Hacking 5G From Radio Security To The Apis
summary
Live networks still accept null ciphers accepted and ship with encryption or integrity protection disabled on signaling and user plane, enabling interception and downgrade. Radio checks use commodity modems, firmware mods or SDRs like aerosswift controlled UE and gNodeB to confirm isolation failures and downgrades. Cloud-native cores expose REST surfaces: a purpose-built Burp Suite extension for 5G core API pentesting automates NF discovery, IMSI enumeration, credential extraction and fuzzing. Operator developer gateways such as CAMARA exposes 30+ REST APIs permit location, SIM swap and subscriber-surveillance flows when misconfigured.
AI-written summary · about
chapters (10)
- 0:00Introduction to 5G security
- 1:56Speaker background and experience
- 5:065G architecture and evolution
- 9:20Testing 5G radio configurations
- 13:16Penetrating 5G core networks
- 17:36Exploiting 5G service-based APIs
- 22:14Vulnerabilities in 5G stacks
- 24:43Open RAN and Kubernetes risks
- 26:52CAMARA API and new attack vectors
- 30:25Conclusion and Q&A
related talks
44mNew Vulnerabilities in 5G Networks
54mExposing device features on 4G & 5G networks
22mDefensive 5G
13mSNI5GECT: A Practical Approach to Inject aNRchy into 5G NR
26mBack to the Future. Cross-Protocol Attacks in the Era of 5G
49mAll the 4G Modules Could be Hacked
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
08mHacking 4G and how to get arrested in 10 minutes