Part 15: Real-World Attack Matrix & Defense Roadmap

Learning Objective: Synthesize all 20 real-world cellular network attacks from Parts 11–14 into a unified reference — master comparison matrix, combined STRIDE profile, standards mapping, lab replicability guide, and a prioritized defense roadmap for telecom security engineers.

Table of Contents

• Unified Network Attack Map
• Master Attack Comparison Matrix
• Combined STRIDE Profile (All 20 Attacks)
• Attack Kill Chain Mapping
• Unified Standards Mapping
• Lab Replicability Guide
• Defense Roadmap
• Lab Exercises

Unified Network Attack Map

The following diagram shows where all 20 attacks originate across the mobile network architecture. Each attack is mapped to its primary entry point and the network layers it traverses.

graph TB
    subgraph "Radio Access Network"
        UE[📱 UE
Subscriber Device]
        RAN[📡 eNB / gNB
Base Station]
    end

    subgraph "Core Network — Control Plane"
        MME_AMF[🎛️ MME / AMF
Mobility Management]
        HSS_UDM[(🔐 HSS / UDM
Subscriber Database)]
        SMSC[📨 SMSC / SMSF
SMS Routing]
        AUSF[🔑 AUSF
Authentication]
    end

    subgraph "Core Network — User Plane"
        SGW_UPF[📦 SGW / UPF
User Plane Gateway]
        PGW[📦 PGW-U
PDN Gateway]
    end

    subgraph "Interconnect & Roaming"
        STP_DRA[🔀 STP / DRA
Signaling Transfer]
        GRX_IPX[🌐 GRX / IPX
Roaming Exchange]
    end

    subgraph "Carrier Business Systems"
        BSS[💰 BSS / Billing]
        CRM[🖥️ CRM / Portal]
        Provisioning[⚙️ Provisioning
SIM Management]
        CDR_DB[(📊 CDR Database)]
    end

    subgraph "External Systems"
        A2P[📨 A2P SMS
Aggregators]
        Internet[🌐 Internet]
        Banks[🏦 Banks / SaaS]
    end

    subgraph "Attacker Entry Points (Red = Attack Origin)"
        ATK_SS7[🔴 1,2,4,13
SS7 Signaling
Access]
        ATK_Diameter[🔴 3
Diameter
Peer Access]
        ATK_GTP[🔴 5
GTP Roaming
Access]
        ATK_Breach[🔴 6,9
Carrier Data
Breach]
        ATK_Social[🔴 7,8,20
Social Engineering
of Carrier Staff]
        ATK_Insider[🔴 8
Insider
Access]
        ATK_Malware[🔴 11,15
Device
Malware]
        ATK_A2P[🔴 14,10
A2P SMS
Channel Abuse]
        ATK_Platform[🔴 12,19
CaaS
Platform]
        ATK_APT[🔴 16,17,18
APT/Gang
Operations]
    end

    ATK_SS7 -.->|"MAP msgs"| STP_DRA
    ATK_Diameter -.->|"Diameter"| STP_DRA
    ATK_GTP -.->|"GTP-C/U"| GRX_IPX

    STP_DRA <--> HSS_UDM
    STP_DRA <--> MME_AMF
    STP_DRA <--> SMSC
    GRX_IPX <--> SGW_UPF

    ATK_Breach -.->|"Exploit/exfil"| CDR_DB
    ATK_Breach -.->|"Exploit/exfil"| CRM
    ATK_Social -.->|"SIM swap"| Provisioning
    ATK_Insider -.->|"Direct access"| Provisioning
    ATK_Insider -.->|"Direct access"| HSS_UDM

    ATK_Malware -.->|"Infected device"| UE
    UE <--> RAN
    RAN <--> MME_AMF
    MME_AMF <--> HSS_UDM
    MME_AMF <--> AUSF
    SGW_UPF <--> PGW
    PGW <--> Internet

