Hacking 5G: From Radio Security to the APIs

Hacking 5G: From Radio Security to the APIs

Speakers: Sébastien Dudek, Founder, Penthertz

Conference: Hardwear.io USA

YouTube: https://www.youtube.com/watch?v=OXwfEFma7Zw

Overview

In his Hardwear.io USA talk, "Hacking 5G: From Radio Security to the APIs," Sébastien Dudek, founder of Penthertz, challenged the common perception that 5G is inherently more secure than its predecessors. Dudek, a seasoned security researcher and pentester, demystified the complexities of 5G security, demonstrating that while older vulnerabilities may have been addressed, new architectural paradigms introduce an entirely fresh set of attack vectors. His presentation provided a comprehensive overview of how security assessments are conducted against 5G networks, covering everything from the radio access network (RAN) to the core network and emerging API-driven interfaces.

The talk is particularly relevant given the rapid adoption of 5G across diverse sectors, including automotive, industrial IoT, private networks for enterprises, and even critical infrastructure. As 5G modules become ubiquitous, understanding its security posture is paramount. Dudek highlighted that the shift from traditional telecom protocols to web-based Service-Based Architectures (SBA), Open RAN, and CAMARA APIs transforms the threat landscape, making 5G core networks increasingly susceptible to attack methodologies familiar to web application pentesters. This re-framing of 5G security underscores the critical need for operators and private network maintainers to adapt their defensive strategies.

Background

▶ Watch: Introduction and talk's objective (0:00)

The evolution of mobile communication technologies has always been intertwined with the progression of security. Sébastien Dudek began by tracing this lineage, starting with 1G, an analog system that was notoriously insecure, allowing anyone with a simple FM demodulator to eavesdrop on conversations. 2G introduced digital communication but suffered from a lack of mutual authentication, making it vulnerable to various attacks. Subsequent generations, 3G and 4G, significantly improved security by incorporating mutual authentication and enabling broader internet connectivity. However, these networks still harbored vulnerabilities related to specific protocol implementations and SIM card usage.

With the advent of 5G, the industry widely promoted it as the "most secure" generation yet. This perception, Dudek argued, is largely an illusion. While 5G addresses many legacy telecom vulnerabilities, it introduces fundamental architectural changes that create new avenues for attack. Key among these are the two primary 5G architectures: Non-Standalone (NSA), which combines 5G radio access with a 4G core network, and Standalone (SA), which utilizes a completely new, cloud-native New Generation Core (NGC). The SA mode, often deployed in cloud environments, offers operators unprecedented flexibility but also expands the attack surface.

Central to 5G's architecture is the Service-Based Architecture (SBA), which replaces many traditional telecom protocols with RESTful APIs for inter-function communication within the core network. This shift, while simplifying development and deployment, means that many 5G core components now behave like web services, making them accessible to standard web penetration testing techniques. Additionally, 5G introduces network slicing, a feature designed to create isolated virtual networks for different services (e.g., automotive, IoT, public safety). While intended for isolation, Dudek's research reveals that misconfigurations can compromise the integrity of these slices, leading to unauthorized access and data leakage. The speaker emphasized that the actual security of a 5G network heavily depends on the operator's specific configuration and enforcement policies, rather than inherent protocol strength alone.

Key Findings

▶ Watch: 5G NSA vs SA and new core network architecture (5:00)

Sébastien Dudek's research unveiled several critical findings regarding the security posture of 5G networks, challenging the industry's optimistic view. The primary discovery is that 5G, despite its advanced design, is not inherently more secure; instead, it has shifted the battleground for attackers. Old vulnerabilities tied to legacy telecom protocols have been largely replaced by new ones emerging from the adoption of modern, web-centric architectures.

Firstly, misconfigurations are rampant across various layers of 5G networks, from the gNodeB (gNB) (the 5G base station) to the core network components. These misconfigurations can manifest as weak cipher enforcement (e.g., allowing null cipher or null integrity modes), inadequate isolation between network slices, or exposed management interfaces. Such flaws enable attackers to downgrade connections, intercept traffic, or gain unauthorized access.

