Attacks From a New Front Door in 4G & 5G Mobile Networks

This talk presents a security investigation of APIs exposing 4G and 5G mobile networks to IoT platforms, application developers, and external industries. It examines authentication, authorization, configuration, input validation, and business-logic weaknesses found across commercial providers, including risks to devices, customer data, and critical infrastructure.

Syllabus

Intro
General mobile network
Exposure via a provider
Drone control via network exposure
Control and configure the SIMS
How it works: Get device location
Misc functions
Attack model for network exposure
Commercial loT service platform security configurations
Platform design and forged access?
Guessable username and password policies for API authentication
Token management
Lack of rate limiting for API requests
Private identifiers used in apps domain
Verbose error messages
Firewall vs secure API-by-design
Malware propagation inside user plane
Internal node exposure
Broken authorization while sending downlink message
Access control misconfiguration
Script Injection
XSS execution
Summary of security analysis