This repository consolidates community knowledge in the cellular security space, including exploits, research papers, tools, and educational resources. The goal is to preserve and organize important security research that might otherwise become difficult to find.
New to cellular security research? This section outlines the recommended path for building foundational skills.
-
SNI5GECT: Sniffing and Injecting 5G Traffic Without Rogue Base Stations — Singapore University of Technology and Design, USENIX Security 2025
Framework that enables sniffing unencrypted 5G messages and injecting attack payloads over-the-air without jamming or rogue base stations. An attacker within 20 meters can force devices to reboot and downgrade to 4G. GitHub
-
5Gone: Uplink Overshadowing Attacks in 5G-SA — ETH Zurich, Feb 2026
SDR-based uplink overshadowing attack against 5G-SA networks exploiting 3GPP standard deficiencies. Enables surgical DoS, privacy, and downgrade attacks with E2E latency under 500μs. Runs on standard x86 hardware without dedicated acceleration.
-
Kairos: Timing-Induced Interaction Failures in LTE and 5G Core Networks — 2026
Lightweight testing framework exposing timing-induced interaction failures. Discovered 20 new vulnerabilities and reproduced 34 existing issues across Open5GS, srsRAN, Amarisoft, and commercial implementations.
-
RANsacked: 100+ Flaws in LTE and 5G Implementations — University of Florida / NC State, Jan 2025
Researchers disclosed 119 vulnerabilities (97 CVEs) across seven LTE and three 5G implementations including Open5GS, Magma, OpenAirInterface, Athonet, SD-Core, srsRAN. Every flaw can be used to persistently disrupt city-wide cellular communications. Some require no SIM card — a single unauthenticated packet can crash an MME or AMF.
-
CITesting: Context Integrity Violations in LTE Core Networks — KAIST, ACM CCS 2025 (Distinguished Paper)
KAIST researchers identified a new class of uplink attacks against LTE core networks. Unlike traditional downlink attacks, these work through legitimate base stations and can affect anyone in the same MME coverage area. All four tested implementations (Open5GS, srsRAN, Amarisoft, Nokia) were vulnerable.
-
LLFuzz: LLM-Guided Baseband Firmware Fuzzing — KAIST, July 2025
LLM-guided fuzzing framework for cellular baseband firmware targeting MediaTek and Samsung Shannon. Discovered 11 memory corruption vulnerabilities including buffer overflows in NAS and RRC message handlers. Leverages LLM to generate semantically valid protocol messages.
-
Uncovering Hidden Paths in 5G: Protocol Tunneling and Network Boundary Bridging — ACM CCS 2025
New research on exploiting protocol tunneling in 5G networks to cross network boundaries and reach components that should be isolated.
-
BaseBridge: Over-the-Air and Emulation Testing for Cellular Baseband Firmware — IEEE S&P 2025
Bridges the gap between over-the-air and emulation-based testing for cellular baseband firmware analysis. Extends the FirmWire emulator.
-
From Control to Chaos: Formal Analysis of 5G Access Control — Penn State, IEEE S&P 2025
Comprehensive formal analysis of 5G’s access control mechanisms, uncovering critical vulnerabilities.
-
Devilray: Adversarial Model Revealing Blind Spots in Fake Base Station Detection — May 2026
Systematic adversarial baseline exploring realistic FBS evasion strategies. Evaluates 7 detectors and identifies gaps in coverage across 2,592 feasible FBS configurations.
-
GLaDoS: Location-aware Denial-of-Service of Cellular Networks — USENIX Security 2025
Location-aware DoS attacks targeting specific geographical areas in cellular networks.
-
Breaking 5G on The Lower Layer — 2026
Lower-layer exploitation research presenting SIB1 spoofing and Timing Advance manipulation attacks during random access procedures.
-
5G Network Slicing: Security Challenges, Attack Vectors, and Mitigation — PMC, July 2025
Comprehensive classification of attacks across orchestration, virtualization, and inter-slice communication layers in 5G.
-
Survey on 5G Physical Layer Security Threats and Countermeasures — MDPI Sensors, 2024
In-depth review of PHY layer attack surface in 4G/5G: jamming, spoofing, eavesdropping, pilot contamination, and current SDR-based research tooling.
-
SNI5GECT: Practical 5G Traffic Injection — USENIX Security 2025
Sniff and inject 5G messages without rogue base stations or jamming. Demonstrated 4G downgrade attacks within 20 meters of victim. GitHub
-
“NASty” 5G Baseband Vulnerabilities through Dependency-Aware Fuzzing — Black Hat USA 2025
Targeting Non-Access Stratum (NAS) layer vulnerabilities using dependency-aware fuzzing. Discovered security bypass using “!!FAKE-TESTHARNESS!!” message. Symbolic execution challenges with Samsung Shannon basebands requiring TB-level memory.
-
Budget-Friendly Baseband Fuzzing Setup — DefCon 32, Janne Taponen
Covers building cost-effective baseband fuzzing rigs using SDRs, using LLMs to accelerate protocol parser development, and testing automotive ECUs, payment terminals, and mobile devices.
-
RANsacked Fuzzing Framework — University of Florida / NC State, ACM CCS 2024
Domain-informed fuzzing approach targeting RAN-Core interfaces. Discovered 119 vulnerabilities across ten network implementations.
-
BaseBridge — IEEE S&P 2025
Framework that bridges over-the-air and emulation-based testing for cellular baseband firmware. Extends FirmWire.
-
FirmWire — NDSS 2022
Full-system baseband firmware emulation platform for Samsung and MediaTek. Discovered 8 remote memory corruptions including 3 pre-authentication RCE vulnerabilities.
-
CITesting: Systematic Testing of Context Integrity Violations in LTE Core Networks — ACM CCS 2025 (Distinguished Paper Award)
KAIST’s CITesting tool runs thousands of test cases against LTE core implementations, dwarfing the 31-case coverage of prior tooling (LTEFuzz). All four tested implementations contained CIV vulnerabilities.
-
Uncovering Hidden Paths in 5G: Protocol Tunneling and Network Boundary Bridging — ACM CCS 2025
-
5G Network Slicing: Security Challenges, Attack Vectors, and Mitigation Approaches — MDPI, July 2025
-
Starshields for iOS: Navigating the Security Cosmos in Satellite Communication — NDSS 2025
First comprehensive security analysis of Apple’s satellite communication features. Researchers reverse-engineered the proprietary protocol, demonstrated restriction bypasses, and built a simulation testbed covering Emergency SOS, Find My, roadside assistance, and iMessage over satellite.
-
RANsacked: A Domain-Informed Approach for Fuzzing LTE and 5G RAN-Core Interfaces — University of Florida / NC State, Jan 2025
119 vulnerabilities, 97 CVEs, across ten implementations. Any one enables city-wide disruption.
-
SNI5GECT: A Practical Approach to Inject aNRchy into 5G NR — USENIX Security 2025
-
GLaDoS: Location-aware Denial-of-Service of Cellular Networks — USENIX Security 2025
-
LLFuzz: LLM-Guided Baseband Firmware Fuzzing — KAIST, July 2025
LLM-guided fuzzing framework targeting MediaTek and Samsung Shannon basebands. Discovered 11 memory corruption vulnerabilities in NAS/RRC message handlers. Uses LLM to generate semantically valid protocol messages for improved coverage.
-
BaseBridge: Bridging Over-the-Air and Emulation Testing for Cellular Baseband Firmware — IEEE S&P 2025
-
From Control to Chaos: Formal Analysis of 5G Access Control — IEEE S&P 2025
评论