SNI5GECT - A Practical Approach to Inject aNRchy into 5G NR

Explore a groundbreaking cybersecurity research presentation that introduces SNI5GECT, an innovative framework designed to exploit vulnerabilities in 5G New Radio (NR) networks through real-time message sniffing and targeted attack payload injection. Learn how this third-party communication framework operates by silently intercepting pre-authentication 5G messages and tracking protocol states during user equipment (UE) attach procedures, enabling sophisticated downlink attacks without requiring a rogue base station. Discover the comprehensive evaluation methodology conducted across five 5G-enabled UE devices using both open-source srsRAN and commercial Effnet base stations, revealing over 80% accuracy in bidirectional sniffing and 70-90% success rates for message injection at distances up to 20 meters. Examine the framework's capability to execute various attack vectors including UE crashes, connection downgrades to lower generations, and identity extraction with success rates exceeding 70% for known UE distances. Understand the discovery and implications of a novel multi-stage downgrade attack that leverages the SNI5GECT framework, which has been acknowledged by GSMA and assigned a coordinated vulnerability disclosure identity. Gain insights into how this practical tool serves as a complementary resource for evaluating current and emerging 5G security threats in real-world environments, presented by researchers from Singapore University of Technology and Design at the USENIX Security Symposium.