MITM attack on 5G networks

Matthai

This is quite interesting presentation on 5G security: https://i.blackhat.com/BH-USA-25/Presentations/BHUSA_2025_The5GTitanic_AltafShaik.pdf

The authors identified a loophole in the separation of user plane and control plane by cleverly crafting a GPU-T header inside a frame with GPU-T header. This means they are circumventing safeguards by making the UPF believe that the packet comes from the inside and can safely be forwarded to the control plane devices.

This leads to a nice MITM attack. You can have a rogue 5G gNodeB and use UE as a relay, and the network will provide encryption and integrity protection keys to attacker controlled gNodeB.

The authors claim:

Full interception & redirection of user traffic by a attacker-controlled gNodeB (attacker gains control over critical functions such as user data paths, DNS resolution, handovers, and service availability; all inside an legitimate and encrypted session)
Voice call (VoNR) can be intercepted, SMS delivery can be controlled
Cannot defend: existing 5G security mechanisms—such as mutual authentication, encryption, integrity protection, and downgrade prevention

And: "Stingray detectors and all UE-side security solutions will fail".

So, what does that means for GrapheneOS and baseband isolation?

Probably9857

Matthai So, what does that means for GrapheneOS and baseband isolation?

First, it has nothing to do with baseband isolation.

Second, GrapheneOS has always said that networks should not be trusted, mobile networks in particular track users by design, and voice calls and SMS should not be considered secure.

It's interesting because 5G has generally been considered more secure than older protocols, and this seems like a pretty major vulnerability. But GrapheneOS has never assumed 5G was secure at all, so not really big news in that respect.

gMan

love the title and graphic used in that presentation

there's a billion tech terms in that presentation, about none of which i understand, so...

Q: is this an exploit that Cape's network can mitigate given they physically own the core network infrastructure (not the towers, obviously) and use encryption keys as the method of authenticating??? my guess is NO, but i'm curious

Matthai

Probably9857 Well, yes, network should not be trusted, but what bothers me is that attacker can gain control DNS resolution.

Probably9857

Matthai attacker can gain control DNS resolution

It seems like this would only be the case if you're relying on the mobile network for DNS. Wouldn't a VPN that provides its own DNS prevent this?

AcclaimSublevel19

Probably9857 Yes, I can't see why this is a problem. Specifying a custom DNS server or using a VPN mitigates the risk completely and you should be doing that anyway, there is no reason to trust the ISP's DNS server not to be malicious. I'd personally be more worried about the other effects of this vulnerability.

On a side note, even if an attacker controlled DNS, since the majority of internet communication happens over HTTPS (with certificates linked to domain names), few attacks can succeed.

pixelfairy

Gos has a mitigation for this, https://grapheneos.org/features#lte-only-mode

AcclaimSublevel19 On a side note, even if an attacker controlled DNS, since the majority of internet communication happens over HTTPS (with certificates linked to domain names), few attacks can succeed.

AcclaimSublevel19 Adversaries can get a cert from another CA. There are efforts to mitigate this, including some based on DNS.

Freedomain

AcclaimSublevel19 I have a previous forum post where using SIM in 4G/5G only mode was resulting in bugs across phones and installs however I have the most extreme threat profile - if it can happen it will happen for me. Implementing VPNs in all profiles and completely disconnecting owner and other profiles seemed like the key to get it working while I know that my IMEI etc are compromised.

Matthai

I guess yes, but I am thinking, is it possible to perform some other attack, for instance something similar to buffer overflow or something?

Matthai

Well, commercial company can get gag order. Or government can employ undercover agents there? Or the government can spy on their ISP (and perform correlation attacks)...

AcclaimSublevel19

pixelfairy AcclaimSublevel19 Adversaries can get a cert from another CA. There are efforts to mitigate this, including some based on DNS.

Good point, I forgot about that. Would DNSSEC solve (well not exactly solve but at least prevent) this problem? There's no way to enforce it system-wide of course, but in theory isn't this what it's built to defend against?