Mobility Research Guideline — Initial Entry Vectors

BLUF. An initial entry vector (IV) here means the first physical asset, field device, or exposed network endpoint a researcher reaches — cell-site cabinet, RRU, site router, splice handhole, rogue radio at the tower perimeter, or an internet-exposed management interface tied to RAN/transport. This guide catalogs what equipment matters, what to bring to assess it, what this program has exercised, and what is still unexercised. Protocol attacks (SS7, Diameter, SIP) are downstream of these footholds; they are not IVs in this document.

How to use this document

Operating rules

1. Asset first. Name the box, cabinet, or exposed IP before naming the protocol.
2. Outside-in. OSINT/shodan → passive RF from public land → escorted cabinet → lab replica of same asset class.
3. Lab calibrates field. Use Open5GS + srsRAN + CellScope so you know what “normal” looks like before interpreting a live site (0. Methodology).
4. Authorization defines scope. Touching tower hardware without escort is out of scope; documenting exposed management from OSINT may be AL0.
5. Evidence every time. Photos (where allowed), port labels, serial/console capture, config export, PCAP from SPAN — not narrative alone.

What counts as an IV (and what does not)

Site asset map (where IVs live)

Typical macro site and immediate edge. IV research starts on red nodes — things you can see, touch, scan, or impersonate from the perimeter.

flowchart TB
    subgraph PERIM["Perimeter / public"]
        UE["Test handset / drive-test phone"]
        ROGUE["Portable rogue eNB/gNB\nSDR + laptop"]
        OSINT["Internet-exposed mgmt\nShodan / Censys hits"]
    end

    subgraph TOWER["Tower / rooftop / monopole"]
        ANT["Panel / massive MIMO antennas"]
        RET["RET / AISG tilt controllers"]
        RRU["RRU / RRH / O-RU"]
        GPS["GNSS antenna"]
    end

    subgraph CAB["Ground cabinet / hut"]
        DU["BBU / DU / CU shelf"]
        SW["Site router / switch"]
        SYNC["PTP grandmaster / sync module"]
        PWR["Rectifier / battery / ATS"]
        ENV["Environmental / access controller"]
        CRAFT["Craft port\nUSB-serial / RJ45 console"]
        OOB["OOB LTE/modem / IP-KVM"]
        CAM["CCTV / tamper sensor"]
    end

    subgraph PLANT["Outside plant"]
        HAND["Handhole / manhole / splice tray"]
        MW["Microwave backhaul radio"]
        FIB["Fiber termination / mux"]
    end

    subgraph EDGE["Customer / small cell edge"]
        SC["Small cell / DAS hub"]
        CPE["Fixed-wireless CPE / outdoor router"]
    end

    UE -->|"IV-A1 passive scan"| ANT
    ROGUE -->|"IV-A2 rogue cell"| UE
    OSINT -->|"IV-B1 exposed WebUI/SSH"| SW
    OSINT -->|"IV-B2"| DU
    CRAFT -->|"IV-C1 local console"| DU
    RRU -->|"IV-C2 flash / serial"| DU
    RET -->|"IV-C3 unauth tilt bus"| ANT
    HAND -->|"IV-D1 splice / tap"| FIB
    FIB --> SW
    SW --> DU
    GPS --> SYNC
    SYNC --> DU
    SC --> SW
    CPE --> SW

    style ROGUE fill:#d62828,color:#fff
    style OSINT fill:#d62828,color:#fff
    style CRAFT fill:#d62828,color:#fff
    style RRU fill:#e76f51,color:#fff
    style HAND fill:#e76f51,color:#fff
    style DU fill:#e76f51,color:#fff

Trust boundary rule: Anything in CAB or PLANT that speaks IPsec, MPLS, or fronthaul toward core is a bridge from physical site → regional core. Orange Core-ruption class findings often start at BBU + IPsec secrets, not at AMF APIs.

IV catalog by asset

Each row is a candidate first foothold. “Researcher kit” is what you carry to validate or simulate that asset.

A — Air interface & subscriber edge (no cabinet access)

B — Internet-exposed & WAN-facing devices (no physical access)

C — Cabinet / hut (escorted physical access — AL2)

D — Outside plant & transport (fiber / microwave)

E — Indoor / enterprise edge (non-macro)

Field researcher kit (site & edge)

Pack for AL1–AL2 when the goal is equipment-centric IV discovery.

Full RF/active stack: Support_Hardware_Lab_Equipment, Support_Hardware_Pixel9.

Lab kit (simulated site & RAN)

Use this to exercise IV mechanics without touching operator gear.

Post-attach core tests (open5gs_lab/19_checklist_network_joined) are not IVs — they assume you already joined as a UE or compromised a core component.

Exercised initial entry vectors

Equipment- and exposure-focused only.

Honest gap: Almost all real tower equipment IVs (RRU flash, BBU firmware, RET, handhole tap, Shodan on live site gear) are unexercised.

Unexercised initial entry vectors (research backlog)

Prioritized for equipment acquisition and authorized site access. P1 = can start with procurement or AL2 escort; P2 = needs climb/vendor gear; P3 = specialized optical/legal.

Coverage snapshot (equipment IVs)

Suggested procurement order: decommissioned RRH/BBU (U-01/U-02) → optical tap demo kit (U-06) → console cable set for first escorted IV-C5 (U-05).

Recommended research sequence (equipment-first)

flowchart LR
    S1[AL0 OSINT\nIV-B1/B2 templates] --> S2[AL1 passive RF\nIV-A1 inventory]
    S2 --> S3[AL4 lab rogue cell\nIV-A2/A3]
    S3 --> S4[AL2 escorted site\nIV-C/D checklists]
    S4 --> S5[Bench hardware\nIV-C2/C3 RRU/BBU]
    S5 --> S6[Update exercised table]

1. Run IV-A1 on known cells with test phone + CellScope.
2. Run IV-A2 in Faraday with B210mini (Support_Hardware_Lab_Equipment).
3. Complete TC-05/06/09 tabletop for a real or sample site photo set.
4. Acquire bench RRU/BBU and work U-01/U-02 offline.
5. Only then extend to handhole/optical (U-06) and OSINT on routers (U-03) under written scope.

After foothold (not IVs)

Once an asset IV succeeds, operators and talks describe movement toward:

Detail for core protocol testing remains in open5gs_lab/19_checklist_network_joined, open5gs_lab/TP-03_sbi_security, open5gs_lab/TP-04_gtp_userplane. Use those after documenting which equipment IV would have enabled the path.

Source corpus

• NLM notebook mobility: notebook link — prioritize Core-ruption (BBU/site), HITB downgrade (rogue cell), fiber tap, srsRAN/LTESniffer lab videos.
• Site test plan: open5gs_lab/18_test_plan_mobility_site_to_core — TC-01..09 map to IV-A/C/D.
• Hardware: Support_Hardware_Lab_Equipment, Support_Hardware_Pixel9.
• Fiber plant: Theory_Fiber_Telecom_Infrastructure.

Maintenance

When an equipment IV is exercised:

1. Add row under Exercised with asset photo/model and evidence type.
2. Remove matching Unexercised row.
3. Add procedural detail to open5gs_lab/18_test_plan_mobility_site_to_core or a new TP-* — not here.

New IV candidates must name a specific asset (manufacturer class optional), not a protocol alone.

Related

• 00-index — subscriber/OSS fraud vectors (different lane)
• 0. Methodology — lab-first phase gates
• open5gs_lab/15_real_world_attack_matrix — real-world attack patterns (includes non-equipment fraud)