Introduction
Hello! In our last lesson, we explored how an attacker could weaken the privacy of a 5G connection by exploiting the optional nature of SUCI encryption (the "null-scheme") or by de-anonymizing a subscriber's home network from the unencrypted parts of a SUCI message. Those attacks targeted the very first Non-Access Stratum (NAS) message sent from the device to the core network.
Today, we will take a step back and examine the communication that happens even earlier. Before a device can send any NAS messages to the core network, it must first establish a secure radio link with a base station (gNB). This initial connection setup, managed by the Radio Resource Control (RRC) protocol, is not secure from the outset. This creates a critical window of opportunity for an attacker.
Our goal for this lesson is to explain vulnerabilities in the 5G NR initial connection setup before security is activated. We'll investigate what information is exchanged in this unprotected phase and how an attacker with a rogue base station can manipulate this exchange to track users, degrade their service, or even crash their devices.
The Vulnerability Window: Communication Before Security
When your 5G phone connects to the network, it doesn't immediately have a secure, encrypted channel. It has to build one. The high-level process looks like this:
- Synchronization and System Information: The phone scans for a 5G signal (the Synchronization Signal Block, or SSB) and then reads the basic network parameters from the System Information Block (SIB).
- Random Access (RACH): The phone performs the Random Access procedure to get the gNB's attention and establish a basic uplink connection.
- RRC Connection Setup: The phone and the gNB exchange RRC messages to establish a formal radio connection. It is during this phase that crucial information, such as the device's capabilities, are exchanged.
- Security Activation: The network initiates the Security Mode Command procedure. Only after this procedure is successfully completed is the radio link (the "Access Stratum" or AS) encrypted and integrity-protected.
The following images show the very beginning of this process.
The critical point is that all communication up to and including the initial RRC setup happens in the clear. As the following article clearly states, this creates a vulnerability window.
Demystifying 5G Security: Understanding the Registration Protocol
The article 'Demystifying 5G Security' provides a concise breakdown of the 5G registration protocol and explicitly points out the security gap before security is activated.
Please read the sections 'The 5G Registration Protocol' and the paragraph immediately following it. Focus on the statement that NAS security (and by extension, AS security) is not activated until step 3, meaning the initial messages are transmitted without protection.
So, what exactly is being transmitted in this unprotected window that an attacker could exploit? A key piece of information is the UE Radio Capabilities.
To understand what these are and why they are sent so early, let's watch a segment from a Black Hat presentation on new 5G vulnerabilities.
New Vulnerabilities in 5G Networks
This video explains the concept of modem capabilities and highlights the critical fact that they are often exchanged before security kicks in.
Watch from 12:02 to 16:39. The speaker distinguishes between 'core network capabilities' (e.g., security algorithms, SMS support) and 'radio access capabilities' (e.g., frequency bands, speed category). Pay close attention to the sequence diagram at 15:47, which shows capabilities being sent before authentication and security.
As the video explains, the network needs to know what the device is capable of (e.g., what speeds it supports, what bands it can use) to configure the connection properly. However, because this exchange happens before integrity protection is active, a man-in-the-middle attacker can modify these messages without being detected.
Attack Type 1: Device Downgrading and DoS via Capability Manipulation
Since the UE capability messages are not integrity-protected, an attacker with a rogue base station can intercept them and alter them before relaying them to the real network. This allows for several types of "bidding-down" attacks.
The same video provides an excellent explanation of how this works.
New Vulnerabilities in 5G Networks
Now let's see how an attacker can exploit the insecure capability exchange to actively harm the user's connection.
Watch from 29:16 to 39:57. This long segment covers two specific attacks: Bidding Down Attack (29:16 - 36:16): The speaker details how a man-in-the-middle relay can modify radio capabilities, for example, changing a high-speed iPhone's category to a low-speed IoT category, drastically reducing its data speed and disabling features like VoLTE. Battery Drain Attack (37:07 - 39:57): The attacker removes the 'power saving mode' capability from an IoT device, forcing it to stay active and draining its battery much faster. Notice the key problem mentioned at 32:20: the network stores these modified capabilities, so the attack persists even after the user leaves the attacker's area.
These attacks are powerful because they are subtle. The user isn't disconnected, but their service is significantly degraded (slow speeds, no 5G voice calls, rapid battery drain), and the cause is not obvious. Since you have experience with Wireshark, you can imagine how an attacker could use a tool like Scapy on a Linux system with an SDR to intercept the RRC message from the UE, modify the capability information elements, and forward the altered message.
