Boffins say tool can sniff 5G traffic, launch 'attacks' without using rogue base stations
(2025/08/18)
- Reference: 1755513906
- News link: https://www.theregister.co.uk/2025/08/18/sni5gect/
- Source link:
Security boffins have released an open source tool for poking holes in 5G mobile networks, claiming it can do up- and downlink sniffing and a novel connection downgrade attack - plus "other serious exploits" they're keeping under wraps, for now.
"Sni5Gect [is] a framework that sniffs messages from pre-authentication 5G communication in real-time," the researchers from the Singapore University of Technology and Design explained of their work, presented this week at the 34th USENIX security bash, "and injects targeted attack payload in downlink communication towards the UE [User Equipment, i.e. a phone]."
Designed to take advantage of the period just after a device connects to a 5G network and is still in the process of handshaking and authentication - which, the team points out, can occur when entering or leaving a lift, disembarking a plane and turning aeroplane mode off, or even passing through a tunnel or parking garage - Sni5Gect takes advantage of unencrypted messaging between the base station and a target handset.
[1]
"Since messages exchanged between the gNB [Next-Generation Node B, the base station] and the UE are not encrypted before the security context is established (pre-authentication state)," the researchers wrote, "an attacker does not require knowledge of the UE's credentials to sniff uplink/downlink [traffic] nor to inject messages without integrity protection throughout the UE connection procedure."
[2]
[3]
That's a flaw, and one the framework is designed to exploit. The team's testing showed it capable of sniffing both uplink and downlink traffic with more than 80 percent accuracy, at ranges of up to 20 meters between an off-the-shelf software-defined radio and the target mobile. For packet injection, the success rate varied between 70-90 percent - and delivered, among other things, proof of a novel downgrade attack by which a ne'er-do-well equipped with Sni5Gect could downgrade a connection from 5G to 4G to reduce its security and carry out further surveillance and attacks.
As Sni5Gect works in real-time, its creators have claimed, and can inject attack payloads, including multi-stage attacks, based on protocol state, it's suited to fingerprinting, denial-of-service attacks, and downgrading.
[4]
"To the best of our knowledge," they wrote in their [5]paper's introduction [PDF], "Sni5Gect is the first framework that empowers researchers with both over-the-air sniffing and stateful injection capabilities, without requiring a rogue gNB [base station]."
[6]The White House could end UK's decade-long fight to bust encryption
[7]Trump seeing green as he weighs deal to allow Nvidia Blackwell GPU sales to China
[8]The tiny tech tribe who could change the world tomorrow but won't
[9]Open source's superior security is a matter of eyeballs: Be kind to the brains behind them
Given the scope of the tool, the researchers communicated with the GSM Association (GSMA), the organization responsible for the 5G standard, prior to presenting their findings; the GSMA confirmed their discovery of the novel downgrade attack, which leans on the tool's ability to inject dynamically modified messages at different stages of the connection process, and assigned it CVD-2024-0096 under its common vulnerabilities and disclosures programme.
Some features limited to trusted pen testers
Not all of the capabilities claimed in the team's paper have been fully disclosed, however. The team has kept private "other serious exploits leveraging the framework," in order to "avoid abusing SNI5Gect to launch attacks against people's smartphones[s]." These exploits, it is claimed, will be made available only to "trusted institutions like universities and research institutions" upon application and verification of their legitimate interest.
The Sni5Gect framework itself is available in full, alongside the exploits discussed in the team's paper, [10]on GitHub , under the GNU Affero General Public Licence 3, with the disclaimer that it's "for research and educational purposes only" and that use on live networks "may violate local laws and regulations."
More information, including a link to the open-access paper, is available [11]on the project website . ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aKNOGQjFu5hWFzbG10m_5AAAABM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aKNOGQjFu5hWFzbG10m_5AAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aKNOGQjFu5hWFzbG10m_5AAAABM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aKNOGQjFu5hWFzbG10m_5AAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.usenix.org/system/files/usenixsecurity25-luo-shijie.pdf
[6] https://www.theregister.com/2025/08/12/could_the_white_house_put/
[7] https://www.theregister.com/2025/08/11/trump_seeing_green_as_he/
[8] https://www.theregister.com/2025/07/24/column_settings_standards/
[9] https://www.theregister.com/2025/07/22/open_source_windows_security_opinion_column/
[10] https://github.com/asset-group/Sni5Gect-5GNR-sniffing-and-exploitation
[11] https://asset-group.github.io/Sni5Gect-5GNR-sniffing-and-exploitation/
[12] https://whitepapers.theregister.com/
"Sni5Gect [is] a framework that sniffs messages from pre-authentication 5G communication in real-time," the researchers from the Singapore University of Technology and Design explained of their work, presented this week at the 34th USENIX security bash, "and injects targeted attack payload in downlink communication towards the UE [User Equipment, i.e. a phone]."