Secondly, the introduction of the Service-Based Architecture (SBA) fundamentally changes the attack surface of the 5G core network. By exposing internal functions via REST APIs, the core network becomes vulnerable to standard web application penetration testing techniques, including API fuzzing, authentication bypasses, and data extraction. This means that skills traditionally applied to web applications are now directly transferable to 5G core security assessments.

Thirdly, new architectural paradigms like Open RAN and the CAMARA project significantly expand the potential attack surface. Open RAN's reliance on Kubernetes introduces containerization and orchestration-related vulnerabilities, while its extensibility through X-apps creates opportunities for supply chain attacks or backdooring. The CAMARA project, by exposing sensitive 5G core data and functionalities via external APIs to developers, introduces a new, high-value target for external attackers.

Finally, Dudek demonstrated that effective 5G security assessment requires a multi-faceted approach, combining traditional radio-level analysis with modern web API and cloud infrastructure penetration testing. His work highlights that even with sophisticated security mechanisms in place, implementation errors and architectural novelties can create exploitable weaknesses, allowing attackers to compromise user data, disrupt services, or gain persistent access to critical network infrastructure.

Technical Deep Dive

▶ Watch: The '5G security illusion' and GNB radio testing (7:40)

Sébastien Dudek provided a comprehensive technical exploration of 5G security, detailing various attack vectors and methodologies used in real-world assessments. His approach covered both external (radio/RAN) and internal (core network) perspectives, culminating in discussions on emerging architectures like Open RAN and CAMARA.

External Testing: Radio Access Network (RAN) and gNodeB (gNB)

The first line of defense, and attack, is the Radio Access Network (RAN), specifically the gNodeB (gNB), the 5G base station. Dudek explained that initial assessments involve passive fingerprinting of cells using standard 5G modems. These modems, especially those with JTAG interfaces, can provide insights into the gNB's configuration, such as whether it operates in 5G NSA (Non-Standalone) or 5G SA (Standalone) mode and the default security mechanisms it enforces. However, standard modems have limitations.

For deeper analysis, modified modems or Software-Defined Radios (SDRs) are essential. Dudek introduced aerosswift, a custom tool designed to run a 5G station or client, allowing full control over interactions with the gNB. This enables researchers to actively test the gNB's configurations. For example, using a stack like srsRAN (or OpenAirInterface), researchers can act as a User Equipment (UE), connecting to a target gNB and attempting to force specific, insecure configurations. A critical misconfiguration highlighted is the gNB supporting null cipher or null integrity modes (11:30), which should never be allowed on a legitimate network. If a gNB supports these, it indicates a severe security flaw, allowing for unencrypted or unverified communication.

Conversely, attackers can act as a malicious gNB to test user devices. This involves setting up a rogue base station to perform downgrading attacks (e.g., forcing a 5G device to connect via 4G, then 2G), which can expose devices to known vulnerabilities of older generations. This also enables dumb jamming attacks to test device resilience and behavior.

Internal Testing: 5G Core Network

Gaining a foothold inside the 5G core network is a more complex endeavor. Dudek outlined two primary paths: legitimate access (often costly and bureaucratic) or non-legitimate access, which involves scanning for exposed nodes using tools like Shodan. He cited experiences from the 5GC Hack challenges (2019, 2021), where initial access often revealed severe isolation issues.

In one instance, using a university-provided SIM card, researchers could map critical servers, including management interfaces and even an MME (Mobility Management Entity) – a 4G core component that often holds sensitive user secrets. Exploiting software vulnerabilities (SCA) in products like Nokia's components could allow dumping of critical user information. In another 5GC Hack scenario, by mapping exposed IP addresses and bypassing a UPF (User Plane Function) management console, attackers could extract IMSI (International Mobile Subscriber Identity) and K secrets (authentication keys). Possession of these secrets allows for user impersonation and SIM cloning, enabling an attacker to connect to the network as a legitimate subscriber.

The most significant shift in 5G core security, according to Dudek, is the Service-Based Architecture (SBA). This architecture exposes internal functions as REST APIs, moving away from "dark protocols" to web-centric interfaces. This paradigm shift means that traditional web penetration testing skills are now directly applicable. To facilitate this, Dudek developed 5GC API Pentest, a tool designed for automated scanning, key extraction, and API fuzzing of 5G core APIs. This tool, integrated with Burp Suite, allows pentesters to automatically discover assets, extract credentials (IMSI, DKIs), and identify security issues within the core network's API landscape.