Attack Type 2: Exploiting Firmware Vulnerabilities
The attacks above exploit a weakness in the protocol's design—the lack of early integrity protection. A more severe class of vulnerabilities exists in the implementation of the protocol stack within the phone's modem firmware.
Modem firmware is complex software that has to parse and handle many different RRC and NAS messages. If an attacker sends a malformed or unexpected message during the initial connection setup, it can trigger a bug in the firmware, leading to a modem crash (Denial of Service) or even worse.
The "5Ghoul" disclosure is a recent and comprehensive example of such vulnerabilities.
The '5Ghoul' research page details a family of vulnerabilities in the firmware of major 5G modem vendors. These are prime examples of attacks that work before security is activated.
First, read Section 2, 'Attack Scenario Overview', to understand the attacker model. It explains that the attacker only needs a rogue gNB and that no SIM information is required because the attacks target the pre-authentication phase. Next, skim through Section 7, 'Vulnerabilities Description'. You don't need to understand every detail, but read the 'IMPACT' paragraph for a few of them to see the pattern: V5 (CVE-2023-33043): An invalid Layer 2 MAC frame causes the modem to crash and reboot. V6 (CVE-2023-33044): An unknown NAS message type causes the modem to crash. V7 (CVE-2023-33042): A malformed RRC message disables the phone's 5G capability entirely until it is manually rebooted. Notice how each description explicitly states the vulnerability is easy to trigger because it occurs during the RRC attach procedure, before authentication.
The 5Ghoul attacks demonstrate that by sending a single, carefully crafted, malicious packet during the initial connection, an attacker can effectively disable a 5G device, forcing it to reboot or downgrading it to 4G.
Attack Type 3: Authentication and Key Agreement (AKA) Bypass
Perhaps the most devastating attack in this category is one that tricks the phone into skipping the security setup process entirely. A vulnerability was discovered where a phone's modem would accept a fake, plaintext Registration Accept message from a rogue base station, effectively establishing a "secure" connection that had no security at all.
This allows the attacker to become a full man-in-the-middle, able to read and modify all subsequent traffic from the user.
Cracking the 5G Fortress: Peering Into 5G's Vulnerability Abyss
The presentation 'Cracking the 5G Fortress' demonstrates a full bypass of the 5G authentication and key agreement (AKA) procedure.
First, watch from 17:15 to 19:34. The speaker explains how the attacker's fake base station receives the initial Registration Request and immediately replies with a specially crafted plaintext Registration Accept message. This tricks the phone into thinking authentication and security setup are complete. Then, watch the demo from 21:54 to 24:18. You will see the attack in action. The phone connects to the fake base station, the authentication is bypassed, and the attacker is able to see the user's DNS queries in plaintext.
This final example shows the worst-case scenario. It's not just a service degradation or a temporary DoS; it's a complete compromise of the connection's confidentiality and integrity, all stemming from a bug in how the phone handles an unexpected message during the initial, insecure connection phase.
Conclusion
In this lesson, we delved into the earliest moments of the 5G connection process and found that it represents a significant window of vulnerability before security mechanisms are activated.
Key Takeaways:
- The Insecure Window: The initial RRC connection setup occurs before Access Stratum (AS) security (encryption and integrity protection) is enabled, allowing an attacker with a rogue base station to intercept and modify messages.
- Capability Manipulation: Attackers can alter the un-protected "UE Radio Capability" messages to perform bidding-down attacks, degrading a user's data speed, disabling features like VoLTE, or causing battery drain.
- Firmware Exploitation (DoS/Downgrade): Implementation bugs in modem firmware can be triggered by malformed RRC messages during the initial attach. This can cause the modem to crash (Denial of Service) or permanently downgrade its connectivity until a reboot.
- Authentication Bypass: In the most severe cases, firmware flaws can allow an attacker to trick the device into skipping the authentication and security setup procedures entirely, enabling a full man-in-the-middle attack on the user's traffic.
Preview of the Next Lesson:
We have now covered vulnerabilities at the radio interface, both in the early RRC setup and the subsequent NAS messaging. Our focus will now shift from the radio access network to the heart of the 5G system: the core network. In the next lesson, we will explore how 5G's Service-Based Architecture (SBA) can be targeted using traditional API and web security attack patterns. This topic will align closely with your professional background in web security, showing how familiar attack vectors find new life in the telecommunications world.