The 5G Titanic

Overview: This presentation evaluates the architectural security of 5G cellular networks, drawing an analogy to the design flaws of the Titanic, where compartmentalized bulkheads failed to prevent water from cascading across the vessel. The speaker examines the foundational assumption of 5G infrastructure: the strict separation between the control plane and the user plane. The talk demonstrates how legacy protocols, specifically the GPRS Tunneling Protocol User Plane (GTP-U), can be weaponized through protocol tunneling and network boundary bridging to penetrate telecom core networks.

Key Topics: - Architectural analogies between the Titanic's compartmentalization failure and 5G network design - 5G core network topology: Control plane (AMF, SMF) versus user data plane (gNodeB, UPF) - Security boundaries, over-the-air encryption, and the common omission of internal IPsec - Exploiting the GPRS Tunneling Protocol User Plane (GTP-U) via protocol tunneling and boundary bridging

Technical Details: The Titanic sank because its watertight compartments were sealed only horizontally; once the hull breached, seawater cascaded vertically over the bulkheads into adjacent chambers. The speaker asserts that 5G cellular networks exhibit an identical architectural vulnerability by assuming that the control plane and user plane (data plane) remain strictly isolated. In 5G networks, the control plane manages authentication, session management, and mobility via functions like the Access and Mobility Management Function (AMF) and Session Management Function (SMF). In contrast, the user plane handles actual subscriber data traffic, routed through base stations (gNodeB) and User Plane Functions (UPF) to the internet.

While over-the-air interfaces are secured via Non-Access Stratum (NAS) and Radio Resource Control (RRC) encryption, transport-layer security (IPsec) between core network functions is merely recommended rather than mandated by telecommunications standards. In practice, operators frequently omit IPsec on internal links deemed "physically secure," leaving core traffic unencrypted in plain text. Furthermore, user data transmission relies on the GPRS Tunneling Protocol User Plane (GTP-U)—a 26-year-old protocol originating from 2G/3G architectures. The base station (gNodeB) receives raw IP packets from the user equipment (UE), encapsulates them within an outer GTP-U header, and forwards the packet to the UPF. Critically, GTP-U possesses no native cryptographic authentication and performs no deep inspection of its encapsulated payloads.

The author models a threat environment where any subscriber possessing a standard 5G SIM card can launch attacks from the user plane. By crafting malicious IP packets containing an inner GTP-U header (complete with target internal IP addresses, ports, and Tunnel Endpoint Identifiers / TEIDs), an attacker executes protocol tunneling. When the gNodeB adds a legitimate outer GTP-U header and transmits it to the UPF, the UPF strips the outer header and re-evaluates the inner packet. If configured to re-route internal traffic, the UPF forwards the attacker's inner packet across internal core interfaces or across the N9 roaming interface between home and visited networks. In network boundary bridging attacks, data plane traffic penetrates directly into control plane functions (AMF/SMF), bypassing perimeter filtering to trigger telecom fraud and core service disruption.

Key Takeaways: Telecommunications operators must not assume the 5G user plane and control plane are securely isolated by default when legacy encapsulation protocols like GTP-U bridge the boundaries. Network security teams must enforce end-to-end IPsec encryption across all internal network function interfaces regardless of physical security assumptions. Core firewalls and User Plane Functions must implement strict deep packet inspection to detect and drop nested GTP-U headers and block data plane packets attempting to communicate with control plane services.

(AI summary — Gemini Flash)