SNI5GECT: A Practical Approach to Inject aNRchy into 5G NR
summary
SNI5GECT passively sniffs pre-auth 5G NR messages, tracks protocol state, and injects downlink payloads to UEs without a rogue gNB, implemented against five real 5G devices and both srsRAN and Effnet gNBs. The framework reports over 80% accuracy in uplink/downlink sniffing and 70–90% injection success up to 20 m, and demonstrates modem crashes, forced downgrade to LTE, identity extraction, and a new multi‑stage downgrade attack with a CVD assigned.
AI-written summary · about
chapters (10)
- 0:00SNI5GECT framework intro
- 1:12Attacker model defined
- 2:37Framework design overview
- 4:01UE Tractor exploit module
- 5:26Supported attack categories
- 6:09One-shot attack demos
- 7:34Multi-stage attack walkthrough
- 8:15Sniffing/injection performance
- 9:39Research applications
- 10:20Live demos
related talks
54mExposing device features on 4G & 5G networks
33mHacking 5G From Radio Security To The Apis
44mNew Vulnerabilities in 5G Networks
44mLTE And IMSI Catchers: Then And Now
08mHacking 4G and how to get arrested in 10 minutes
22mDefensive 5G
17mCellDAM: User-Space, Rootless Detection and Mitigation for 5G Data Plane
17mOh No, My RAN! Breaking Into an O-RAN 5G Indoor Base Station