Designed to take advantage of the period just after a device connects to a 5G network and is still in the process of handshaking and authentication - which, the team points out, can occur when entering or leaving a lift, disembarking a plane and turning aeroplane mode off, or even passing through a tunnel or parking garage - Sni5Gect takes advantage of unencrypted messaging between the base station and a target handset.
[1]
"Since messages exchanged between the gNB [Next-Generation Node B, the base station] and the UE are not encrypted before the security context is established (pre-authentication state)," the researchers wrote, "an attacker does not require knowledge of the UE's credentials to sniff uplink/downlink [traffic] nor to inject messages without integrity protection throughout the UE connection procedure."
[2]
[3]
That's a flaw, and one the framework is designed to exploit. The team's testing showed it capable of sniffing both uplink and downlink traffic with more than 80 percent accuracy, at ranges of up to 20 meters between an off-the-shelf software-defined radio and the target mobile. For packet injection, the success rate varied between 70-90 percent - and delivered, among other things, proof of a novel downgrade attack by which a ne'er-do-well equipped with Sni5Gect could downgrade a connection from 5G to 4G to reduce its security and carry out further surveillance and attacks.
As Sni5Gect works in real-time, its creators have claimed, and can inject attack payloads, including multi-stage attacks, based on protocol state, it's suited to fingerprinting, denial-of-service attacks, and downgrading.
[4]
"To the best of our knowledge," they wrote in their [5]paper's introduction [PDF], "Sni5Gect is the first framework that empowers researchers with both over-the-air sniffing and stateful injection capabilities, without requiring a rogue gNB [base station]."
[6]The White House could end UK's decade-long fight to bust encryption
[7]Trump seeing green as he weighs deal to allow Nvidia Blackwell GPU sales to China
[8]The tiny tech tribe who could change the world tomorrow but won't
[9]Open source's superior security is a matter of eyeballs: Be kind to the brains behind them
Given the scope of the tool, the researchers communicated with the GSM Association (GSMA), the organization responsible for the 5G standard, prior to presenting their findings; the GSMA confirmed their discovery of the novel downgrade attack, which leans on the tool's ability to inject dynamically modified messages at different stages of the connection process, and assigned it CVD-2024-0096 under its common vulnerabilities and disclosures programme.
Some features limited to trusted pen testers
Not all of the capabilities claimed in the team's paper have been fully disclosed, however. The team has kept private "other serious exploits leveraging the framework," in order to "avoid abusing SNI5Gect to launch attacks against people's smartphones[s]." These exploits, it is claimed, will be made available only to "trusted institutions like universities and research institutions" upon application and verification of their legitimate interest.
The Sni5Gect framework itself is available in full, alongside the exploits discussed in the team's paper, [10]on GitHub , under the GNU Affero General Public Licence 3, with the disclaimer that it's "for research and educational purposes only" and that use on live networks "may violate local laws and regulations."
More information, including a link to the open-access paper, is available [11]on the project website . ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aKNOGQjFu5hWFzbG10m_5AAAABM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aKNOGQjFu5hWFzbG10m_5AAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aKNOGQjFu5hWFzbG10m_5AAAABM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aKNOGQjFu5hWFzbG10m_5AAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.usenix.org/system/files/usenixsecurity25-luo-shijie.pdf
[6] https://www.theregister.com/2025/08/12/could_the_white_house_put/
[7] https://www.theregister.com/2025/08/11/trump_seeing_green_as_he/
[8] https://www.theregister.com/2025/07/24/column_settings_standards/
[9] https://www.theregister.com/2025/07/22/open_source_windows_security_opinion_column/
[10] https://github.com/asset-group/Sni5Gect-5GNR-sniffing-and-exploitation
[11] https://asset-group.github.io/Sni5Gect-5GNR-sniffing-and-exploitation/
[12] https://whitepapers.theregister.com/
Incredible (but to be expected)
Flak
Quite crazy when you consider that mobile devices are likely to negotiate new encrypted sessions so regularly.
Probably so fundamental that an improved protocol to establish sessions is needed.
Re: Incredible (but to be expected)
Strahd Ivarius
6G or 7G, perhaps?
With a need to change all the network equipments to handle it?
Snee-five-ject...
Tron
...is a crap name. Plus why are they assisting crims in this way?
Re: Snee-five-ject...
Pascal Monett
Well, it's pretty simple.
When you can submit better code, you can name whatever you want.
Facepalm
The collective facepalm from intelligence services when this dropped must have sounded like a sonic boom. They’ve spent billions building bespoke interception systems, and now some grad students with an SDR and a GitHub repo have gift-wrapped a downgrade attack that works in a parking garage. The 5G marketing hype was all about security and resilience, but apparently the handshake is as fragile as a car Bluetooth pairing. Now the spooks have to decide whether to quietly thank the researchers for doing their job, or curse them for blowing the cover off vulnerabilities they were probably already abusing.