{"id":54225,"date":"2023-10-20T00:00:00","date_gmt":"2023-10-20T00:00:00","guid":{"rendered":"urn:uuid:3f9ffb73-56de-5170-ae25-461f8aad420e"},"modified":"2023-10-20T00:00:00","modified_gmt":"2023-10-20T00:00:00","slug":"attacks-on-5g-infrastructure-from-user-devices-asn-1-vulnerabilities-in-5g-cores","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/attacks-on-5g-infrastructure-from-user-devices-asn-1-vulnerabilities-in-5g-cores\/","title":{"rendered":"Attacks on 5G Infrastructure From User Devices: ASN.1 Vulnerabilities in 5G Cores"},"content":{"rendered":"

<\/p>\n

<\/div>\n

NGAP is the protocol for Control Plane (signaling), running on SCTP port 38412. GTP-U is the encapsulating protocol for user data, running on UDP port 2152.  From the UE, the control plane signaling is handled by the baseband modem.<\/p>\n

Users do not have access to baseband modem. The user-plane traffic (data sent from the user such as browsing and streaming) is sent to the User Plane Function (UPF) over a GTP-U tunnel. In 5G Control Plane User Plane Separation (CUPS) architecture, UPF and AMF are functionally separated: they are separate network functions with their own IP addresses. Normal users do not have the authorization to access the network infrastructure, so user data going to the Control Plane is a security risk.<\/p>\n

We were able to establish an SCTP connection with AMF from the UE application layer. Through this SCTP connection, the anomalous NGAP payload was sent. From the 5GC side, the packet will appear as NGAP-in-GTPU. This NGAP message was delivered to the AMF and resulted in it crashing.<\/p>\n

The most concerning weakness here is the routing of the User Plane messages. This allowed the delivery of anomalous signaling messages to the AMF. As a prerequisite of an attack, the attacker must know the AMF IP address. We were able to accomplish this using SCTP scanning through the User Plane.<\/p>\n

Note that this test was done with a free5gc all-in-one virtual machine and not a containerized version of it. These will have different routing setups.<\/p>\n

In our test case, the attack vector employed was user traffic from User Equipment, taking advantage of the poor separation of the control plane and the user plane.<\/p>\n

There are two problems here:<\/p>\n