    ATK_A2P -.->|"Spoofed SMS"| A2P
    A2P -.-> SMSC
    SMSC --> UE

    ATK_Platform -.->|"Multi-method"| STP_DRA
    ATK_Platform -.->|"Multi-method"| UE

    ATK_APT -.->|"Surveillance"| STP_DRA
    ATK_APT -.->|"Spear-phish"| UE
    ATK_APT -.->|"Carrier compromise"| CRM

    Provisioning <--> HSS_UDM
    BSS <--> CDR_DB
    Banks <-.-> Internet

    style ATK_SS7 fill:#ff6666,color:#fff
    style ATK_Diameter fill:#ff6666,color:#fff
    style ATK_GTP fill:#ff6666,color:#fff
    style ATK_Breach fill:#ff6666,color:#fff
    style ATK_Social fill:#ff6666,color:#fff
    style ATK_Insider fill:#ff6666,color:#fff
    style ATK_Malware fill:#ff6666,color:#fff
    style ATK_A2P fill:#ff6666,color:#fff
    style ATK_Platform fill:#ff6666,color:#fff
    style ATK_APT fill:#ff6666,color:#fff
    style STP_DRA fill:#ffaa66
    style GRX_IPX fill:#ffaa66
    style Provisioning fill:#ffaa66
    style CDR_DB fill:#ffaa66
    style CRM fill:#ffaa66
    style HSS_UDM fill:#ffee66
    style SMSC fill:#ffee66
    style UE fill:#ffee66
    style SGW_UPF fill:#ffee66
    style MME_AMF fill:#99cc99
    style AUSF fill:#99cc99
    style PGW fill:#99cc99
    style RAN fill:#99cc99
    style BSS fill:#99cc99

Legend: 🔴 Red = attacker entry point | 🟠 Orange = directly exploited component | 🟡 Yellow = impacted/victim component | 🟢 Green = not directly affected

Master Attack Comparison Matrix

Combined STRIDE Profile (All 20 Attacks)

✅ = Primary impact | ⚠️ = Secondary/moderate impact

STRIDE Category Heatmap

graph LR
    subgraph "STRIDE Frequency Across 20 Attacks"
        S["S — Spoofing
12 attacks (60%)"]
        T["T — Tampering
7 attacks (35%)"]
        R["R — Repudiation
18 attacks (90%)"]
        I["I — Info Disclosure
18 attacks (90%)"]
        D["D — DoS
6 attacks (30%)"]
        E["E — Elev. of Privilege
14 attacks (70%)"]
    end

    style S fill:#ff9999
    style T fill:#ffcc99
    style R fill:#ff6666,color:#fff
    style I fill:#ff6666,color:#fff
    style D fill:#ffffcc
    style E fill:#ff9999

Key insight: Repudiation and Information Disclosure dominate (90% of attacks each). This reflects the core problem: mobile network attacks are hard to trace (repudiation) and almost always expose sensitive data (info disclosure). Defense investments should prioritize logging/attribution (countering repudiation) and encryption/access control (countering disclosure).

Attack Kill Chain Mapping

Each of the 20 attacks mapped to a simplified Telecom Kill Chain:

graph LR
    KC1[1. Reconnaissance
Target identification]
    KC2[2. Access Acquisition
SS7/GTP/insider/breach]
    KC3[3. Network Positioning
Establish attack path]
    KC4[4. Exploitation
Execute attack]
    KC5[5. Monetization
Financial gain / intel]
    KC6[6. Persistence
Maintain access]

    KC1 --> KC2 --> KC3 --> KC4 --> KC5 --> KC6

    style KC1 fill:#e6f3ff
    style KC2 fill:#cce5ff
    style KC3 fill:#99ccff
    style KC4 fill:#ff9999
    style KC5 fill:#ff6666,color:#fff
    style KC6 fill:#cc3333,color:#fff

Unified Standards Mapping

Standards Coverage Summary

Lab Replicability Guide

Replicability Classification

Detailed Lab Exercise Mapping

Defense Roadmap

Priority Matrix

The following prioritization considers impact severity, attack frequency in the wild, and feasibility of defense implementation.

