Apply packet filtering in Wireshark for cellular traffic, verify firewall rules at signaling boundaries, and audit protocol parameter bounds.
In this presentation, we will introduce a method which jointly exploits the vulnerabilities in tracking area update procedure, attach procedure, and RRC redirection procedure in LTE networks resulting in the ability to force a targeted LTE cellphone to downgrade into a malicious GSM network where an attacker can subsequently eavesdrop its voice calls and GPRS data.
Call flow illustrating how an unauthenticated Network Function (Rogue NF Consumer) queries the NRF for discovery and retrieves access tokens without adequate TLS mutual auth or token scoping.
Rogue NF queries NRF discovery endpoint to enumerate registered UDM instances in PLMN.
Core network architecture in 5G Standalone (SA) where Network Functions (AMF, SMF, NRF, UDM) communicate via HTTP/2 REST APIs with OAuth2 authentication.
Vulnerable to NRF token abuse, unauthorized REST discovery, and API gateway parameter tampering.
In this presentation, we will introduce a method which jointly exploits the vulnerabilities in tracking area update procedure, attach procedure, and RRC redirection procedure in LTE networks resulting in the ability to force a targeted LTE cellphone to downgrade into a malicious GSM network where an attacker can subsequently eavesdrop its voice calls and GPRS data.