Apply packet filtering in Wireshark for cellular traffic, verify firewall rules at signaling boundaries, and audit protocol parameter bounds.
📖 Briefing Coverage Scope
Interconnection networks operating over GPRS Roaming Exchange (GRX) and IP Exchange (IPX) transport cleartext user data across international borders. When a subscriber roams, the visited network routes their data traffic back to the home network through GPRS Tunneling Protocol User Plane (GTP-U) tunnels over the S8 or Gn interface, or processes it locally using Local Breakout. Historically, mobile operators assumed IPX transport networks were private, trusted, and isolated from the public Internet. Malicious actors, rogue IPX providers, and compromised carrier network elements routinely invalidate this trust model by monitoring, tapping, or injecting traffic into international link exchanges.
GPRS Tunneling Protocol User Plane (GTP-U) lacks native encryption or cryptographic integrity verification. A GPRS Tunneling Protocol User Plane header contains a 32-bit Tunnel Endpoint Identifier (TEID) followed by unencrypted inner IP packets carrying subscriber web browsing, unencrypted Voice over IP (VoIP) calls, or application payloads. An adversary with passive access to an IPX peering point, such as a compromised border gateway or tap on an optical cross-connect, extracts raw subscriber data by filtering packets matching the destination IP address of the Serving Gateway (SGW) or Packet Data Network Gateway (PGW) on User Datagram Protocol (UDP) port 2152.
An attacker can also execute active injection attacks over IPX links using GPRS Tunneling Protocol Control Plane (GTP-C). By transmitting forged GTP-C Create PDP Context Request or Update PDP Context Request (for 3G) or Create Session Request and Modify Bearer Request (for 4G Long Term Evolution (LTE)) messages on UDP port 2123, an attacker overwrites the stored Tunnel Endpoint Identifier and Fully Qualified Tunnel Endpoint Identifier (FTEID) Information Elements inside the home network Packet Data Network Gateway. This forces the Packet Data Network Gateway to duplicate or redirect outbound GTP-U streams toward an attacker-controlled IP address, exposing the entire user plane stream to man-in-the-middle interception without disrupting the subscriber session.
To mitigate user plane traffic interception, operators must implement strict perimeter security measures:
- Enforce GSM Association (GSMA) FS.11 and FS.34 GTP security guidelines on all GPRS Roaming Exchange and IP Exchange border firewalls.
- Drop unexpected GTP-C context creation and modification requests originating from non-whitelisted IPX IP addresses.
- Validate that incoming GTP-U Tunnel Endpoint Identifiers match active GPRS Tunneling Protocol Control Plane sessions recorded in the local network state table.
- Implement IPsec Encapsulating Security Payload (ESP) tunnels across IPX interconnect links to encrypt roaming traffic between security gateways.
- In 5G Standalone (5G SA) architectures, deploy Security Edge Protection Proxy (SEPP) nodes running Protocol for N32 Interconnect Security (PRINS) over the N32-c and N32-f interfaces to enforce end-to-end application layer encryption, mutual Transport Layer Security (mTLS), and cryptographic payload integrity checking for all inter-Public Land Mobile Network (PLMN) signaling exchanges.
STUDY BRIEFING DOSSIER EXPORTER EXPORT COMPLETE LAB NOTES & TIMESTAMPS FOR NOTION / OBSIDIAN
5G SBA NRF Service Discovery & OAuth2 Token Abuse
5G-SBA
Call flow illustrating how an unauthenticated Network Function (Rogue NF Consumer) queries the NRF for discovery and retrieves access tokens without adequate TLS mutual auth or token scoping.
Entity 01Rogue NF Consumer (AMF)
Entity 02NRF (Discovery & Auth)
Entity 03Target NF Producer (UDM)
1
1. GET /nnrf-disc/v1/nf-instances?target-nf-type=UDMREQUEST
Rogue NF Consumer (AMF) ➔ NRF (Discovery & Auth)
2
2. 200 OK (UDM Endpoint URI & Supported Services)RESPONSE
NRF (Discovery & Auth) ➔ Rogue NF Consumer (AMF)
3
3. POST /oauth2/token (grant_type=client_credentials, scope=nudm-sdm)EXPLOIT
Rogue NF Consumer (AMF) ➔ NRF (Discovery & Auth)
4
4. 200 OK (Access Token: Bearer eyJhbGciOi...)RESPONSE
NRF (Discovery & Auth) ➔ Rogue NF Consumer (AMF)
5
5. GET /nudm-sdm/v1/imsi-208950000000001/am-dataEXPLOIT
Rogue NF queries NRF discovery endpoint to enumerate registered UDM instances in PLMN.