graph TB
    subgraph "Priority 1 — Immediate (0-6 months)"
        P1A[🔴 Eliminate SMS-based MFA
Migrate to FIDO2/WebAuthn
Blocks: 1,4,7,11,12,13,17,19]
        P1B[🔴 Deploy SS7/Diameter Firewall
GSMA FS.11/FS.19 categories
Blocks: 1,2,3,4,13,16]
        P1C[🔴 Phishing-Resistant MFA
for Carrier Employees
Blocks: 7,8,20]
    end

    subgraph "Priority 2 — Near-Term (6-12 months)"
        P2A[🟠 GTP Firewall at GRX/IPX
GSMA FS.20 + IR.88
Blocks: 5]
        P2B[🟠 A2P Sender ID Registry
10DLC + brand verification
Blocks: 10,14,18]
        P2C[🟠 CDR Encryption + Access Control
At rest and in transit
Blocks: 6,9]
        P2D[🟠 Insider Threat Program
UEBA + provisioning monitoring
Blocks: 8,20]
    end

    subgraph "Priority 3 — Medium-Term (12-24 months)"
        P3A[🟡 Device Attestation
SafetyNet / Play Integrity
Blocks: 11,15]
        P3B[🟡 RCS Business Messaging
Verified sender identity
Blocks: 10,14]
        P3C[🟡 Zero-Trust Architecture
for Carrier Internal Systems
Blocks: 8,20]
        P3D[🟡 Premium SMS Controls
DCB opt-in + confirmation
Blocks: 15]
    end

    subgraph "Priority 4 — Long-Term (24+ months)"
        P4A[🟢 Full 5G SA Migration
Eliminates SS7/Diameter exposure
Blocks: 1,2,3,4,13,16]
        P4B[🟢 IPsec on All GTP Interfaces
Encrypt + authenticate tunnels
Blocks: 5]
        P4C[🟢 Industry-Wide Coordination
GSMA threat sharing, law enforcement
Blocks: 4,12,19]
    end

    style P1A fill:#ff6666,color:#fff
    style P1B fill:#ff6666,color:#fff
    style P1C fill:#ff6666,color:#fff
    style P2A fill:#ffaa66
    style P2B fill:#ffaa66
    style P2C fill:#ffaa66
    style P2D fill:#ffaa66
    style P3A fill:#ffee66
    style P3B fill:#ffee66
    style P3C fill:#ffee66
    style P3D fill:#ffee66
    style P4A fill:#99cc99
    style P4B fill:#99cc99
    style P4C fill:#99cc99

Defense-to-Attack Coverage Matrix

Defense Sequence Diagram — Layered Response

sequenceDiagram
    participant Carrier as 📡 Mobile Carrier
    participant Enterprise as 🏢 Enterprise (Downstream)
    participant Regulator as ⚖️ Regulator (FCC/GSMA)
    participant User as 📱 End User

    rect rgb(255, 200, 200)
        Note over Carrier,User: Priority 1: Immediate Actions (0-6 months)
        Carrier->>Carrier: Deploy SS7/Diameter firewall
(GSMA FS.11 Cat 1-3 rules)
        Carrier->>Carrier: Enforce FIDO2 keys for
all employee internal access
        Enterprise->>Enterprise: Migrate MFA from SMS
to FIDO2/WebAuthn/TOTP
        Enterprise->>User: Notify: "Enroll new MFA method"
    end

    rect rgb(255, 220, 180)
        Note over Carrier,User: Priority 2: Near-Term (6-12 months)
        Carrier->>Carrier: Deploy GTP firewall at IPX border
        Carrier->>Carrier: Implement CDR encryption
+ strict RBAC
        Carrier->>Carrier: Launch insider threat program
(UEBA on provisioning systems)
        Regulator->>Carrier: Mandate A2P sender ID
registration (10DLC)
    end

