Security: Mobile Core - GTP Attack Vectors & Vulnerabilities

🚩 Core Attack Sequences

1. TEID Brute-Force / Prediction

• Vector: GTP-U (User Plane).
• Method: An attacker sends GTP-U packets with varying Tunnel Endpoint Identifiers (TEID) to a known GGSN/UPF port (2152).
• Impact: Discovery of active subscriber tunnels and the ability to inject malicious data into an encrypted or unencrypted session.
• Mitigation: Mandatory TEID Randomization and rate-limiting unknown TEID packets at the gateway.

2. Malicious Session Creation (GTP-C)

• Vector: GTP-C (Control Plane).
• Method: Sending a spoofed Create Session Request from a rogue SGSN/MME to a PGW/UPF.
• Impact: Creation of "Ghost Tunnels" that allow attackers to use the carrier's network for free or to launch attacks from the carrier's IP space.
• Mitigation: IPX/GRX Roaming Filters and strict authentication of peer GTP-C identities.

3. GTP-in-GTP Tunnelling (Encapsulation)

• Vector: GTP-U.
• Method: Encapsulating a GTP packet inside another GTP packet. Many perimeter filters only inspect the outer header.
• Impact: Bypassing deep packet inspection (DPI) to transport malicious control signaling or unauthorized data protocols.
• Mitigation: GTP Extension Header Validation and disabling G-PDU nesting at the firewall.

4. TEID Collision DoS

• Vector: GTP-C.
• Method: Triggering the creation of multiple sessions with the same target TEID or flooding the control plane with Modify Bearer Request messages.
• Impact: Denial of Service for specific subscribers or entire network segments as the PGW/UPF state table becomes unstable.
• Mitigation: Stateful GTP Sequence Number Tracking and anomaly detection on session modification rates.

🛠️ Security Architecture Mapping

!CAUTIONUser Plane Cleartext: In most 4G and 5G non-standalone deployments, GTP-U traffic is NOT encrypted between the base station and the core unless IPsec is explicitly configured. This makes the entire backhaul vulnerable to passive wiretapping.