Mobility Domain Playbook — Index
Mobility Domain Playbook — Index
BLUF. This is the published Mobility domain-playbook entry point. The key modeling unit is not “a hostname”; it is a state-changing workflow: SIM/eSIM, port-out, APN, private cellular, IoT/M2M fleet control, CPE/router provisioning, 4G/5G core policy, OSS/BSS, field/edge work orders, and support/vendor actions.
Boundaries and safety
- Defensive assessment, architecture review, OSINT synthesis, and authorized lab work only.
- No live exploitation, credential testing, support-line testing, RF interference, signaling abuse, or interaction with real subscribers/services without explicit scope.
- Treat missing scope as a constraint: convert ideas into document review, synthetic tabletop, authorized test account, or lab-only validation.
Canonical code location
All runnable mobility tooling lives in one monorepo:
| Piece | Path | Role |
|---|---|---|
| Monorepo root | ~/code/CodeCollector/mobility/ | Passive + lab + mastery + deps |
| Lab scripts | ~/code/CodeCollector/mobility/lab/scripts/ | Frida intercept launcher and other operator helpers |
| Active lab | ~/code/CodeCollector/mobility/lab/ | Open5GS + srsRAN ZMQ + UERANSIM (core-up / 4g-up / 5gsa-up / tap / tp) |
| CellScope | ~/code/CodeCollector/mobility/cellscope/ | Passive observe + FBS scorer (SOURCE=mobilitylab for lab calibration) |
| Learning vault | ~/code/CodeCollector/mobility/mastery/00-START-HERE.md | Staged Obsidian journey (open mastery/ as a vault) |
| Migration note | ~/code/CodeCollector/mobility/lab/docs/MIGRATION-FROM-MINI-LAB.md | What was absorbed from old ~/code/mobility_lab / ~/code/cellscope |
Legacy standalone trees under ~/code/mobility_lab and ~/code/cellscope are superseded archives.
Recommended reading order
Folders and files are numbered so sort order = read order. Start at 01-methodology/ and work down; use 09-evidence/–13-apt-threat-intelligence/ as reference when a case, incident, or actor comparison applies.
| # | Folder | Start with |
|---|---|---|
| 01 | 01-methodology/ | 01 Assessment methodology → 02 Research guideline (IVs) |
| 02 | 02-theory/ | 01 Threat model framing → 02 Macro infrastructure → fiber → satellite → 5G core |
| 03 | 03-phases/ | 01 Core simulation through 06 5G specific (in numeric order) |
| 04 | 04-open5gs_lab/ | Lab index → TP-00 → holistic test plan |
| 05 | 05-hardware/ | 01 Lab equipment → 02 Pixel 9 |
| 06 | 06-toolkit/ | 01 App interception toolkit |
| 07 | 07-test-plans/ | 01 Master blackbox UE-to-node plan |
| 08 | 08-nf-guides/ | AUSF → UDR (as needed) |
| 09 | 09-evidence/ | Case matrices — read when mapping real-world fraud to controls |
| 10 | 10-research/ | Background research (e.g. NAS fuzzing) |
| 11 | 11-reference/ | 01 Curated sources |
| 12 | 12-incidents/ | Time-bound notes — consult when relevant |
| 13 | 13-apt-threat-intelligence/ | APT threat-intelligence index → documented campaigns → attack surfaces → local lab mapping |
Folder map
| # | Folder | Doc type | Contents |
|---|---|---|---|
| 01 | 01-methodology/ | Procedure / gates | Assessment methodology, equipment/site IV research guideline |
| 02 | 02-theory/ | Concept | Threat model framing, macro/fiber/satellite infrastructure, 5G core overview |
| 03 | 03-phases/ | Procedure | Phase 1–6 assessment handbook (lab → UE → RF → signaling → core → 5G) |
| 04 | 04-open5gs_lab/ | Procedure | Lab build guides, threat models, test plans (TP-*) |
| 05 | 05-hardware/ | Reference | Owned lab equipment and Pixel 9 setup |
| 06 | 06-toolkit/ | Procedure | MBX app-interception runbooks (Frida + Burp) |
| 07 | 07-test-plans/ | Procedure | Cross-cutting test plans (e.g. blackbox UE-to-node) |
| 08 | 08-nf-guides/ | Reference | Per–network-function security guides (AUSF, UDR) |
| 09 | 09-evidence/ | Reference | OSINT / case evidence matrices |
| 10 | 10-research/ | Concept | Background research notes (e.g. NAS fuzzing) |
| 11 | 11-reference/ | Reference | Curated external sources |
| 12 | 12-incidents/ | Log | Time-bound incident notes and cleanup runbooks |
| 13 | 13-apt-threat-intelligence/ | Threat intelligence / lab mapping | Evidence-tiered APT campaigns, exact files and vectors, Open5GS lab exposure map, defensive validation backlog |
Runnable scripts live in ~/code/CodeCollector/mobility/lab/scripts/ — not in this vault.