    rect rgb(255, 255, 200)
        Note over Carrier,User: Priority 3: Medium-Term (12-24 months)
        Enterprise->>Enterprise: Integrate device attestation
into auth flows
        Carrier->>User: Launch RCS Business Messaging
(verified sender identity)
        Carrier->>Carrier: Zero-trust architecture
for internal systems
    end

    rect rgb(200, 255, 200)
        Note over Carrier,User: Priority 4: Long-Term (24+ months)
        Carrier->>Carrier: Complete 5G SA migration
(sunset 2G/3G + SS7)
        Carrier->>Carrier: IPsec on all GTP interfaces
        Regulator->>Regulator: International enforcement
cooperation (CaaS takedowns)
    end

Threat Landscape Summary

By Attacker Type

By Network Layer

Critical Observations

1. The signaling plane remains the most dangerous attack surface — 7 of 20 attacks exploit trust assumptions in SS7, Diameter, or GTP that were designed 30+ years ago and cannot be patched without protocol replacement.

2. SMS is the most exploited delivery/interception mechanism — it appears in 12 of 20 attacks as either the attack channel (smishing, premium SMS) or the target (OTP interception, SMS stealing).

3. The "as-a-service" trend is the most concerning evolution — attacks 4, 12, and 19 show that signaling exploitation, OTP interception, and SMS fraud have been productized into commodity services available to anyone.

4. Carrier business systems are an underappreciated attack surface — attacks 6, 7, 8, 9, and 20 show that compromising CRM, provisioning, and CDR systems has cascading downstream impact across the entire subscriber base.

5. No single defense blocks all attacks — a defense-in-depth approach is required, combining signaling firewalls (network layer), authentication modernization (application layer), insider threat programs (human layer), and regulatory coordination (ecosystem layer).

🔬 Lab Exercises

Exercise 1: Map Your Docker Lab to the Unified Attack Surface

# Identify which components in your Docker lab correspond
# to the attack surface in the Unified Network Attack Map

# List all running containers — these are your network functions
docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Ports}}"

# For each container, identify:
# 1. What network layer does it belong to? (RAN, control plane, user plane, BSS)
# 2. Which attacks from the matrix target this component?
# 3. What interfaces/ports does it expose?

# Example analysis:
# open5gs_hss → HSS/UDM (control plane)
#   Attacked by: #1 (SS7 OTP), #2 (location), #7 (SIM swap), #8 (insider)
#   Interfaces: Diameter S6a (port 3868)
#   Defense: Access control, signaling firewall, monitoring

# open5gs_upf → UPF (user plane)
#   Attacked by: #5 (GTP abuse)
#   Interfaces: GTP-U (port 2152)
#   Defense: GTP firewall, TEID validation, IPsec

Exercise 2: Build a Component Vulnerability Heat Map

# Using the Docker lab, determine which components are exposed
# to the most attack categories

# Check which ports are exposed (these are potential entry points)
docker ps --format "{{.Names}}: {{.Ports}}" | sort

# Check network connectivity between containers
docker network inspect $(docker network ls -q) 2>/dev/null | \
  python3 -c "
import json, sys
data = json.load(sys.stdin)
for net in data:
    if net.get('Containers'):
        print(f\"Network: {net['Name']}\")
        for cid, info in net['Containers'].items():
            print(f\"  {info['Name']}: {info['IPv4Address']}\")
"

# Question: Which container has the most network connections?
# That container likely has the largest attack surface.
# (Answer: Usually MME/AMF — it connects to HSS, SGW, eNB/gNB, and SMF)

Exercise 3: Test Defense Effectiveness — Subscriber DB Hardening

# Demonstrate the difference between an unprotected and protected
# subscriber database (relevant to attacks #6, #7, #8, #20)

# Step 1: Show current (unprotected) state
docker exec -it open5gs_mongo mongosh open5gs --eval '
db.subscribers.find({}, {
  imsi: 1,
  "security.k": 1,
  "security.opc": 1
}).pretty()'
# All authentication secrets are readable!

