (Lewis & Baker, 2013).

The cyberespionage linked to China on the African Union headquarters in Ethiopia is an excellent example of such espionage in developing countries. According to the reports, the contents of the headquarters’ servers were hacked and uploaded to a server in Shanghai. These alleged espionage operations are said to have been successful, in part because China built the headquarters building and is a provider of Information and Communications Technology (ICT) infrastructure, allowing them to build backdoor and install listening devices (Allen,).

11. Critical infrastructure sabotage

Securing cyberspace is quickly becoming one of many countries’ top security concerns. Extensive and sophisticated infrastructures that power the vast majority of a country’s economy are now connected to the Internet and must be safeguarded against catastrophic sabotage. If their connection is disrupted, government, banking and finance, information and telecommunication networks, military systems, energy grids, transportation, emergency services, public health, and many other systems are at risk (Allen, ; Thakur et al.,).

Sometimes sabotage is perpetrated by a former or disgruntled employee who has access to sensitive information due to his or her job position. Because of their knowledge of and access to employer systems and databases, this insider perpetrator poses a significant threat (Homoliak et al., 2019; Schoenherr & Thomson,).

For example, “Stuxnet” malware sabotaged Iran’s nuclear infrastructure, causing critical damage. The malware was designed to destroy Iran’s infrastructure, such as power plants and gas pipelines, as well as the nuclear program (Thakur et al.,). Many African banks and other critical infrastructure are becoming targets of such sabotage. The Nigerian National Security Agency and the Johannesburg municipal government were victims (Allen, ; Baken, 2013).

12. Organized crime

Since globalization, electronic systems have entirely replaced the direct transfer of money. Nowadays, wealth transactions have evolved from property exchanges to information technology transactions, intensifying the types and techniques of cybercrimes (Grabosky, 2015). Many developing countries are increasingly concerned about cybercrime. Africa lost approximately $3.5 billion in 2017 due to malicious activities such as cyber fraud and theft, suggesting that cybercrime poses a significant threat to African national security (Allen,). Hackers use cutting-edge phishing techniques and malware to compromise and steal information from poorly protected and unsuspected businesses, organizations, and governments.

13. Factors that expose developing countries to security threats

13.1. Technology-related factors

Because of the insufficiency of previously established business institutions, developing countries, particularly Africa, rely on mobile technologies to transfer money. Approximately 14% of Africans use mobile technology to transfer money, making Africa the world leader in this area (Akerele,).

Though this is critical for reaching people who previously had no access to business organizations, many developing countries are characterized by hosting outdated and inadequately secured information assets, making them easy targets for cybercriminals. Furthermore, many developing countries lack security professionals and specific cyber legislation, allowing cybercriminals to target these countries continuously (Akerele, ; Allen,). Independent surveys have revealed the following issues:

• Malware has infected more than 80% of Personal Computers in Africa (Oğul & Baktır, 2013). Windows 7, the most vulnerable to the “WannaCry” attack, is installed on approximately 55% of computers (Schia, 2018).

• Windows XP, which has been out of support and with no updates since 2014, is still used by roughly a quarter of Africans (Akerele,).

• It is challenging to manage cyberattacks in Africa because more than 95 percent of African organizations operate below the “security threshold line”. They do not invest in improving security, and many do not even have basic security structures (Serianu,).

• According to Global Software’s survey, more than 57 percent of software used in the Middle East and Africa is unlicensed (BSA, 2016), making upgrading and installing security patches difficult. Furthermore, it is unaffordable for startups, entities, and individuals to own the most recent hardware and software versions, let alone invest in cyber security solutions, leaving them vulnerable to attacks.

Most developing countries cannot afford to purchase more secure products, so they will opt for those that are less expensive, resulting in less secure products and versions. Many ICT vendors assess their clients’ expectations and capacities and adjust their offerings to meet such demands, exacerbating the problem because outdated or unprotected systems will remain operational, providing easy prey for cybercriminals. These targets could also be weaponized to reach additional targets (Kshetri, 2010).

