A Technical Dive into 5G Hacking

5G Standalone (5G SA) is not an upgrade — it is a full rebuild of the mobile network into a cloud-native, HTTP/2, Kubernetes-based distributed system. This collapses radio, transport, and core into one attack surface that no single discipline can cover alone.

For red teamers, this changes everything. The same SSRF that pops a web app now chains into NRF poisoning and lawful intercept abuse. The same Kubernetes LFI now yields cluster-admin over an entire 5G core. The same JTAG/UART toolkit that owns IoT firmware now extracts IPsec PSKs from BBUs and tunnels into the operator's transport network.

This article is a field manual — covering RAN hardware exploitation, SBI web vulnerability chains, 5G-AKA crypto weaknesses, HSM side channels, Kubernetes CNF compromise, and full kill-chain scenarios. It extends the research of Arthur Naullet and Maxime Gautier (Orange Cyberdefense), and every technique maps to 3GPP specs and open-source tooling.

::Threat Actors Targeting Telecoms

This is not theoretical. Key APT campaigns targeting telecoms include:

• ▹Salt Typhoon (PRC-linked) breached U.S. broadband providers and accessed lawful intercept infrastructure in 2023-2024.
• ▹APT41 abuses telecom trust to deliver SMS lures and track dissidents.
• ▹APT43 targets Korean/SE Asian carriers for subscriber metadata.

Their TTPs are consistent: compromise edge appliances, steal CNF service account credentials, exploit SBI APIs lacking mTLS, and abuse roaming interfaces with poor certificate hygiene.

A single successful breach means: SUPI/IMSI disclosure of millions of subscribers, forged auth vectors enabling SIM cloning, unauthorized wiretaps, mass SMS interception for 2FA bypass, and DoS via HSM starvation.

::5G Attack Surface Map

Traditional penetration testing methods fail on 5G networks. Unlike typical IT environments, a single cell tower connects several completely different attack surfaces that live behind hidden internal networks:

• ▹Cloud Web APIs (SBI): 5G core microservices communicating via RESTful HTTP/2 APIs on virtual IPs.
• ▹Equipment Management (NETCONF/YANG, MML, OSS): Operator management consoles used to configure base station hardware.
• ▹Radio & Transport Protocols (SCTP, GTP-U, F1, eCPRI): Specialized telecom protocols carrying user data and signaling between cell towers and the core.

Because these services live across separate VLANs and radio interfaces, effective red teaming must start with architecture diagrams rather than simple port scans.

::2.1 Reconnaissance

• ▹

  Passive DNS & Certificate Logs:

  • ▹5G network functions use standard 3GPP naming formats (e.g., nrf.5gc.mnc<MNC>.mcc<MCC>.3gppnetwork.org).
  • ▹Look for internal server names leaking onto public DNS.
  • ▹Sweep Certificate Transparency (CT) logs for domains like *.5gc.<operator>.net. Pre-production cores are frequently exposed by accident.
• ▹

  Shodan & Censys Scanning:

  • ▹Search for exposed 5G dashboards or APIs. Because staging environments often lack VPN protection, they frequently show up on the internet.
  • ▹Useful queries: http.html:"3gpp-Sbi" (for SBI headers), ssl.cert.subject.CN:"nrf" (for NRF certificates), or port:38412 (for N2 SCTP traffic).
• ▹

  Legacy Interconnects & Roaming:

  • ▹Modern 5G networks still connect to older 3G/4G networks (SS7/Diameter) using gateways like IP-SM-GW, SMSF, and IWF.
  • ▹The modern 5G roaming gateway (the SEPP on the N32 interface) is a prime target, as many are misconfigured to accept self-signed certificates.

::2.2 Asset Enumeration

• ▹gNodeB OAM: HTTP/HTTPS with default creds (admin/admin, root/root), SSH on non-standard ports, vendor MML consoles
• ▹MML ports: Ericsson MML on TCP 5000/5001, Huawei LMT on 22/23, Nokia C-Lesh on proprietary ports — all frequently vulnerable to command injection
• ▹NETCONF/YANG (TCP 830): Often vendor-default creds, accepts <edit-config> pushing rogue configs to gNBs
• ▹SFTP jump hosts: Store firmware in cleartext, accept SSH keys from compromised field-engineer laptops — poison one firmware image, backdoor 10,000 BBUs

::2.3 Hybrid Testing Matrix

The RAN is where physical meets digital. Compromise here bypasses every firewall and WAF in the core.