Start here
| Need | Read |
|---|---|
| Mobility research — equipment/site IVs, field kit, exercised vs backlog | Research guideline (IVs) |
| Assessment methodology and phase gates | Assessment methodology |
| Overall mobility threat-modeling framing | Threat model framing |
| 5G core overview | 5G core overview |
| Macro telecom infrastructure model | Macro infrastructure |
| Fiber telecom infrastructure | Fiber infrastructure |
| Satellite telecom infrastructure | Satellite infrastructure |
| Telecom fraud evidence matrix (SS / SIM / care / Iridium) | Telecom fraud evidence |
| Scattered Spider to SIM-farm evidence (SS-01..06) | Scattered Spider evidence |
| UE / Android / SIM layer | Phase 2 — UE / Android / SIM |
| RF air interface | Phase 3 — RF air interface |
| RRC / NAS signaling | Phase 4 — RRC / NAS signaling |
| Core network / GTP | Phase 5 — Core / GTP |
| 5G-specific topics | Phase 6 — 5G specific |
| Lab baseline (Phase 1) | Phase 1 — Core simulation |
| Pixel 9 + Frida toolkit | Pixel 9 setup, App interception toolkit |
| Curated external sources | Curated sources |
| Open5GS lab index | 04-open5gs_lab/00_index |
| Holistic 4G/5G lab test plan | 04-open5gs_lab/17_test_plan_4g_5g_holistic |
| Site-to-core mobility test plan | 04-open5gs_lab/18_test_plan_mobility_site_to_core |
| APT campaigns, exact IOCs, and local attack locations | Mobility APT threat intelligence |
Mobility vector index
| Vector class | Mobility-specific meaning | Primary surfaces | Safe validation mode | Defensive control theme |
|---|---|---|---|---|
| Unauthenticated or weak-auth network join | A device, SIM/eSIM profile, CPE/router, gateway, UE, private-cellular endpoint, partner app, or admin client is allowed onto a network/control plane with weak proof of ownership, stale enrollment, default credentials, weak pairing, weak certificate lifecycle, or over-trusted bearer tokens. | IoT/M2M onboarding, CPE/fixed-wireless gateways, managed routers, private cellular SIMs, APN/private-network enrollment, partner/MSP delegated portals, UE/core lab attachment flows. | Document review; synthetic tenant; lab UE/core only; authorized test fleet if scoped. | Strong device identity, ownership proof, certificate-backed enrollment, tenant-bound tokens, mTLS, least-privilege APN/private-network entitlements, stale-device cleanup. |
| Subscriber state-change abuse | Changing who controls a number, device, SIM/eSIM, port lock, recovery path, billing owner, shipping address, or delegated admin state. | Consumer portal/app, support, retail, BPO, business mobility admin, fraud desk. | Authorized test account only; tabletop for support paths. | Step-up proof independent of affected phone, cooldowns, rollback, dual control, agent/action anomaly detection. |
| Business delegated-admin abuse | A compromised or stale business admin can change many lines, devices, APNs, users, orders, tickets, or services at once. | Business wireless portals, delegated admin consoles, reseller/MSP delegation, enterprise APIs. | Authorized business tenant review only. | RBAC lifecycle, scoped roles, bulk-change approval, high-risk action notifications, delegated admin recertification. |
| IoT/M2M fleet-control abuse | Bulk actions against SIM fleets, device inventory, rate plans, APNs, routers, gateways, fixed wireless, private cellular, or telemetry. | IoT control planes, APIs, MSP/reseller access, enterprise admins. | Authorized test fleet/device; document/API review; lab simulation. | Fleet ownership proof, API token scoping, approval for bulk changes, anomaly detection, per-device lifecycle audit. |
| API/OAuth token abuse | Over-scoped tokens or weak redirect/callback validation allow data access or state-changing automation beyond intended app scope. | Developer/API portals, API gateways, partner integrations, web/mobile apps, enterprise automation. | Authorized test app or documentation review only. | Exact redirect URIs, audience-bound tokens, least-privilege scopes, rotation, consent review, token-use baselines. |
| Support / BPO / help-desk workflow abuse | Human exception handling bypasses technical controls: KBA, supervisor override, callbacks, MFA resets, remote support, or insider-assisted account changes. | Call center, chat, IVR, retail, fraud desk, vendor/BPO agent desktops. | Tabletop, call-flow documentation review, synthetic scenarios. | KBA reduction, voice/device proofing, queue-to-record binding, dual control, session recording, social-engineering analytics. |
