Targeting 5G's SBA: API and Web Security Attacks

From Point-to-Point to a Web of Services

Previous cellular generations, like 4G, used an architecture with dedicated, point-to-point interfaces between network components. These interfaces relied on specialized telecommunication protocols (like Diameter). In contrast, the 5G Standalone (SA) core introduces a radical paradigm shift: the Service-Based Architecture (SBA).

The best way to think of the SBA is as a cloud-native, microservices-style ecosystem. Instead of rigid connections, it features a collection of Network Functions (NFs) that offer their capabilities to other NFs through standardized Application Programming Interfaces (APIs).

To understand what this shift means for security, please read the following article.

As the article highlights, this architecture relies on common web technologies. Communication between NFs like the AMF (Access and Mobility Management Function) and SMF (Session Management Function) now uses RESTful APIs, with data often formatted in JSON and transported over HTTP/2.

This image provides a detailed view of the 5G SBA and, crucially, the protocol stacks involved.

The key takeaway is that the control plane of the 5G core network now operates using the same fundamental technologies as the modern web. This brings flexibility and speed but also exposes the core network to a class of vulnerabilities that were previously confined to web applications.

The New Attack Surface: Web Threats in the Core

Because SBA uses standard web protocols, the attack surface is no longer obscure. It's now accessible to a wide pool of security researchers and attackers who already possess web and API hacking skills. This opens a "new front door" into the mobile network.

Let's begin by looking at how this new API-driven model exposes the network to external entities and creates opportunities for attackers.

While the video focuses on APIs exposed to external partners, the same principles and risks apply to the communications between the Network Functions (NFs) inside the core network itself.

The following research paper explains this internal threat very clearly.

Mapping Web Attack Patterns to the 5G Core

Your background in web security makes you perfectly equipped to understand the threats to the 5G SBA. Let's map some classic web/API attack patterns to the 5G core context, using concrete examples from security research.

1. Broken Authentication and Authorization

This is perhaps the most critical vulnerability category in any API-driven system, and the 5G core is no exception. In a web context, this might mean accessing another user's account. In the 5G core, it could mean a rogue service gaining a foothold in the network or an attacker accessing sensitive subscriber data.

• Web Attack: An attacker makes an API call to /api/users/123/profile without a valid token and the server responds. Or, an attacker with a regular user token successfully calls an admin-only endpoint like /api/admin/deleteUser.
• 5G SBA Equivalent:
  • Rogue NF Registration: An attacker connects to the core network and successfully registers a malicious NF with the Network Repository Function (NRF) because the NRF's API doesn't require authentication. This rogue NF could then be used to intercept or manipulate traffic.
  • Subscriber Data Theft: An attacker queries the Unified Data Management (UDM) or Unified Data Repository (UDR) APIs for a subscriber's data (e.g., authentication keys) and receives it, because the API endpoint lacks proper authorization checks.

The TELEscope paper provides direct evidence of these vulnerabilities in a real-world open-source 5G core implementation.

2. Denial of Service (DoS) & Lack of Rate Limiting

In web applications, failing to limit the rate of incoming requests can allow an attacker to overwhelm a server, making it unavailable to legitimate users. The same logic applies to NFs in the 5G core.

• Web Attack: An attacker sends thousands of password reset requests per second, overloading the mail server and CPU.
• 5G SBA Equivalent:
  • API Flooding: A compromised or malicious component floods an NF (like the AMF) with API requests, consuming its resources and preventing it from handling legitimate mobility or session management procedures.
  • Forced De-registration: An attacker sends an unauthenticated DELETE request to the NRF's API to de-register a critical, legitimate NF, effectively taking it offline and disrupting the entire network.

The research from the Black Hat video found that this is a common design oversight.

The TELEscope paper also lists "Forced NF De-registration" and "Malformed API Requests" as tested scenarios (S02 and S04 in Table II) that lead to DoS.

3. Injection and Information Exposure

This category covers attacks where an attacker sends malformed data to cause unintended behavior (injection) or where the system reveals too much information about its internal state (information exposure).

• Web Attack: An attacker submits a comment with <script>alert('XSS')</script> (XSS injection). Or, a failed request returns a verbose error message revealing database schema details (information exposure).
• 5G SBA Equivalent:
  • API Enumeration: An attacker sends an unauthenticated discovery request to the NRF and receives a complete map of every NF in the network, their IP addresses, and the services they offer. This is a severe information leak that perfectly sets up further attacks. (This was scenario D02 from the TELEscope paper you read).
  • Service Crash via Malformed JSON: An attacker sends a syntactically valid but semantically incorrect JSON payload to an NF's API endpoint, triggering an unhandled exception in the parser and causing the NF process to crash.
  • Data Overexposure: A legitimate API call returns far more data than necessary. For example, a request for a device's connection status also returns sensitive credentials like the SIM card's PIN and PUK codes.

This final example of data overexposure was found by the researchers in the Black Hat video.

Conclusion

Today's lesson brought us into the core of the 5G network and revealed a surprising truth: its security is deeply intertwined with the principles of modern web and API security. The shift to the Service-Based Architecture, while powerful, has effectively imported a well-known class of vulnerabilities into critical telecommunications infrastructure.

Key Takeaways:

• SBA is Web-Based: The 5G Service-Based Architecture replaces proprietary telecom protocols with a microservices-style system where Network Functions communicate via RESTful APIs over HTTP/2.
• A Familiar Attack Surface: This architectural change exposes the 5G core to traditional web security attack patterns that are well-understood by a broad audience of security professionals.
• Mapping Web Attacks to 5G:
  • Broken Authentication can lead to rogue NF registration or theft of subscriber data from the UDM.
  • Lack of Rate Limiting can enable Denial of Service attacks against critical NFs like the AMF or NRF.
  • Information Exposure can leak the entire network topology from the NRF.
  • Injection of malformed data can crash NFs, while Data Overexposure in API responses can leak sensitive user credentials.
• Your Skills Are Relevant: Your expertise in identifying and exploiting vulnerabilities in web applications and APIs is directly applicable to assessing the security of the 5G core network.

Preview of the Next Lesson:

One of the most touted features enabled by the SBA is network slicing, the ability to create multiple virtual, isolated end-to-end networks on top of a single physical infrastructure. In our next lesson, we will explain the concept of network slicing and potential cross-slice security risks. We'll investigate whether these "slices" are truly isolated and how an attacker might pivot from a low-security slice (like one for simple IoT devices) to a high-security one (like one for emergency services).