::3.1 Rogue gNodeB Attack

A rogue gNodeB uses SDR to impersonate a legitimate base station, forcing UEs to attach and reveal identifiers.

Equipment: USRP B210/X310 or bladeRF 2.0 micro xA4, GPSDO, RF shielded enclosure.

Software:

Attack steps:

1. ▹Scan the Airwaves (Recon): Use radio tools (like Kalibrate-RTL) to scan local frequency bands. Record the target network's identifying details (like the PLMN ID and TAC).
2. ▹Impersonate the Tower: Configure your rogue base station (gNB) with the exact same network IDs, but broadcast a much stronger signal than the real tower. Mobile devices (UEs) will automatically connect to the strongest signal.
3. ▹Steal Subscriber Identities: Force devices to use the "NULL scheme" for encryption. This often works on roaming devices or MVNO users, causing them to transmit their permanent identity (SUPI) in pure plaintext.
4. ▹Downgrade Encryption: Attempt to force the connection into NEA0 (no encryption) or NEA1 (weak SNOW 3G encryption). If the device accepts NEA0, you can read all text messages and network traffic in plain text.
5. ▹Harvest Master Keys: Log the authentication challenges (RAND/AUTN) sent back and forth. If the target's SIM card uses older, weaker algorithms, these challenges can be cracked offline to recover the master encryption key K.

Detection evasion: To avoid triggering alarms, keep the attack short (under 30 seconds per device) and constantly rotate your physical cell ID (PCI). Most modern smartphones will silently connect to your fake tower without warning the user.

::3.2 Hardware Hacking (Cell Tower Equipment)

Cell tower baseband units (BBU) are a critical physical entry point. Once physical access to the cabinet is obtained, red teams can compromise the hardware directly:

1. ▹Serial Console Access: Locate debug pins on the main circuit board (UART). Connect a hardware debugger (like a Bus Pirate) to view the boot logs and memory addresses.
2. ▹Dump the Firmware: Use a hardware flasher to physically read the memory chip (SPI flash) and save the firmware to a file (flashrom -r bbu_flash.bin).
3. ▹Extract the Filesystem: Run binwalk on the extracted firmware to unpack the Linux filesystem (often SquashFS).
4. ▹Steal VPN Keys: Search the extracted files for hidden IPsec keys (often found in /etc/ipsec.secrets). Using these stolen keys, you can connect your own laptop directly to the carrier's internal transport network — bypassing all firewalls.

::3.3 Fronthaul Network Attacks

The "fronthaul" network connects the antennas to the processing units. Surprisingly, this traffic often runs over plain, unencrypted Ethernet.

• ▹Eavesdropping on Signaling (F1): By mirroring the fronthaul network traffic, you can decode control messages in Wireshark. Since it's unencrypted, you can see subscriber connections in plain text, and even inject "disconnect" commands to silently drop users off the network.
• ▹Radio Jamming via Ethernet (eCPRI): Instead of using a bulky radio jammer, you can inject malicious data packets directly into the Ethernet cable. This creates targeted interference that traditional radio monitoring tools cannot detect.

::3.4 RAN Tools

5G SBA replaced SS7/Diameter with HTTP/2 REST APIs. Every SSRF, IDOR, and auth bypass that ever hit a web app is now a candidate for taking down a national carrier.

::4.1 The HTTP/2 Attack Surface

SBI custom headers (TS 29.500) that are routinely mishandled:

• ▹3gpp-Sbi-Target-apiRoot — tells SCP where to forward → arbitrary SSRF
• ▹3gpp-Sbi-Callback — async event callback URL → blind SSRF to internal services
• ▹3gpp-Sbi-Discovery-* — NF discovery via NRF → internal topology leak
• ▹3gpp-Sbi-Routing-Binding — SCP routing → traffic redirection to attacker NF

Example — Callback SSRF:

If the PCF follows that callback, you get cloud credentials → Keystone access → Glance image upload → backdoored VM. One header, full kill chain.