# Step 2: Demonstrate what role-based access control would look like
# Create a read-only user that can't access security fields
docker exec -it open5gs_mongo mongosh admin --eval '
db.createUser({
  user: "readonly_audit",
  pwd: "auditpass123",
  roles: [{role: "read", db: "open5gs"}]
})'

# Step 3: Even the read-only user can see secrets!
# This demonstrates why field-level encryption (FLE) or
# application-level access control is needed — database-level
# RBAC alone is insufficient for HSS/UDM protection.

# Question: What additional controls would prevent an attacker
# with database read access from extracting K and OPc values?
# (Answer: Field-level encryption, HSM-backed key storage,
# application-level access control with audit logging)

Exercise 4: Simulate Multi-Vector Attack Chain (Attacks #7 + #1 Combined)

# This exercise demonstrates how SIM swap (#7) + signaling access (#1)
# could be combined for maximum impact

# Step 1: Record original subscriber state
docker exec -it open5gs_mongo mongosh open5gs --eval '
db.subscribers.findOne({imsi: "999700000000001"}, {imsi: 1, msisdn: 1})'

# Step 2: Verify UE is connected
docker exec -it ueransim_ue nr-cli UERANSIM --exec "status"

# Step 3: "SIM swap" — change the subscriber's auth key
# (simulating what happens after social engineering carrier staff)
docker exec -it open5gs_mongo mongosh open5gs --eval '
db.subscribers.updateOne(
  {imsi: "999700000000001"},
  {$set: {"security.k": "11111111111111111111111111111111"}}
)'

# Step 4: Force re-authentication — UE should fail
docker restart ueransim_ue
sleep 5

# Step 5: Check UE status — should show authentication failure
docker logs ueransim_ue 2>&1 | tail -15

# Step 6: If an attacker had a device with the new key (11111...),
# they could now attach as the victim subscriber
# This is the SIM swap + session hijack combination

# Step 7: Restore original state
docker exec -it open5gs_mongo mongosh open5gs --eval '
db.subscribers.updateOne(
  {imsi: "999700000000001"},
  {$set: {"security.k": "465B5CE8B199B49FAA5F0A2EE238A6BC"}}
)'
docker restart ueransim_ue

External References

Academic & Industry Research

News & Incident Sources

• Terrazone: SS7 Security Vulnerabilities, Attacks & Prevention
• EFF: The Danger of SS7 and What You Can Do About It
• SecurityWeek: Massive OTP-Stealing Android Malware Campaign (2024)
• AccountableHQ: T-Mobile Data Breach Explained
• P1 Security: SMS-Based Attacks — The Hidden Threat
• TechTarget: The Biggest Ransomware Attacks in History

Summary

• ✅ 20 real-world attack patterns span four categories: signaling exploitation (SS7/Diameter/GTP), subscriber identity theft, SMS abuse/malware, and APT/gang strategic operations
• ✅ Information Disclosure and Repudiation are the dominant STRIDE categories (90% of attacks each) — invest in encryption, access control, and attribution/logging
• ✅ SMS is the single most exploited mechanism — appearing in 12 of 20 attacks as either the attack channel or the interception target
• ✅ The "as-a-service" evolution (attacks 4, 12, 19) has commoditized signaling exploitation, making nation-state-grade attacks available to any criminal with cryptocurrency
• ✅ Eliminating SMS-based authentication is the highest-impact single defense, blocking or mitigating 40% of all catalogued attacks
• ✅ No single defense is sufficient — a layered approach combining signaling firewalls, authentication modernization, insider threat programs, and ecosystem coordination is required
• ✅ 9 of 20 attacks are at least partially replicable in the Open5GS Docker lab, making this a practical learning resource for hands-on telecom security training

Return to: Index

← Previous: Part 14: APT & Gang Mobile Infrastructure Operations