13.2. Human-related factors

Aside from technological reasons, a lack of basic awareness, knowledge, and skills of cyber threats plays a significant role in developing countries’ poor cyber security (Kshetri, 2010). Careless online users are easy targets for cyberattacks. The fact that many developing countries lack cyber security experts exacerbates this problem. In (Serianu,), it is reported that Africa has less than 10,000 cyber security professionals, despite having a population of more than 1.3 billion people. According to ISACA (an independent association of information security professionals), as of mid-2018, sub-Saharan African cybersecurity professionals constituted only 4% of ISACA-accredited information assurance experts globally, totaling only 5700 (Nduati, 2018).

Another human factor worth mentioning is a lack of education in cybersecurity. Because the education system does not attempt to cover the area and research solutions are not being developed, addressing this imminent problem remains a significant challenge (Serianu,). Individuals attempted to teach themselves about such issues through informal education, primarily by independent self-study. However, this option is still limited in developing countries because English is required to understand basic information security concepts, and most people are not fluent in this language (Kshetri, 2010).

Cybercrime can also be viewed as a source of income in areas where unemployment is high and available jobs pay less or are unevenly distributed. Because of the poor economic situation, individuals who have acquired some ICT knowledge and skills but cannot meet their financial demands or find any form of formal employment are encouraged to consider hacking an attractive income source. Others may obtain hacking tools via the Darknet and engage in illegal activities (Sullivan, ; worldbank,). Cybercrime is becoming more acceptable in societies where poverty and unemployment are prevalent. The so-called “yahoo boys” in Western African countries are a good example (UNODC,). These university students attempted to engage in online fraud for monetary gain. Similarly, in Ghana, the “sakawa boys” attempted such frauds, citing survival and unemployment as justifications (Warner, 2011).

14. Legal framework and strategic solution related factors

Developing countries lack effective legal and strategic frameworks that play a critical role in preventing cybercrime. Adopting cybersecurity strategies for long-term solutions is yet to come being the major drawback of developing a well-designed cybersecurity system.

According to a survey in (UNODC,), most countries worldwide that participated in this survey believe that cybercrime-related laws are insufficient. An independent study confirmed that legal enforcement of cybercrime is lacking in approximately 30 of 54 African countries (Symantec,). Because cyber law is weak in such developing countries, organized crime prefers to use them as a base of operations. Weaker legal frameworks and clumsy law enforcement will provide criminal organizations with a “safe haven” (Kshetri, 2010), which significantly impacts the rise of cybercrime in developing countries. Brazil, for example, is ranked first in the world in terms of cybercrime origination (Limor Kessem, 2015); this is mainly due to insufficient cybercrime legislation (C. S. A. of Singapore, 2017).

In addition to insufficient regulations, weak law enforcement mechanisms hinder the fight against cybercrime, especially in developing countries. The police force to national internet users’ ratio is 0.2 to 100,000 (UNODC,). Furthermore, more than 70% of law enforcement officers lack computer and cyber skills and the necessary equipment, and they require assistance in investigating cybercrimes (UNODC,).

15. Solutions and way forward

15.1. Education

Security threats are more severe in developing countries than in developed countries due to an inability to secure ICT platforms. As a result, it is critical to improving security systems and ICT knowledge first and foremost in order to avoid or eliminate the threat. More knowledge means the ability to fight back against perpetrators, either technologically or legally. Developing-country governments must intervene to integrate aspects of cybersecurity into their educational curricula. Because no one can escape the advancements of such technologies, countries will be more vulnerable to new threats. The best way to move forward with technology and use it for the benefit of one country is for government bodies responsible for setting up education curricula to prioritize security (Europeancommission, 2017).