::4.2 API Chaining: Jumping from Edge to Core

The Network Exposure Function (NEF) is designed to be the gateway for external applications, making it a prime initial target for attackers trying to break into the core:

1. ▹Find an Edge Vulnerability (SSRF): The NEF often accepts external callback URLs. By providing an internal IP instead of a real external URL, the attacker forces the NEF to make unauthorized internal requests on their behalf.
2. ▹Map the Internal Network: The attacker sends a request to the central network registry (NRF) to list all active core microservices and their hidden internal IP addresses.
3. ▹Target Session Management: The attacker routes a request through the NEF into the Session Management Function (SMF). These internal endpoints often lack authentication because developers wrongly assume they are shielded from the outside.
4. ▹Dump Subscriber Data: The attacker extracts sensitive user data, including active session IDs, network slices, and real-time physical locations (ueLocation).

::4.3 Auth Bypass: OAuth2/mTLS Failures

The gap between spec and deployment is enormous:

• ▹Self-signed cert acceptance: Many Open5GS/free5GC deployments ship with verify: false
• ▹OAuth2 scope escalation: NFs check iss/exp but not scope — a NEF JWT works against UDM
• ▹JWT alg=none: Still present in some Java-based vendor NFs using older nimbus-jose-jwt
• ▹N32/SEPP misconfiguration: SEPPs accepting self-signed peer certs → pivot from roaming partner into home network

::4.4 NF Discovery Poisoning

Register a rogue NF via Nnrf_NFRegister (TS 29.510). If cert validation is weak, your rogue SMF gets returned to every consumer querying for SMF instances. You intercept all subsequent PDU session traffic.

::4.5 The Ghost SMF Attack

This attack creates a hidden "man-in-the-middle" inside the 5G core network.

1. ▹Break In: The attacker uses the edge vulnerability (SSRF) mentioned earlier to reach the central registry (NRF).
2. ▹Steal Credentials: The attacker finds exposed security certificates (often left unsecured in Kubernetes Helm configurations).
3. ▹Register a Fake Service: Using the stolen certificates, the attacker tells the central registry, "I am a legitimate Session Management Function (SMF)."
4. ▹Hijack Traffic: The core network believes the fake service is real and starts routing user session traffic directly to the attacker.
5. ▹Listen and Forward: The attacker secretly reads the traffic, then forwards it to the real SMF. The victim's phone continues to work normally, completely unaware of the intercept.
6. ▹Profit: The attacker can now inject fake billing records, resulting in direct financial fraud.

Staying Hidden: The attacker configures their fake service to only be checked once every 24 hours (heartBeatTimer). Since most operators don't actively audit their internal registry logs, the fake service remains undetected indefinitely.

5G crypto is spec'd in TS 33.501. The primitives are sound — the implementations are not.

::5.1 5G-AKA Weaknesses

While the 5G-AKA authentication protocol introduced new protections to stop fake cell towers, real-world software and hardware implementations still suffer from critical weaknesses:

• ▹Cheating the Math (Milenage Weakness): Some phone chips intentionally take shortcuts in the complex authentication math to save battery and processing power. Attackers can send a deliberately corrupted signal—and because the chip skips the full math check, it connects to the fake tower anyway.
• ▹Predictable Random Numbers (RAND): Security relies on generating truly random numbers. If a carrier's security hardware (HSM) uses a weak or predictable random number generator, an attacker who observes just one authentication sequence can mathematically predict all future secret keys.
• ▹The "Fast-Reauth" Loophole: To speed up connections, 5G allows a "fast re-authentication" token. If an attacker steals just one of these tokens using a fake tower, they can often reuse it indefinitely to hijack connections because many network operators forget to configure them to expire.

::5.2 SUCI De-anonymization

SUCI protects the SUPI via ECIES encryption. But TS 33.501 mandates a NULL-scheme fallback — and many UEs ship without operator public keys, defaulting to NULL. The SUPI goes in cleartext.

For ECIES deployments: recover the home network public key from a SIM, then check for weak entropy in key generation or key reuse. One compromise of the private key unmasks every subscriber in real time.