Beyond API-level flaws, vulnerabilities can also exist in the underlying stacks. Dudek mentioned GTP (GPRS Tunnelling Protocol) encapsulation attacks, where injecting GTP layers within simple IP packets could crash the UPF, leading to service denial. He also noted potential issues with TGISO (Tunneling Gateway for Inter-Operator Services), where brute-forcing or impersonation could lead to intercepting other users' packets.

Emerging Architectures: Open RAN and CAMARA Project

The talk also delved into future attack surfaces: Open RAN and the CAMARA Project.

Open RAN aims to disaggregate the traditional RAN into flexible, vendor-agnostic components (Radio Unit, Distributed Unit, Centralized Unit, RIC). This flexibility often comes from deploying these functions as virtualized network functions (VNFs) or containerized network functions (CNFs) on platforms like Kubernetes. Dudek emphasized that if an organization is accustomed to Kubernetes penetration testing, those skills are directly transferable to Open RAN. Attackers can check Kubernetes status, list pods, execute commands within containers, and even infect them to pivot into the operator's internal networks. A unique aspect of Open RAN is the concept of X-apps, custom applications that extend RAN functionality. If an attacker gains access to the Chart Museum (where X-apps are managed), they can backdoor X-apps using various languages (Python, Rust, Go, C++), and wait for an administrator to deploy or trigger them, establishing persistent access.

The CAMARA Project is a joint initiative by GSMA Open Gateway and the Linux Foundation, designed to expose over 30 REST APIs that provide direct access to 5G core data and functions. These APIs, intended for developers, banks, and insurance companies, can expose sensitive information like device location, SIM swap status, QoS parameters, network slicing details, and subscriber identity. While currently in pre-production, Dudek warned that these APIs represent a significant new vector. Attackers could pose as developers to gain API tokens or enumerate exposed CAMARA endpoints. Once authenticated, these APIs offer direct access to internal 5G functionalities, creating unprecedented external attack opportunities.

Demo / Proof of Concept

▶ Watch: Demo: Automating 5G core API pentesting with custom tool (18:30)

Sébastien Dudek provided a live demonstration of his automated 5G core network penetration testing tool, 5GC API Pentest, showcasing how modern web security methodologies apply to the new 5G Service-Based Architecture (SBA).

The demonstration began with Dudek simulating a local 5G telco network using Docker. He then launched Burp Suite, a widely used web vulnerability scanner, integrating his custom 5GC API Pentest extension. The key configuration for the tool was the NRF (Network Repository Function) URL, which acts as a service registry for the 5G core. By pointing the tool to the simulated NRF address, Dudek initiated an "auto audit."

The tool then automatically began scanning the exposed 5G core APIs. Within moments, the output showed:

• Discovered assets: Various 5G core functions and endpoints.
• Credentials: Crucially, the tool successfully dumped IMSI (International Mobile Subscriber Identity) and K secrets (authentication keys) (20:00). Dudek highlighted that with these, an attacker could clone a subscriber's identity and impersonate them on the network.
• Security issues: The tool identified potential vulnerabilities in the API implementations.

The demonstration underscored that once an attacker has a foothold inside the core network, even basic web pentesting skills, augmented by specialized tools like 5GC API Pentest, can quickly uncover critical vulnerabilities and sensitive data. The ease with which the tool identified and extracted vital subscriber credentials reinforced Dudek's central thesis: 5G's shift to RESTful APIs makes its core network more accessible to standard attack techniques than many might assume. While not a full radio-level exploit, this PoC effectively illustrated the practical implications of SBA's security posture.

Defensive Implications

▶ Watch: CAMARA project: 5G core data exposed via REST APIs (26:30)

Sébastien Dudek's talk provides crucial insights for defenders safeguarding 5G networks. The shift in the attack surface necessitates a re-evaluation of security strategies, moving beyond traditional telecom security to embrace modern cloud and API security practices.

