STATUS: ACTIVE
SECTOR: VULNERABILITIES
LEVEL: UNCLASSIFIED // RESEARCH
Protocol-Level Flaws (Legacy & Modern)
This repository tracks Architectural Vulnerabilities in the core signalling protocols that power global telecommunications. Unlike traditional software bugs, these are "vulnerabilities by design."
🏗️ Protocol Landscape
| Protocol | Generation | Primary Vulnerability | Mitigation Standard |
|---|---|---|---|
| SS7 (MAP/CAP) | 2G/3G | No Source Validation: Any node can query any other node for location (IMSI-Catching). | GSMA FS.11 |
| Diameter | 4G (LTE) | State Information Mismatch: Using valid Diameter messages to spoof location and SMS. | itu-t Q.3062 |
| GTP (GPRS Tunneling) | 3G/4G/5G | TEID Prediction: Information disclosure and Denial of Service in the user plane. | itu-t X.1038 |
| SBA (HTTP/2 / JSON) | 5G (SA) | Insecure Inter-Slice Comm: Bypassing slice isolation via AMF/SMF discovery. | itu-t Y.3101 |
📑 Deep-Dive: The SS7 Location Tracking Attack
- Vulnerability: The Any-Time Interrogation (ATI) message allows a remote node to request the Cell-ID and MSISDN of any subscriber.
- ITU Mapping: X.1205 (General security principles) - Failure of Authentication.
- Tactical Audit: Attempt an ATI query from an external global-title (GT) and verify if the Signalling Firewall blocks the request.
📑 Deep-Dive: Diameter Header Manipulation
- Vulnerability: Manipulating the Origin-Host and Origin-Realm AVP (Attribute-Value Pairs) to impersonate a legitimate HSS (Home Subscriber Server).
- ITU Mapping: Q.3062 (Protocols for interconnecting NGN).
- Tactical Audit: Fuzzing Diameter AVPs to trigger improper parsing or bypass of authentication logic at the DRA (Diameter Routing Agent).
📑 Deep-Dive: 5G SBA Slice Bypassing
- Vulnerability: Exploiting the NRF (Network Repository Function) to discover NF (Network Function) services in a different, higher-security Network Slice.
- ITU Mapping: Y.3101 (IMT-2020 functional security).
- Tactical Audit: Testing for Unauthorized NF Registration and verifying that the SEPP enforces strict slice-ID validation for inter-PLMN roaming.
🛠️ Tactical Audit Tools
- SigPloit: SS7 and Diameter vulnerability testing framework.
- GTP-Scan: Mapping GTP-U TEIDs for identification of user-plane leaks.
- 5G-Explorer: Auditing 5G HTTP2/JSON signalling for SBA misconfigurations.
!WARNINGInterconnect Risks: Even if your internal network is hardened, your subscribers remain vulnerable to attacks originating from compromised international partners via the GRX/IPX roaming hubs.
Temporal SignatureSYNC_ID: 19E40411ABA
ITU-T Navigator v4.0.0
IntegritySIGNAL: SECURE