::5.3 Hardware Security Module (HSM) Attacks

The physical security vaults (HSMs) used by telecom networks are supposed to be impenetrable. But in reality, they often fail in surprising ways:

• ▹Denial of Service (Session Exhaustion): Attackers can spam the HSM with thousands of fake connection requests. Many older systems hit a hard limit (e.g., 1024 connections) and completely lock up. This stops the network from generating new keys for genuine users, causing a massive network-wide outage.
• ▹Timing Attacks: If an HSM takes a split-second longer to calculate one mathematical operation versus another, attackers can measure that delay to slowly guess the master keys. This is especially effective against cheaper, software-based HSMs.
• ▹Cloud Configuration Leaks: Operators are increasingly moving HSMs to the cloud, but misconfigured permissions can allow attackers to simply ask the vault to export its secrets. In some real-world telecom setups, supposed "secure vaults" running in Docker containers were caught storing master keys in plain text.

::5.4 The "Copy-Paste" Password Problem

A chronic flaw in modern 5G rollouts is deployment laziness. In one real-world case, a vendor shipped 10,000 cell tower computers (BBUs) with the exact same master password hardcoded into their setup files. If a hacker breaks into just one isolated rural cell tower, they instantly have the passwords to hack the other 9,999.

5G cores run as CNFs on Kubernetes. Compromise one pod with cluster-admin → own the entire 5G core.

::6.1 5G Core NFV Architecture

::6.2 Hacking the 5G Software (The CNF)

Modern 5G core apps are just software running in containers. Here is how a standard breach unfolds:

1. ▹Find a Web Flaw: Attackers look for simple web vulnerabilities (like a directory traversal) in internal diagnostic dashboards that the vendor left exposed.
2. ▹Steal Kubernetes Passwords: They use the web flaw to read internal configuration files, stealing the application's Kubernetes access token.
3. ▹Exploit Over-Permissions: To make installation easy, vendors often give these apps cluster-admin (god-mode) rights by default. The attacker uses the stolen token to dump all network secrets, including database passwords and HSM PINs.
4. ▹Total Takeover: The attacker uses their god-mode access to push a malicious update to all servers in the cluster, gaining permanent root access to the entire 5G core.

::6.3 Bypassing Internal Security (Service Mesh)

Even if the network uses internal encryption (like a Service Mesh) to hide traffic between 5G apps, attackers can bypass it:

• ▹Misconfigurations: Many networks leave encryption in "permissive mode" during testing and forget to enforce it in production, allowing attackers to send unencrypted commands directly to the core.
• ▹Traffic Interception: If an attacker gains admin rights, they can inject malicious routing rules to silently copy all internal 5G traffic to their own rogue servers.

::6.4 Escaping the Network Sandbox (CNI)

Telecom apps often require direct access to physical network cards for high-speed routing (using technologies like SR-IOV or Multus). If an attacker compromises one of these apps (like the UPF data router), they can reconfigure the network card to sniff all traffic passing through the datacenter, completely bypassing standard firewall rules.

::6.5 Cloud Platform (IaaS) Exploitation

If the 5G core runs on a private cloud (like OpenStack), the attack doesn't stop at the container level:

• ▹Metadata Leaks: A compromised virtual machine can often query the cloud's internal metadata service to steal cloud API keys, allowing the attacker to delete, modify, or clone other servers.
• ▹Virtualization Escapes: Exploiting unpatched system drivers allows attackers to break out of their virtual machine and completely take over the underlying physical server.

::6.6 Supply Chain Poisoning

Instead of hacking the live network, attackers can hack the software update process:

1. ▹Break into the vendor's or operator's software registry.
2. ▹Inject a backdoor into the 5G software package (the Helm chart).
3. ▹Wait for the automated CI/CD pipeline to push the poisoned update directly into production.

::7.1 Operation "Shadow SIM" (Mass Data Theft)

If an attacker breaches the core network, they can extract the master keys for millions of subscribers and clone their SIMs:

1. ▹

   Initial Breach: The attacker gains internal access (e.g., through a web flaw or a stolen Kubernetes token).

