5G Radio and Core Networks Hacking
Three days on 5G NSA and SA security: assessing devices, the current and Next-Generation Core Network, and the attack surface OpenRAN brings. Private 5G on unlicensed bands puts campuses and companies on the air, and this course covers the new risks that come with it.
- Tell 2G, 3G, 4G and 5G apart, and 5G NSA from SA, with their new security mechanisms
- Downgrade security mechanisms
- Set up an entire 5G lab and testbed
- Assess 5G-NR devices safely and hunt for vulnerabilities
- Attack current and Next-Generation Core Networks from outside and inside
- Understand OpenRAN architecture and its attack surface
- Get the first reflexes to attack embedded and IoT systems
- Mobile operators and private-5G owners
- Device and infrastructure makers
- Red teamers and researchers on the mobile core
Conferences where we have taught
Our courses have run at these conferences, and most of them can also run privately for your team.
Three parts, radio to core to OpenRAN
Radio first, then the core network, then the OpenRAN surface.
Part 15G radio
Day 1 introduces the 5G NSA mode and the SA mode. During this day, we will also introduce the radio aspect, the tools, and the setup to organize our RF assessments with Software-Defined Radio
- Introduction to mobile networks and protocols (2G/3G/4G/5G)
- Differences between 5G NSA and SA
- Security mechanism on the radio
- SIM/USIM/ISIM cards
- Equipment and tools for our tests
- Incoming tools
- Possible attacks on 5G-NR
- How to safely assess 5G devices
- Hunting for vulnerabilities
- Looking in-depth secrets generated during a registration
- Manipulating them
- Running a 5G virtual network
- Inspecting captures
- Fingerprinting devices
- Set up a 5G NSA network with Software-Defined Radio
- Configuring an ISIM card
- Set up a 5G SA network with Software-Defined Radio
- Alternatives
- Analyzing communications between a client and a network
- Capturing the secrets
Part 25G Core Networks
Day 2 is an opportunity to see the core network side, which could be very interesting when the operator exposes some nodes outside, as was the case many times. Moreover, it will focus more on the Standalone mode, which will drastically change from 2G-4G infrastructures and applications.
- Introduction of the 5G SA infrastructure and REST APIs
- Security Mechanisms
- Possible attacks
- Hunting for exposed nodes/gateways
- Our latest feedbacks
- Mapping a cloud
- Look for exposed services
- Finding and exploiting vulnerabilities to intrude the service
- Attacking the API to get persistent
- Hijack communications
- Looking at 2 different Open-sourced stacks
- Map devices in remote from the exposed network
- Find and exploit vulnerabilities on devices
Part 3OpenRAN
OpenRAN represents a good opportunity for manufacturers that are not part of the telecom ecosystem. This technology revisits all the architectures of a RAN with open-sources blocks and new AI concepts to handle and scale a network. But this new technology that is sold to be secure using open-sources blocks can also introduce new vulnerabilities and vectors of attacks.
- Introduction to RANs
- OpenRAN's architectures
- Introduction to containers and Kubernetes
- Current tools and attacks
- Mapping OpenRAN assets
- Enumerating vulnerabilities
- Looking for interesting vectors
- Intruding a network
- Pivoting
- Backdooring applications
- Avoid misconfigurations
- Testing and auditing a setup in the cloud
In a private session
The content is arranged around your needs, and we can add:
- More practical attacks on vRAN and OpenRAN
- Fuzzing the core network protocol stacks
What every attendee takes home
Attendees keep the kit, the tooling and the captures.
- RF kit
- bladeRF 2.0 micro, kept by the attendee
- Virtual machine
- Preconfigured lab and tools
- Slides and tools
- Full deck and the tools used in class
- Captures
- Cleared for teaching
Prerequisites
A laptop running Linux
8 GB of RAM minimum
Linux administration
Required
Radio knowledge
Helps but is not required
Pentest or red team experience
A plus, not required
Your trainer
Wireless and hardware security specialist. Published research on 5G security, Open RAN, baseband fuzzing, interception and mapping, and power-line communication (HomePlug AV, domestic PLC, electric vehicles and charging stations). Practical work across Wi-Fi, RFID and other wireless systems.
PublicationsHow it runs and what to know
How it is taught
Hands-on from the start: you work on real radios and real hardware, with the same tools and signal captures we use on engagements. Live courses include a hardware kit you keep; on-demand courses run at your own pace, on this site.
How progress is assessed
Progress is checked through the practical exercises done during the course. A certificate of completion is issued to each participant.
How and when to enrol
Live and tailored sessions are scheduled with you after a short scoping call, usually within a few weeks. On-demand courses start as soon as your purchase is confirmed.
Accessibility
Penthertz is a registered French training organisation (no. 11788588278). If a participant has a disability or a specific need, tell us when scoping and we will adapt the setup where we can.
Run it privately for your team
Priced per group, with content adapted to your needs. Remotely, on your site or at our offices near Paris.