Mobility APT Defensive Validation Backlog

#mobility #apt #validation #detection #backlog

Mobility APT Defensive Validation Backlog

Acceptance rule

Every test must produce: timestamp, topology/profile, source and destination identity, exact version/image digest, config hash, expected result, observed result, cleanup result, and evidence path. Do not call a control effective from a packet capture alone; correlate host, container, NF, and database state.

P0 — close first

ID	Defensive question	Safe procedure	Pass condition	Evidence
APT-LAB-001	Is the running Open5GS image outside the CVE-2025-41067 affected range?	Record digest/version, stage a supported fixed release, rerun existing non-destructive attach and SBI robustness tests. Do not reproduce destructive registry deletion on shared state.	Fixed version runs baseline SA/4G flows; rollback image is known; NRF restart/registry alerts remain enabled.	Image inspect, release/advisory, TP report, NRF logs, registry snapshot.
APT-LAB-002	Can only an authorized workload register or call an NF service?	Preserve current insecure profile; add a hardened mTLS/OAuth or protected-mesh profile and run the existing unauthenticated registration test against both.	Insecure control reproduces documented gap; hardened profile rejects unauthenticated source and accepts provisioned identity.	Test JSON, cert/workload identity, HTTP status, NRF log, network policy.
APT-LAB-003	Can an arbitrary attached container reach or modify MongoDB?	Use a benign ephemeral client with no credentials to perform a read-only connection check, then enable auth/segmentation and repeat. Use only synthetic data.	Hardened profile refuses unauthenticated access; only named provisioning identity can write.	Connection result, Mongo auth/audit, network policy, subscriber hash/diff.
APT-LAB-004	Can we prove image and config provenance before startup?	Capture digests/SBOM and hashes for compose-mounted files; compare at preflight and fail on drift.	Startup fails closed for unapproved digest/hash and reports exact changed artifact.	Manifest, signature/attestation, preflight output, Git diff.
APT-LAB-005	Would a host or container privilege change be detected?	Snapshot expected capabilities, mounts, users, namespaces, routes, and firewall; compare after normal lab lifecycle.	Unexpected privileged/root/capability/network change generates a finding with container identity.	`docker inspect` baseline/diff, daemon events, route/firewall diff.

P1 — telecom trust boundaries

ID	Defensive question	Safe procedure	Pass condition	Evidence
APT-LAB-010	Does ordinary UE registration ever select a null NAS algorithm?	Run baseline attach under strict and compatibility profiles; inspect Security Mode negotiation.	Strict profile never offers/selects null; compatibility exceptions are explicit and test-scoped.	UE/AMF or UE/MME logs, NAS PCAP, config hash.
APT-LAB-011	Is subscriber identity protected when protected SUCI mode is enabled?	Add a test HN keypair/profile using synthetic SUPI and compare evidence artifacts.	Protected profile does not expose raw SUPI in the relevant pre-auth identity exchange; keys are scrubbed from published evidence.	UE config hash, NAS trace, sanitizer report.
APT-LAB-012	Can an unapproved Diameter peer establish trust?	Add a TLS/allowlisted lab profile and attempt a benign connection from a non-peer test namespace without sending operational commands.	Non-peer is rejected and logged; approved peer identity is authenticated.	Peer config, TLS identity, connection log, firewall decision.
APT-LAB-013	Are PFCP associations bound to expected SMF/UPF endpoints?	Baseline association and session events; perform restart/failover only through normal lab controls.	New endpoint or unplanned association is visible and correlated to a deployment event.	SMF/UPF logs, network flow, Docker events.
APT-LAB-014	Can GTP-U packets be correlated to a valid session?	Use the existing lab injection/correlation test with synthetic traffic and no external route.	Packet without matching endpoint/TEID/session is dropped or unambiguously alerted; valid flow remains functional.	PCAP, SMF/UPF session record, test report.
APT-LAB-015	Does LAN isolation fail closed?	Stop/reload the isolation service during an isolated maintenance test and run approved reachability checks.	No unintended external reachability; rule drift is detected before core startup.	service journal, firewall snapshot, reachability matrix.

P2 — campaign-informed detection

ID	Campaign lesson	Local validation
APT-LAB-020	LIMINAL PANDA changed Linux binaries, SSH startup, and iptables while using telecom-aware tunneling.	Hash monitored host/container paths; alert on unexpected SSH/PAM/firewall changes and processes/listeners not in image SBOM. Do not hunt only exact IOC filenames.
APT-LAB-021	Soft Cell collected selected subscriber records after enterprise lateral movement.	Generate synthetic subscriber queries and verify that small targeted reads/exports are attributable, not only bulk downloads.
APT-LAB-022	Salt Typhoon guidance emphasizes management isolation, AAA, configuration baselines, and encrypted administration.	Baseline Docker/gateway administrative identities and config; alert on new source, privilege, management listener, or unexplained config commit.
APT-LAB-023	Sea Turtle demonstrated that external control of DNS can redirect trust.	Pin/record image registry and dependency resolution, inspect Docker DNS/service-name changes, and ensure external DNS cannot silently alter an approved digest.
APT-LAB-024	KA-SAT showed legitimate management commands can cause destructive scale.	Require a maintenance marker and two-step confirmation for bulk container/NF/subscriber teardown; alert on unplanned fan-out.
APT-LAB-025	3CX showed trusted software distribution can become initial access.	Verify image digests/signatures, produce SBOMs, scan build inputs, and record the identity that promoted each lab image.

Evidence bundle layout

evidence/<run-id>/
  manifest.json              # operator, UTC time, git commit, topology, scope
  versions/                  # image digests, package versions, SBOM
  config-hashes/             # hashes only; secrets stay out of the bundle
  host/                      # Docker events, route/firewall and service state
  nf-logs/                   # AMF/SMF/NRF/UPF etc., time-normalized
  protocol/                  # scoped PCAP and decoded summaries
  datastore/                 # redacted before/after synthetic-record diff
  assertions.json            # expected versus observed result
  cleanup.json               # teardown and state-restoration proof

Detection queries to implement conceptually

NF registration without deployment: NF registry create/update with no matching approved container digest, workload identity, or deployment event.
Subscriber write without change authority: Mongo/UDR/HSS write with no seed/test run, WebUI session, or approved operator identity.
Packet-plane peer drift: new PFCP/GTP/Diameter endpoint not present in the topology manifest.
Control-plane availability precursor: NRF restart, registry-size collapse, or mass NF re-registration in a short window.
Privilege drift: container gains privileged/root/new capability, new host mount, or attachment to both management and packet networks.
Configuration masquerading as RF failure: attach/handover failure preceded by PLMN/TAC/core-address/ZMQ config hash change.

Exit criteria

The lab reaches a defensible “APT comparison ready” state when:

Open5GS is on a fixed/supported version or the affected NRF is isolated with explicit compensating controls.
There is a hardened SBI profile with authenticated workload identity.
MongoDB requires authentication and is network-restricted.
Every image and mounted config is digest/hash baselined.
The evidence bundle correlates host, NF, protocol, and datastore events on one clock.
Null NAS/SUCI modes exist only in named test profiles.
Diameter/PFCP/GTP peers have an approved endpoint manifest and drift alert.