Presentation Material
Abstract
5G networks are designed with advanced protections to counter interception, fraud, and denial-of-service attacks. But what happens when an attacker leverages legitimate protocol semantics to navigate beyond intended security boundaries? This talk presents a new class of attacks that exploit subtle flaws in the design and deployment of 5G user plane architecture.
Through hands-on evaluation across multiple commercial and open-source 5G cores, we demonstrate how trust assumptions in user-plane traffic can be broken—enabling communication with otherwise unreachable core systems. The findings expose limitations in current protections and call for a reexamination of user plane trust in 5G architectures.
AI Generated Summary
The talk focused on security vulnerabilities in 5G networks, specifically in the separation between the control plane and data plane. The researcher drew an analogy between the Titanic’s supposedly unsinkable design and the 5G network’s assumed security, highlighting the potential for catastrophic failures when design flaws are exploited.
Key findings included the ability to tunnel malicious traffic from the data plane to the control plane using the GTPU protocol, which is used for packet forwarding. This allowed for protocol tunneling and network boundary bridging attacks, enabling an attacker to inject malicious packets into the core network. The researcher demonstrated several attacks, including reflective injection, direct routing to a target device, and registering a legitimate man-in-the-middle attack.
The practical implications of these findings are significant, as they could lead to billing fraud, legitimate man-in-the-middle attacks, and other security breaches. The researcher recommended that vendors and network operators prioritize securing their 5G core networks, including implementing proper identity management, rate limiting, and secure design practices. The talk concluded with a call to action, emphasizing the need for increased awareness and mitigation of these vulnerabilities to prevent potential attacks.