2. ▹

   Scraping the Database: They target the main subscriber database (UDM). Because internal systems rarely limit the speed of requests, they can write a simple Python script to scrape millions of user profiles in minutes:

   ~ / python

   # Example: Scraping the 5G subscriber database using a stolen internal token

   import concurrent.futures, requests, urllib3

   urllib3.disable_warnings()

    

   def dump(supi):

   r = requests.get(f"https://udm.5gc.svc.local/nudm-sdm/v2/{supi}",

   headers={"Authorization":f"Bearer {JWT}"}, verify=False)

   return r.json() if r.ok else None

    

   with concurrent.futures.ThreadPoolExecutor(max_workers=50) as ex:

   # Iterate through 10 million possible subscriber IDs

   for r in ex.map(dump, [f"imsi-00101000{i:07d}" for i in range(10000000)]):

   if r: log(r)

   Show all 13 lines
3. ▹

   Cloning SIMs: Using the stolen master keys, the attacker writes them to blank, programmable SIM cards. They can now receive the victim's SMS messages, effortlessly bypassing banking two-factor authentication (2FA).

4. ▹

   Real-time Tracking: They subscribe to the network's internal location-tracking API, silently monitoring the physical location of any user in real-time.

::7.2 The Silent Interceptor (Hacking Lawful Wiretaps)

5G includes built-in systems for Lawful Interception (wiretaps used by law enforcement). State-sponsored hackers actively target these systems because they offer perfect, silent surveillance without having to hack the user's actual phone.

How attackers abuse wiretaps:

1. ▹Hacking the Admin Panel: Attackers log into the wiretap provisioning system (often using default passwords) and configure a wiretap on a target. The network silently forwards a copy of all the target's calls and data to the attacker.
2. ▹Direct Traffic Tampering: If the attacker has admin rights to the Kubernetes cluster, they can manually edit the network's routing rules to send a copy of a user's internet traffic directly to an offshore rogue server.
3. ▹Hijacking Police Data: The attacker registers a fake receiving server with the wiretap system. When actual law enforcement sets up a wiretap, the network accidentally sends the intercepted data to the hacker instead of the police.

Covering Tracks: Operators often store wiretap logs in basic, unencrypted databases. If the attacker has database credentials, they can simply hit DELETE to erase all evidence of their surveillance.

::7.3 Full Kill Chain: Baseband to Cloud

The eleven-day attack timeline shown above is conservative. With full access to source code and documentation (white-box testing), this entire attack chain has been executed by security teams in under 72 hours.

::7.4 Build Your Own 5G Hacking Lab

You can spin up a fully functional 5G network on your own machine to practice these techniques:

::8.1 Open Source 5G Lab Tools

These are the tools you need to build a working 5G hacking lab:

::8.2 Cloud-Native Security Tools

::8.3 Essential Reading

3GPP Specs (free to read): TS 23.501 (Architecture), TS 23.502 (Procedures), TS 33.501 (Security), TS 29.500 (Service-Based Architecture), TS 29.510 (NRF), TS 29.503 (UDM), TS 33.126/33.127 (Lawful Intercept)

Conferences to follow: Black Hat USA/EU, DEF CON Telecom Village, Hexacon, USENIX Security, NDSS

Security Guidance: GSMA FS.07/FS.15/FS.31, NIST SP 800-207 (Zero Trust), NIST SP 1800-33 (5G Cybersecurity), ENISA 5G Threat Landscape

::9.1 How Attackers Stay Hidden (Red Team Evasion)

Understanding attacker evasion techniques helps defenders know what to watch for:

• ▹Silencing Logs: Attackers can change the logging verbosity of a 5G app to ERROR before performing sensitive operations, then change it back after. Only errors are logged — normal reconnaissance activity is invisible.
• ▹Exploiting SIEM Lag: Most security monitoring systems take 30-60 seconds to ingest and process logs. If an attacker completes their operation within that window, alerts fire after the damage is done.
• ▹Blending In: Instead of blasting thousands of requests at once (which is easy to detect), smart attackers spread their operations across hours or days, mimicking normal network traffic patterns.
• ▹Reusing Debug Pods: Almost every production 5G core has at least one vendor debug container running with elevated privileges. Attackers reuse these existing pods instead of deploying their own, leaving no deployment logs.
• ▹DNS Tunneling: Even in heavily locked-down Kubernetes clusters, DNS traffic is almost always allowed. Attackers tunnel stolen data out through DNS queries, which most firewalls pass without inspection.

