Mobility Attack Surfaces and Inspection Files

#mobility #telecom #attack-surface #detection #files

Mobility Attack Surfaces and Inspection Files

Surface map

Surface	Attack vector	Specific vulnerability or weak condition	Applications / protocols	Files and evidence to inspect	Evidence	Lab coverage
Internet edge and OOB management	Stolen admin identity, exposed management service, vulnerable VPN/router, configuration modification	Shared admin access, Internet-reachable management, weak ACLs, unpatched edge device, unmanaged virtual router/container	PE/CE router, VPN, SSH, SNMP, NETCONF/RESTCONF, AAA	Running/startup config; AAA accounting; command history; VPN auth; config diff; firmware inventory; flow logs	D/A	Partial: Docker host is the management-plane analogue; no carrier router.
DNS, registrar, and eDNS	Credential theft, record manipulation, or pivot across trusted carrier DNS	Weak registrar proofing, reusable credentials, poor DNS-change approval, external SSH exposure	Authoritative DNS, registrar/EPP, carrier eDNS	Zone changes; registrar audit; EPP key lifecycle; DNSSEC state; SSH auth; `authorized_keys`; host binaries; iptables	D	Absent from active lab. Docker service discovery is only a limited analogue.
Vendor and supply chain	Signed or trusted software/update carries malicious code; compromised MSP identity pivots inward	Weak artifact provenance, mutable tags, no digest/signature verification, broad vendor access	Desktop agents, package repositories, CI/CD, container registries, MSP remote access	Lockfiles; SBOM; image digest; signature/attestation; build logs; deployment identity; unusual child processes	D/A	Present as a design risk: external Docker base images and local UERANSIM build image.
OSS/BSS and CDR stores	Web-shell entry, credential dumping, bulk querying or export	Internet-facing IIS/app flaw, weak service accounts, overbroad DB read, missing query/export detection	IIS, CRM, billing, provisioning, CDR warehouse, TM Forum APIs	Web roots; IIS logs; `w3wp.exe` children; service-account use; DB audit; export jobs; TMF API gateway logs	D/A	Production layer absent. MongoDB is a subscriber-store analogue, not a CDR warehouse.
Subscriber provisioning	Valid admin/API access changes SIM profile, authentication data, APN, or policy	No DB authentication, broad write role, static K/OP material, weak dual control	HSS/UDR/UDM, provisioning portal, MongoDB, eSIM systems	Subscriber change log; DB auth/audit; `seed_subscribers.sh`; compose DB URI; UE credential config	D/A/L	Strong lab coverage through MongoDB, WebUI, UDR/UDM/HSS, and seeded subscriber.
5G service-based architecture	Rogue NF identity, unauthorized service call, discovery poisoning, malformed request, vulnerable NF	Missing TLS/mTLS and NF authorization; reachable vulnerable implementation; weak schema/state validation	NRF, SCP, AMF, SMF, AUSF, UDM, UDR, PCF, NSSF, BSF over HTTP/2 SBI	NF registration/deregistration; NRF registry snapshot; HTTP status and peer identity; NF logs; config URIs; container restart count	A/L; CVE where named	Strong. All active NFs use cleartext `http://...:7777`; lab test confirms unauthenticated NF registration.
Open5GS NRF	Network-reachable crafted management action causes NRF to delete its own registry and abort	CVE-2025-41067, Open5GS through 2.7.6; unauthenticated reachable assertion per NVD	Open5GS NRF	Image/version; NRF logs and restart count; NF registry discontinuity; `nrf.yaml`; container events	Confirmed CVE	Exact lab image is 2.7.6. Treat as P0 patch/isolation item; do not run destructive reproduction on shared lab state.
AMF mobility/handover validation	Inconsistent validation of UE security capabilities/state during handover	Open upstream report against Open5GS 2.7.6; not a CVE and not locally reproduced	Open5GS AMF NGAP/NAS	AMF version; handover traces; AMF logs; upstream `src/amf/ngap-handler.c`; restart/session loss evidence	U	Potentially relevant to SA handover work, but current UERANSIM single-gNB topology does not reproduce it.
NAS identity and algorithms	Identity exposure or downgrade if null modes are accepted in the wrong state	Null SUCI protection; `NIA0/NEA0` or `EIA0/EEA0` permitted as fallback; static lab secrets	UE, gNB/eNB, AMF/MME, NAS	UE config; AMF/MME algorithm order; NAS PCAP; security-mode events; SUPI/SUCI appearance	A/L	Strong. These are deliberate lab settings, not necessarily product defects.
Diameter control plane	On-path observation/modification or unauthorized peer inside trusted network	`No_TLS`, weak peer admission, flat reachability	S6a/Gx and freeDiameter peers	Peer config; TLS state; CER/CEA peer identity; DWR/DWA churn; message anomalies; firewall rules	A/L	Exact lab configs use TCP/3868 with `No_TLS`.
GTP and packet plane	Rogue or compromised trusted endpoint injects/redirects traffic or abuses tunnel state	Source trust without strong cryptographic peer identity; exposed UDP/2152; excessive container privilege	GTP-C, GTP-U, SGWU/UPF, sgsnemu	Tunnel endpoint inventory; TEID/session correlation; unexpected peers; packet captures; iptables/nftables; container process list	D/A/L	Strong for GTP-U and session correlation; stays lab-only.
PFCP	Unauthorized session-control messages or compromised SMF/UPF relationship	Flat N4 reachability, weak peer allowlisting, no independent NF workload identity	SMF/UPF over UDP/8805	Association changes; peer IP; session establishment/deletion rate; SMF/UPF logs; network policy	A/L	Present inside Docker network; no dedicated adversarial test yet.
RAN OAM and configuration	Stolen operator identity or modified eNB/gNB config changes availability, neighbor, slice, or core attachment	Broad OAM access, unsigned config, shared secrets, unsafe remote management	srsRAN, UERANSIM, vendor EMS/NMS, NETCONF/SSH	gNB/eNB YAML/CONF; config hashes; OAM auth; process command line; service unit; change ticket	A/L	Configuration-integrity study only. No production EMS/NMS or real vendor RAN.
Cloud/NFV/container layer	Orchestrator or host compromise changes NF image, config, network, or secrets	Privileged/root container, Docker socket/admin access, unpinned image, absent runtime audit	Docker, Kubernetes, NFV MANO, registry	Compose manifests; image digests; `docker inspect`; daemon events; audit logs; RBAC; admission records; mounted files	A/L	Strong Docker-host exposure; Kubernetes and ETSI NFV MANO absent.
UE and baseband	Remote baseband parsing flaw or malicious configuration/profile	Product-specific memory-safety flaw; outdated modem firmware; untrusted carrier profile	Physical UE, modem/baseband, SIM/eSIM	Baseband build; security bulletin; modem crash logs; carrier config; SIM/eSIM lifecycle	Documented vulnerabilities/A	UERANSIM does not emulate a vulnerable chipset. Physical-device track required.
Lawful-intercept and mediation	Compromised authorized workflow or mediation environment exposes selected communications/metadata	Privileged access, opaque export path, weak separation or monitoring	LI mediation/delivery function, case-management interface	Case authorization, provisioning change, delivery endpoint, access/export audit, separation-of-duty record	Public impact report/A	Absent. Do not invent product filenames or infer a specific CALEA platform from the FBI wording.