Technical Term & Subtitle Translator
Inspect Technical Acronym:
5G-SBA — 5G Service Based Architecture
5G Core
🇺🇸 English
Core network architecture in 5G Standalone (SA) where Network Functions (AMF, SMF, NRF, UDM) communicate via HTTP/2 REST APIs with OAuth2 authentication.
⚠️ Security Vectors & Exploitation Note:
Vulnerable to NRF token abuse, unauthorized REST discovery, and API gateway parameter tampering.
About this signal
Interconnection networks operating over GPRS Roaming Exchange (GRX) and IP Exchange (IPX) transport cleartext user data across international borders. When a subscriber roams, the visited network routes their data traffic back to the home network through GPRS Tunneling Protocol User Plane (GTP-U) tunnels over the S8 or Gn interface, or processes it locally using Local Breakout. Historically, mobile operators assumed IPX transport networks were private, trusted, and isolated from the public Internet. Malicious actors, rogue IPX providers, and compromised carrier network elements routinely invalidate this trust model by monitoring, tapping, or injecting traffic into international link exchanges.
GPRS Tunneling Protocol User Plane (GTP-U) lacks native encryption or cryptographic integrity verification. A GPRS Tunneling Protocol User Plane header contains a 32-bit Tunnel Endpoint Identifier (TEID) followed by unencrypted inner IP packets carrying subscriber web browsing, unencrypted Voice over IP (VoIP) calls, or application payloads. An adversary with passive access to an IPX peering point, such as a compromised border gateway or tap on an optical cross-connect, extracts raw subscriber data by filtering packets matching the destination IP address of the Serving Gateway (SGW) or Packet Data Network Gateway (PGW) on User Datagram Protocol (UDP) port 2152.
An attacker can also execute active injection attacks over IPX links using GPRS Tunneling Protocol Control Plane (GTP-C). By transmitting forged GTP-C Create PDP Context Request or Update PDP Context Request (for 3G) or Create Session Request and Modify Bearer Request (for 4G Long Term Evolution (LTE)) messages on UDP port 2123, an attacker overwrites the stored Tunnel Endpoint Identifier and Fully Qualified Tunnel Endpoint Identifier (FTEID) Information Elements inside the home network Packet Data Network Gateway. This forces the Packet Data Network Gateway to duplicate or redirect outbound GTP-U streams toward an attacker-controlled IP address, exposing the entire user plane stream to man-in-the-middle interception without disrupting the subscriber session.
To mitigate user plane traffic interception, operators must implement strict perimeter security measures:
- Enforce GSM Association (GSMA) FS.11 and FS.34 GTP security guidelines on all GPRS Roaming Exchange and IP Exchange border firewalls.
- Drop unexpected GTP-C context creation and modification requests originating from non-whitelisted IPX IP addresses.
- Validate that incoming GTP-U Tunnel Endpoint Identifiers match active GPRS Tunneling Protocol Control Plane sessions recorded in the local network state table.
- Implement IPsec Encapsulating Security Payload (ESP) tunnels across IPX interconnect links to encrypt roaming traffic between security gateways.
- In 5G Standalone (5G SA) architectures, deploy Security Edge Protection Proxy (SEPP) nodes running Protocol for N32 Interconnect Security (PRINS) over the N32-c and N32-f interfaces to enforce end-to-end application layer encryption, mutual Transport Layer Security (mTLS), and cryptographic payload integrity checking for all inter-Public Land Mobile Network (PLMN) signaling exchanges.
SIGINT DISPATCH // BRIEFING DISCLOSURES
Intercepted Telecom Security Intelligence
Weekly briefings on 3GPP signaling CVEs, baseband reverse engineering, 5G SBA vulnerabilities, and packet captures.