For thirty years, telecom security relied on proprietary protocols and closed hardware. That era is over. 5G Standalone rebuilt the mobile network on HTTP/2, REST APIs, OAuth2, mutual TLS, Kubernetes, Helm, and Linux containers — inheriting every vulnerability those technologies have ever produced.

A web pentester who learns the 5G architecture spec (TS 23.501) can find core network vulnerabilities within a week. A Kubernetes red teamer who understands the NRF can compromise a national carrier within a month. The cross-disciplinary attacker wins.

::References

>3GPP Specifications

1. ▹3GPP TS 23.501 — System Architecture for the 5G System (5GS), v18.6.0, 2024. 3gpp.org
2. ▹3GPP TS 23.502 — Procedures for the 5G System (5GS), v18.6.0, 2024. 3gpp.org
3. ▹3GPP TS 33.501 — Security Architecture and Procedures for 5G System, v18.5.0, 2024. 3gpp.org
4. ▹3GPP TS 29.500 — 5G System; Technical Realization of Service Based Architecture, v18.5.0, 2024. 3gpp.org
5. ▹3GPP TS 29.510 — Network Function Repository Services, v18.6.0, 2024. 3gpp.org
6. ▹3GPP TS 29.503 — Unified Data Management Services, v18.5.0, 2024. 3gpp.org
7. ▹3GPP TS 29.502 — Session Management Services, v18.6.0, 2024. 3gpp.org
8. ▹3GPP TS 33.310 — Network Domain Security (NDS); Authentication Framework (AF), v17.3.0, 2023. 3gpp.org
9. ▹3GPP TS 33.126 — Lawful Interception (LI); LI Requirements, v18.2.0, 2024. 3gpp.org
10. ▹3GPP TS 33.127 — Lawful Interception (LI); LI Architecture and Functions, v18.3.0, 2024. 3gpp.org
11. ▹3GPP TS 29.910 — Domain Name System Procedures; Stage 3, v17.0.0, 2022. 3gpp.org
12. ▹3GPP TS 28.541 — Management and Orchestration; 5G Network Resource Model (NRM), v18.5.0, 2024. 3gpp.org
13. ▹3GPP TR 33.809 — Study on 5G Security Enhancements, v18.0.0, 2023. 3gpp.org
14. ▹3GPP TS 35.206 — Specification of the Milenage Algorithm Set, v17.0.0, 2022. 3gpp.org

>Conference Talks and Presentations

15. ▹Naullet, A. & Gautier, M. — Unmasking the 5G Core: A Practical Red Team Approach, Hexacon 2023. Orange Cyberdefense Research
16. ▹Naullet, A. & Gautier, M. — 5G Core Network Hacking, Black Hat EU 2023. blackhat.com
17. ▹Beer, I. & Groß, S. — A Deep Dive into an NSO Zero-Click iMessage Exploit, Project Zero, 2021. googleprojectzero.blogspot.com
18. ▹Weinmann, R.-P. — Baseband Attacks: Remote Exploitation of Memory Corruption in Cellular Protocol Stacks, USENIX WOOT 2012. usenix.org
19. ▹Golde, N., Redon, K., & Seifert, J.-P. — Let Me Answer That for You: Exploiting Broadcast Information in Cellular Networks, USENIX Security 2013. usenix.org
20. ▹SRLabs — Rooting SIM Cards, Black Hat USA 2013. srlabs.de
21. ▹Michau, B. & Muzat, C. — How to not Break LTE Crypto, SSTIC 2016. sstic.org
22. ▹Positive Technologies — 5G Standalone Core Security Research, 2021. ptsecurity.com
23. ▹ERNW — 5G Security Evaluation, Troopers Conference 2020. ernw.de
24. ▹Altaf Shaik — Practical Attacks Against 5G Networks, DEF CON 31 Telecom Village, 2023. defcon.org
25. ▹Karsten Nohl — Mobile Self-Defense, 31C3, 2014. media.ccc.de
26. ▹Yuwei Zheng & Haoqi Shan — Ghost Telephonist Impersonates You, DEF CON 25, 2017. defcon.org

