Practical Core Network Hacking
Three days on the weaknesses of operator core networks: the fundamentals, the interfaces and protocols, and what an attacker reaches from an internal pentest or from the outside during a Red Team. It also helps operators build their own measures by understanding the techniques.
- Tell 2G to 5G infrastructures apart and their security mechanisms
- Map exposed services, protocols and interfaces
- Hunt for common internal and external vulnerabilities
- Steal secrets and subscriber information
- Pivot internally
- Apply the right security measures
- Operator and telecom security teams
- Internal pentesters and red teamers
- Researchers on signalling and core
Conferences where we have taught
Our courses have run at these conferences, and most of them can also run privately for your team.
Three days, 2G to 5G core
From SS7 on 2G, through DIAMETER on 3G and 4G, to the 5G Next-Generation Core.
Day 1Day 1
Day 1 will introduce the mobile network and its evolution and compare the security features of 2G, 3G, 4G, and 5G. During this day, attendees will start going in depth on 2G core network security, and practical attacks with provided Virtual Machines.
- Introduction to mobile networks (2G/3G/4G/5G)
- Interfaces and protocols
- Channels
- Evolution
- Interconnections between providers
- Vectors of attacks inside and outside
- SS7 / SIGTRAN attacks and possibilities
- Current tools
- Security mechanisms
- SS7 / SIGTRAN scanning
- Identifying interesting assets
- Retrieving information and secrets of subscribers
- Retrieving locations
- Looking forward with further attacks
- Retrieving information from the outside
Day 2Day 2
Day 2 will finish the 2G part and start talking about 3G core network and their similarities. After that, we will be able to proceed on 4G core network and attacks on DIAMETER.
- 3G network pentesting and similarity with 2G
- Interesting components in 3G
- DIAMETER security
- Tools to assess DIAMETER
- Identifying external nodes (passively and actively)
- Attacking a node from the outside
- Scanning for DIAMETER components
- Identifying interesting assets
- Exploiting an identity theft attack
- Exploiting an SMS theft attack
- Intercepting traffic
- Tracking the location of a subscriber
- Going further with DoS, information gathering, etc.
Day 3Day 3
This final day will allow us to go further and focus on new infrastructures we tend to see today and in the near future. We will talk and practice around Next-Generation Core Networks used in 5G, and see the changes and new skills that are required with the used interfaces when intruding a network. We will also see the opportunities that come with them.
- 5G NSA and SA
- New security mechanisms
- Attacking NGC functions
- Intruding the network from the outside
- The tools we have developed
- (Bonus) OpenRAN
- Finish 4G attacks
- Intruding a 5G NSA network
- Finding new opportunities
- Attacking the UPF
- Identifying VNFs
- Attacking VNFs (leaks, exploitation, etc.)
- Hijacking a network
- Introduction to OpenRAN
- Attacking OpenRAN (depending on the time)
In a private session
The content is arranged around your needs, and we can add:
- Practical 2G to 5G radio security testing
- OpenRAN pentesting
What every attendee takes home
The infrastructure to practise on, plus the tools we developed.
- Lab access
- The infrastructure to practise on
- Docker container and VM
- Preconfigured, with the tools
- Slides and tools
- Full deck and the tools we developed
- Captures
- Cleared for teaching
Prerequisites
A laptop running Linux
8 GB of RAM minimum
Linux administration
Required
Network security and radio basics
Helpful
Pentest or red team experience
A plus, not required
Your trainer
Wireless and hardware security specialist. Published research on 5G security, Open RAN, baseband fuzzing, interception and mapping, and power-line communication (HomePlug AV, domestic PLC, electric vehicles and charging stations). Practical work across Wi-Fi, RFID and other wireless systems.
PublicationsHow it runs and what to know
How it is taught
Hands-on from the start: you work on real radios and real hardware, with the same tools and signal captures we use on engagements. Live courses include a hardware kit you keep; on-demand courses run at your own pace, on this site.
How progress is assessed
Progress is checked through the practical exercises done during the course. A certificate of completion is issued to each participant.
How and when to enrol
Live and tailored sessions are scheduled with you after a short scoping call, usually within a few weeks. On-demand courses start as soon as your purchase is confirmed.
Accessibility
Penthertz is a registered French training organisation (no. 11788588278). If a participant has a disability or a specific need, tell us when scoping and we will adapt the setup where we can.
Run it privately for your team
Priced per group, with content adapted to your needs. Remotely, on your site or at our offices near Paris.