Boffins say tool can sniff 5G traffic, launch 'attacks' without using rogue base stations Security boffins have released an open source tool for poking holes in 5G mobile networks, claiming it can do up- and downlink sniffing and a novel connection downgrade attack - plus "other serious exploits" they're keeping under wraps, for now. "Sni5Gect [is] a framework that sniffs messages from pre-authentication 5G …
The collective facepalm from intelligence services when this dropped must have sounded like a sonic boom. They’ve spent billions building bespoke interception systems, and now some grad students with an SDR and a GitHub repo have gift-wrapped a downgrade attack that works in a parking garage. The 5G marketing hype was all about security and resilience, but apparently the handshake is as fragile as a car Bluetooth pairing. Now the spooks have to decide whether to quietly thank the researchers for doing their job, or curse them for blowing the cover off vulnerabilities they were probably already abusing.
This post has been deleted by its author
It feels a *little* over-egged if I’m honest. There’s some truly interesting and impressive work in there, particularly around the engineering side. Winning the race condition between the UE and gNB is far from trivial!
On the impact front they’ve gunned for headlines a bit. They can capture the SUCI from <20m away. At that distance you may as well take the lad’s photo and run it through a reverse image search if you want to ID him. The SUCI is useless for that purpose - that’s its entire function! The SUCI can be abused as a session identifier, but not a permanent device identifier. You can say “this SUCI moved from the office at 123 Blah Street to Wetherspoons at lunchtime” but you can’t correlate that with other movements on other days, or even as they state themselves, between the UE going into and out of a lift/other poor signal area. If the UE loses signal and needs to handshake again, it’s using a new SUCI.
If they’d managed to get a SUPI then that would be proper news! Not a great analogy, but think of it a bit like sniffing a TLS handshake (the SUCI in this example) vs the private key (the SUPI). The SUCI is expected to be exposed by design.
The attacks were mostly performed against non-realistic gNBs (basically test gear). When they used a proper one they discovered that they absolutely hammer bandwidth so there was no “slack” for them to inject messages and their success rate (already not great at 80%) tanked. Tbf attacks only get better, but there’s still a lot of getting better to do :D
They say that the benefit of their attack is it doesn’t require a rogue base station so it’s much harder to passively detect (they can use beam forming etc to ensure only the target UE “sees” their messages). Then, the only interesting actual attack (4G downgrade) uses a rogue base station :D The downgrade is interesting, but there’s no evidence it works on anything recent, and it’s wholly detectable.
Finally, the UEs weren’t exactly brand spanking new. Pixel 7?! Sure, plenty of people outside of the US/Western Europe etc are using older models, but are they even supported any more?
Like I say, great engineering, shit sample sizes, poor headline grab.
Kind of agree with you as none of this is really new and already been written about for 4G systems. Though if they can win the race with the gNB they can send an ILLEGAL_UE in the reject message. This rejection means that for local radio regulations the user equipement is illegal (transmits in illegal bands) and the phone must not be used in this country. This would mean that they could not only stop the phone connecting to the spoofed network but to any network. Think multi-SIM phones. The phone will have to be rebooted before it'll again try to connect anywhere.
now some grad students with an SDR and a GitHub repo have gift-wrapped a downgrade attack that works in a parking garage
Presumably, they strip the COVID chips out of the 5G signals before decoding them? Or is it the other way round? I get so confused by the moronic conspiracy theories..
>under the GNU Affero General Public Licence 3
As per the COPYRIGHT and debian/copyright files, only some of the C files are in fact licensed under the AGPLv3-or-later - not AGPLv3-ambigious.
Although there are a bunch of other files licensed under MIT expat or BSD 3-clause and the python scripts under scripts/ have no license.