Many developing countries may find it difficult to establish strong education systems due to budget, resource, and skilled labor constraints. Here, technology itself comes to the rescue. Technological advancements not only sophisticate threats but also provide educational platforms. Online education, for example, has the potential to play a significant role in areas where internet access is available (AfricaEuropeAlliance, 2019). Organizing other informal methods may also be beneficial. For example, non-governmental organizations (NGOs), private companies, and other agencies could play an essential role in bridging the knowledge gap by providing short-term training, workshops, etc. To encourage such participation, the local government must offer assistance and, if necessary, simple incentives (AfricaEuropeAlliance, 2019). Because budget is frequently cited as a barrier to implementing intensive reforms, identifying and ranking risks, determining which are critical, and addressing those issues may be a strategy worth pursuing. This risk-based strategy should prioritize awareness creation and training in order to best address the cyber-security issue.

16. Legal framework establishment and strengthening

Developing countries must prioritize cybersecurity issues and build structures and countermeasures that can effectively prevent cyber threats. Best existing guidelines that produce effective results must be sought out and used to develop strategic actions and decisions. A well-planned and implemented strategy will ensure that a safe and secure environment is available to business owners and investors.

16.1. Responsibilities of vendors

The imperfections in technology have caused security issues, and vendors must take the lead in finding solutions and providing secure infrastructures. ICT vendors must adhere to security principles when developing their products, beginning with the design phase. Because the world’s reliance on technology is increasing all the time, researchers must focus on security more than ever. Universities and research institutions could be of assistance in this regard.

17. Conclusion

ICT technology has altered our habits and is now affecting everyone’s lives, and no one can avoid it. It has a considerable impact on the world economy. Its influence extends to communication, marketing, manufacturing, health care, educational accessibility, and many other areas. The telecommunications industry is also evolving, with the rapid deployment of 4 G networks worldwide, providing faster connections and introducing new products and services. Providing various interactive platforms brings the world’s people closer together and more connected than ever before. While this is true, it exposes those previously isolated and secure to open fields. Perpetrators stole private information, credit card information, and other sensitive information by hacking into mobile devices and other electronic systems, leaving innocent customers with nothing. The consequences are severe for people in developing countries because their education level is lower, limiting their ability to secure themselves. Because developing countries have limited capacity to invest in security, users are vulnerable to malicious activities. Without careful precautions, hackers may use these countries as a gateway to disrupt the entire world. The inclusion of IoT devices and machine-to-machine communication in 4 G expands potential weak points for perpetrators, especially in developing countries, where a significant issue is lacking appropriate software updates in mobile phones and computers. Because technological advancements bring considerable benefits, we cannot limit their implementation due to security concerns. To deal with the security issues that arise, governments in developing countries must work hard to improve their policies to effectively combat cybercriminals by developing workable laws and strengthening law enforcement bodies. Governments should prioritize training and educating professionals because it is the most effective way to combat such crimes. Furthermore, the leading players in technological advancements, vendors must work to secure their products in the first place because the damage affects everyone.

This paper focuses on 4 G LTE systems, but because WiMAX is also a 4 G technology, assessing the vulnerabilities associated with it is also important for gaining a better understanding of the overall security issues. Furthermore, many developing countries are now beginning to deploy the next generation network known as 5 G, which is expected to increase the number of networked devices and newer types of technologies while also introducing unexpected vulnerabilities. Investigating the effects of this emerging technology sooner would have a significant impact on the security of our network.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Additional information

Funding

The authors received no direct funding for this research.

Notes on contributors

Fanuel Melak Asmare

Fanuel Melak Asmare The Signal Processing and Wireless Systems (SPWS) research group is comprised of Bahir Dar Institute of Technology (BiT) employees. The members completed their studies at Jacobs University Bremen in Germany, Indian Institute of Science Bangalore, and Indian Institute of Technology Bombay in India.

Lijaddis Getnet Ayalew

Lijaddis Getnet Ayalew The research group’s main areas of interest are wireless communication, telecommunications, signal processing, and machine learning. This research takes into account the significant and continuing demand for high-speed data transfer with minimal latency. This demand will become stricter in the coming years as technologies such as the Internet of Things (IoT), Internet of Medical Things (IoMT), Internet of Vehicles (IoV), and others evolve. This can be accomplished by enhancing the capabilities of telecommunication devices.