Detection pivots by operating system

Linux and containers

New or replaced binaries in /usr/bin, /usr/lib, /usr/local/sbin, /sbin, and writable temporary directories.
Changes to SSH startup, authorized_keys, PAM modules, iptables/nftables, routes, forwarding, or namespace membership.
Unexpected processes with raw-socket capability, network tunneling, GTP/SIGTRAN vocabulary, or listeners on DNS-like ports.
Container creation, exec, restart, privilege, mount, and network-attachment events outside the expected lab lifecycle.
Hash and ownership drift for mounted Open5GS YAML and freeDiameter configuration.

Windows operator estate

IIS worker processes spawning command interpreters, archive utilities, credential tools, or network discovery.
Service-account and remote-management use inconsistent with the originating host or ticket.
CDR/provisioning exports that are small and subscriber-selective as well as large bulk exports.
Domain-controller database access, volume shadow copy behavior, audit-log clearing, and ESENT events associated with database copying.

Network and telecom protocols

New management-plane source addresses, virtual routing instances, tunnels, or ACL exceptions.
NRF registrations or profile changes without a workload identity and deployment event.
Diameter peer churn, unexpected Origin-Host/Realm, and unusual command/error distributions.
PFCP associations from a new SMF/UPF endpoint or sudden session deletions.
GTP-U traffic where outer endpoint, TEID, subscriber session, and expected slice/APN do not correlate.
NAS security-mode selections that fall back to null algorithms outside an explicitly approved emergency/test case.

Application-versus-vulnerability distinction

Type	Example	How to record it
Product vulnerability	Open5GS NRF CVE-2025-41067	Product, exact version range, vulnerable component, advisory URL, patch/isolation status.
Upstream report	Open5GS issue #4393	“Reported against 2.7.6; not a CVE; not reproduced locally”; link issue and track validation.
Unsafe configuration	`No_TLS` in freeDiameter	File, line/config key, trust boundary, reachability, compensating controls. Do not assign a CVE.
Deliberate lab simplification	static UE K/OP and null SUCI protection	Mark “lab-only,” prevent repository/host exposure, and never copy into production.
Campaign IOC	`/usr/bin/pingg` in LIMINAL PANDA reporting	Exact source, host role, hash if published, first/last seen, and whether locally observed.
Architectural gap	no NF workload identity on SBI	Cite TS 33.501, document network protection assumptions, then validate access control.