>Industry Reports and Threat Intelligence

27. ▹ENISA — Threat Landscape for 5G Networks, 2024. enisa.europa.eu
28. ▹ENISA — 5G Supplement: Security of Open RAN, 2024. enisa.europa.eu
29. ▹CISA — Enhanced Visibility and Hardening Guidance for Communications Infrastructure, 2024. cisa.gov
30. ▹Mandiant — APT41: A Dual Espionage and Cyber Crime Operation, 2022. mandiant.com
31. ▹Recorded Future — Chinese State-Sponsored Cyber Espionage Targeting Telecoms, Insikt Group, 2024. recordedfuture.com
32. ▹CrowdStrike — 2024 Global Threat Report: Telecom Sector Analysis, 2024. crowdstrike.com
33. ▹Positive Technologies — 5G SA Core Network Security Assessment, 2021. ptsecurity.com
34. ▹Positive Technologies — Vulnerabilities in 5G Networks, 2020. ptsecurity.com
35. ▹AdaptiveMobile Security — Simjacker Technical Report, 2019. simjacker.com
36. ▹SRLabs — SIM Toolkit Security, 2019. srlabs.de
37. ▹Nokia — Threat Intelligence Report: Telecoms, 2024. nokia.com
38. ▹Ericsson — Security in 5G RAN and Core Deployments, 2023. ericsson.com
39. ▹Orange Cyberdefense — Security Navigator 2024, 2024. orangecyberdefense.com
40. ▹EFF — Gotta Catch 'Em All: Understanding How IMSI-Catchers Exploit Cell Networks, 2019. eff.org

>CVEs and Security Advisories

41. ▹CVE-2021-45462 — Open5GS UPF GTP-U denial of service via crafted packet (v2.4.0). nvd.nist.gov
42. ▹CVE-2023-24033 — Samsung Exynos baseband Internet-to-Baseband RCE, discovered by Google Project Zero. nvd.nist.gov
43. ▹CVE-2019-14378 — QEMU SLiRP networking heap buffer overflow during IP packet reassembly (potential VM escape). nvd.nist.gov
44. ▹CVE-2021-3748 — QEMU virtio-net use-after-free (potential guest-to-host escape). nvd.nist.gov
45. ▹CVE-2023-20198 — Cisco IOS XE web UI privilege escalation (used against telecom edge routers). nvd.nist.gov
46. ▹CVE-2022-22947 — Spring Cloud Gateway RCE via SpEL injection (impacts Java-based NFs). nvd.nist.gov
47. ▹CVE-2023-44487 — HTTP/2 Rapid Reset DoS (affects all HTTP/2 SBI endpoints). nvd.nist.gov

>Regulatory and Standards Guidance

48. ▹GSMA FS.07 — SIM Security Guidelines, 2023. gsma.com
49. ▹GSMA FS.15 — Network Equipment Security Assurance Scheme, 2023. gsma.com
50. ▹GSMA FS.31 — Baseline Security Controls for 5G, 2023. gsma.com
51. ▹NIST SP 800-207 — Zero Trust Architecture, 2020. nist.gov
52. ▹NIST SP 1800-33 — 5G Cybersecurity, 2023. nist.gov
53. ▹EU Toolbox — EU Coordinated Risk Assessment of 5G Networks Security, 2020. ec.europa.eu
54. ▹O-RAN Alliance — O-RAN Security Requirements and Threat Model, WG11, 2023. o-ran.org

>Books

55. ▹Liyanage, M., Ahmad, I., Abro, A.B., Gurtov, A., & Ylianttila, M. — A Comprehensive Guide to 5G Security, Wiley, 2018. ISBN: 978-1119293040
56. ▹Penttinen, J. — 5G Explained: Security and Deployment of Advanced Mobile Communications, Wiley, 2019. ISBN: 978-1119275688
57. ▹Schneider, P. & Horn, G. — Towards 5G Security, IEEE TrustCom 2015. doi:10.1109/Trustcom.2015.499
58. ▹Rao, M. & Prasad, N. — Telecom Infrastructure Security for Operators, CRC Press, 2022. ISBN: 978-1032047812