The Design Assumption 5G Shares with the Titanic

▶ Watch (00:09)

The Titanic’s compartments were sealed horizontally but not vertically. When the iceberg split the hull, water poured across six compartments and the ship sank. The designers called it unsinkable.

5G makes the same bet. The architecture enforces a tight separation between control plane (AMF, SMF) and data plane (UPF, gNB). Security runs on each over-the-air interface. But if a packet can cross that vertical boundary, the isolation collapses. That is the research question Shaik set out to answer.

GTP-U: A 26-Year-Old Protocol with No Payload Validation

▶ Watch (01:26)

GTP-U has carried mobile data since 2G and still runs inside 5G cores. By design it does no payload inspection and has no source authentication, so any SIM-equipped device can craft a header and inject it into the network. Shaik walked through the tunnel packet construction and UPF rerouting walkthrough (06:36) live, showing how the base station wraps the attacker’s inner header with a legitimate outer one, the UPF strips the outer header and processes the inner, then reroutes the packet to itself. Via the N9 roaming interface, the same technique reaches international networks.

Testing Six 5G Cores: What the Lab Found

▶ Watch (09:43)

Shaik tested four open-source and two commercial 5G cores in isolated labs with no external firewalls. The majority of UPFs processed tunnel packets and bridged payloads into the core. To attribute attacks to a specific subscriber, an attacker enumerates tunnel endpoint identifiers via the TE ID enumeration method (13:22): mutate TEID values and watch for error-indication replies. Silence means an active session exists. Several cores assigned TEIDs sequentially or using only two bytes, making enumeration take seconds. Rate limiting was absent across nearly all cores tested.

Three Attack Chains Enabled by Tunnel Processing

▶ Watch (16:38)

Three attacks become practical once a UPF processes tunnel packets. Reflective injection: the attacker sends a GTP-encapsulated DNS query through the UPF to an attacker-controlled server; the response lands on the victim UE using a forged TEID. Direct UE-to-UE routing: address the inner header at a target handset’s IP and the UPF forwards it there, bypassing billing. In the third, a rogue gNB uses tunnel packets to register with the AMF, receives the session’s encryption keys, and provides a fully authenticated connection to the victim. Stingray detectors cannot flag it.

Root Cause, Disclosure, and What Vendors Must Fix

▶ Watch (22:17)

The root cause is UPF implementations that accept and process encapsulated packets rather than dropping them. GTP-U has no built-in integrity checks, so IPSec on the transport layer does not help: once the packet reaches the UPF, IPSec is stripped and the inner crafted header is processed. Shaik disclosed findings to GSMA at an FSAG meeting and to all six vendors. Some open-source cores already patched. CVEs are in progress. The full methodology publishes in October 2025 at ACM CCS. The GSMA guidance says to eliminate encapsulated packets but gives no explanation of the consequences, which Shaik calls the deeper problem.

“tunnel packet to get legit encryption” — Altaf Shaik

Q&A

Doesn’t the GSMA 5G security guide require GTP-U traffic to be IPSec-encrypted end-to-end, which would block tunneling? IPSec only protects the transport layer; once the packet reaches the UPF, IPSec is stripped and the UPF processes the inner crafted packet regardless. ▶ 31:21

What is the legitimate use of GTP-U? GTP-U is the standard protocol for carrying all UE traffic between the gNB and the UPF; each user session gets a dedicated tunnel identified by a TEID. ▶ 33:25

Notable Quotes

everyone is is an attacker in this case, Altaf Shaik · ▶ 4:49

tunnel packet to get legit encryption Altaf Shaik · ▶ 26:52

more than like 80% of them are Altaf Shaik · ▶ 28:51

Key Takeaways

  • Modern UPFs across open-source and commercial 5G cores process attacker-crafted GTP-U tunnel packets, bypassing control/data plane separation.
  • A smartphone with a SIM card is sufficient to inject encapsulated packets that reach AMF or SMF without complex RF equipment.
  • Resulting attacks include billing fraud, undetectable man-in-the-middle via a rogue gNB, and direct UE-to-UE traffic injection.