| Vendor / MSP trust pivot | Vendor connectivity is treated as internal, allowing compromised vendor identities/endpoints to reach portals, SaaS, edge appliances, OSS/BSS, or data stores. | VPN/ZTNA, CCaaS, CRM, MSP portals, cloud data platforms, edge/remote-access appliances. | Architecture/log review; no live pivoting. | Per-app ZTNA, vendor segmentation, posture checks, telemetry sharing, privileged-access controls, vendor-to-core anomaly detection. |
| Cloud data export / metadata exposure | Valid credentials or service accounts are used to query/export CDRs, location, billing records, support notes, recordings, transcripts, or analytics data. | Data warehouses, CRM, BI/ETL, SaaS exports, support recordings. | Policy/log review; synthetic data only. | Phishing-resistant MFA, service-account hardening, query baselines, DLP on exports, row/column controls, retention minimization. |
| 4G/5G core service-identity weakness | Network functions, service discovery, roaming/interconnect, slice lifecycle, UPF/MEC placement, or orchestration trust is too broad or poorly segmented. | 4G EPC, IMS/VoLTE/SMS, 5G SBA, NRF/SEPP, UPF/MEC, OSS/BSS, lab Open5GS/UERANSIM. | Lab-only or internal architecture review. | NF identity, mTLS/cert lifecycle, service authorization, segmentation, signaling controls, blocked-event review. |
| Legacy residue / migration drift | Sunset systems, stale support scripts, stale accounts, migrated customers, 3G/4G exceptions, or old KB assumptions weaken current controls. | 3G sunset residue, legacy M2M, old portals, support KBs, decommissioned aliases. | Documentation/CMDB/IAM reconciliation. | Decommission closure, redirect/alias cleanup, IAM reconciliation, script retirement, legacy exception review. |
| Emergency / priority workflow manipulation | Urgency-driven exceptions can affect priority/preemption, deployables, satellite backup, coverage restoration, or public-safety trust. | Public-safety admins, deployables, NDR, field ops, emergency support paths. | Tabletop/docs only; no live service impact. | Emergency override governance, verified contacts, dual approval, post-action audit, incident comms. |
| Field / CPE / edge physical-logical bridge | Work orders, remote hands, tower/colo/site access, managed CPE, OOB, or edge infrastructure become a bridge between physical operations and network control. | Towers, small cells, DAS, fixed-wireless gateways, routers, colocation, remote hands, OOB networks. | Passive/docs/internal review only; no physical testing without scope. | Work-order validation, badge/site alarm correlation, OOB logging, remote-hands callbacks, separation of duties. |
| Content / brand / support routing trust abuse | Content, PDFs, redirects, KB pages, AI support bots, or vendor-hosted shells route users or agents toward the wrong workflow or leak context. | CMS/DAM, support pages, chatbot/RAG, redirects, app links, PDFs. | Benign content-integrity review; authorized prompt-safety review if scoped. | Canonical domain matrix, redirect governance, content integrity, RAG/tool authZ, transcript controls. |
State-change questions to ask for every vector
- Who can change state? Customer, business admin, agent, BPO, MSP, API app, network function, field contractor, vendor service account?
- What proof authorizes the change? Password, MFA, phone possession, KBA, callback, certificate, token scope, work order, supervisor approval?
- What is the blast radius? One subscriber, one enterprise tenant, one IoT fleet, one APN/private network, one region, one network slice, one data warehouse?
- What telemetry proves it happened? Portal logs, API logs, agent desktop, call recording, device enrollment, OSS/BSS event, NF log, SIM/eSIM profile event, ticket/work order?
- How is it reversed? Rollback, SIM reissue, port recovery, APN restore, credential revocation, token rotation, slice/UPF rollback, customer notification?
Published notes in this folder
Update rule
When a mobility note introduces a reusable vector phrase, add it here as a defensive vector class and point to the detailed note. Keep this index scoped to navigation, blast-radius framing, validation mode, and controls — not exploitation steps.