New Vulnerabilities in 5G Networks
summary
Demonstrates that device radio capabilities are sent before security, enabling a passive/active MNmap device fingerprinting that classifies baseband maker, model and OS from ~80–90 tested devices using USRPs and srsLTE; shows a man‑in‑the‑middle modification that persistently downgrades to 2G / reduces throughput to ~2 Mbps (observed fall from ~48 Mbps) and a narrowband IoT exploit that forces devices out of Power Saving Mode, causing NB‑IoT battery drain ~5x; issues are reported to GSMA/3GPP and a Release‑14 mitigation exists but is not widely deployed.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 2:14What is 5G
- 2:43New Use Cases
- 4:37Security
- 11:38MC Catcher
- 12:00Capabilities
- 14:51New Capabilities
- 17:04The Issue
- 17:26Mobile Network Mapping
- 18:00Maninthemiddle
- 19:02Nmap
- 21:19How is it possible
- 22:31Devices used
- 23:09Reference model
- 23:39Identifying baseband vendors
- 24:56Baseband Wiki
- 25:25Application
- 25:36Cellular vs IOT
- 28:19What now
- 29:23What are capabilities
- 30:43Maninthemiddle relay
- 32:07Maninthemiddle modification
- 34:01Testing
- 36:44Why
- 37:11Battery Drain
- 42:03Fix
- 43:21Conclusion
related talks
54mExposing device features on 4G & 5G networks
33mHacking 5G From Radio Security To The Apis
44mLTE And IMSI Catchers: Then And Now
31mSmall Cells and Smaller Devices: Using 5G to Solve IoT Device Security
44mExposing Critical Threats In Millions Of Connected Devices
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
13mSNI5GECT: A Practical Approach to Inject aNRchy into 5G NR
20mSoK: Insecurity of Cellular Basebands