1. Strict Configuration Enforcement on gNBs: Operators must rigorously enforce security configurations on their gNodeBs (gNBs). This includes absolutely disallowing insecure modes like null cipher or null integrity for user plane and control plane communications. Regular audits of gNB configurations, potentially using tools like aerosswift or srsRAN in a testing environment, are essential to identify and rectify such misconfigurations.
2. Robust Network Isolation and Segmentation: The concept of 5G slices and the Service-Based Architecture (SBA) demand stringent network isolation. Defenders must ensure proper segmentation between different core network functions and between network slices. This prevents lateral movement if one component is compromised and protects sensitive data, such as MME or UPF management consoles, from unauthorized access. The talk highlighted that exposed management servers are a frequent point of entry.
3. Comprehensive API Security for 5G Core: With the 5G core transitioning to REST APIs, defenders must treat these interfaces with the same rigor applied to any web application. This means implementing robust authentication and authorization mechanisms, thorough input validation, rate limiting, and continuous monitoring for suspicious API calls. Tools like Burp Suite, integrated with specialized 5G extensions like 5GC API Pentest, should be used for regular penetration testing of these APIs.
4. Secure Kubernetes Deployments for Open RAN: As Open RAN increasingly relies on Kubernetes, organizations must apply strong container and orchestration security practices. This includes hardening Kubernetes clusters, implementing strict access controls (RBAC), regularly patching vulnerabilities, and monitoring for unusual activity within pods. The threat of backdoored X-apps also necessitates a rigorous supply chain security process for all third-party applications deployed on the RIC (RAN Intelligent Controller).
5. Vigilance Against Downgrading and Impersonation Attacks: Defenders should implement mechanisms to detect and prevent devices from being downgraded to older, less secure network generations (e.g., 4G, 2G). Furthermore, strong multi-factor authentication for subscribers and continuous monitoring for unusual login patterns can help detect and mitigate IMSI and K secret theft leading to user impersonation.
6. Secure Integration of CAMARA APIs: The emerging CAMARA APIs present a new external attack surface. Organizations exposing these APIs must ensure robust API gateway security, stringent developer onboarding processes, strong token management, and continuous monitoring of API usage. Any application or service integrating with CAMARA APIs must also be thoroughly vetted for security vulnerabilities.
7. Continuous Threat Intelligence and Research: The 5G threat landscape is evolving rapidly. Defenders must stay abreast of new research, vulnerabilities in underlying stacks (e.g., GTP), and emerging attack techniques to proactively adjust their defenses. This includes investing in internal research capabilities or collaborating with security experts specializing in 5G.

Key Takeaways

• 5G is not inherently more secure; vulnerabilities have shifted: While addressing legacy issues, 5G's new architectures like SBA, Open RAN, and CAMARA introduce entirely new attack vectors.
• The 5G core network is becoming a web application: The shift to Service-Based Architecture (SBA) and REST APIs means standard web penetration testing tools and techniques are now directly applicable to 5G core components.
• Misconfigurations in radio and core are critical: Insecure gNodeB (gNB) configurations (e.g., allowing null ciphers) and flawed isolation within the core network remain significant and exploitable weaknesses.
• Open RAN expands the attack surface via Kubernetes and X-apps: The reliance on containerization and the ability to deploy custom X-apps introduce Kubernetes-specific vulnerabilities and opportunities for backdooring.
• CAMARA APIs expose sensitive core functions externally: The CAMARA Project offers direct developer access to 5G core data and functionalities, creating a new, high-value external attack vector for sensitive information like device location and subscriber identity.
• Comprehensive security requires a multi-layered approach: Effective 5G defense demands securing the radio interface, the core network's APIs, cloud infrastructure (Kubernetes), and newly exposed external APIs, requiring diverse skill sets.

About the Speaker(s)

Sébastien Dudek is the Founder of Penthertz, a company dedicated to specialized security services. With over a decade of experience in software and hardware security, Dudek has cultivated a diverse background as a security researcher, pentester, and red teamer. His expertise is particularly focused on radio hardware security, including extensive work with Software-Defined Radios (SDRs). Penthertz offers security assessments and specialized training programs in SDRs, reflecting Dudek's commitment to advancing knowledge in this niche but critical area of cybersecurity. His work, as demonstrated in this talk, often involves demystifying complex radio and telecom technologies to expose their underlying security challenges.