4G/LTE Cellular Attacks

• BaseSAFE: Baseband SAnitized Fuzzing through Emulation
• Forcing a targeted LTE Cellphone Into an Eavesdropping Network
• Hacking Cellular Networks
• White-Stingray: Evaluating IMSI Catchers Detection Applications
• LTE/LTE-A Jamming, Spoofing, and Sniffing - Assessment and Mitigation
• Using OpenBTS - "Experimental_Security_Assessment_of_BMW_Cars by KeenLab"
• LTE Security – How Good Is It?
• Small Tweaks do Not Help: Differential Power Analysis of MILENAGE Implementations in 3G/4G USIM Cards
• 4G Access Level Security Assessment
• LTE security and protocol exploits
• LTE Recon - (Defcon 23)
• LTE Pwnage: Hacking HLR/HSS and MME CoreNetwork Elements
• Modmobjam - Jam tomorrow, jam yesterday, but also jam today
• WiFi IMSI Catcher
• Demystifying the Mobile Network by Chuck McAuley
• NSA PLAYSET GSM

5G Cellular Attacks

• Privacy Attacks to the 4G and 5G Cellular Paging Protocols Using Side Channel Information
• QCSniper - A tool For capture 2g-4g air traffic using qualcomm phones

5G Cellular Attacks (Soon to be updated)

• European 5G Security in the Wild: Reality versus Expectations
• Threat modeling framework for mobile communication system
• Privacy Attacks to the 4G and 5G Cellular Paging Protocols Using Side Channel Information
• New Privacy Threat on 3G, 4G, and Upcoming 5G AKA Protocols

📚 Additional Reading

Legal & Regulatory

• Analyzing GSM Downlink with USRP
• Demystifying Mobile Networks

⚔️ Attack Vectors

5G Security Research

• New Vulnerabilities in 5G Networks
• European 5G Security in the Wild
• 5G Threat Modeling Framework
• New Privacy Threat on 3G, 4G, and Upcoming 5G AKA Protocols

LTE/4G Security Research

• LTRACK: Stealthy Mobile Phone Tracking
• Detecting Fake 4G Base Stations
• Paging Storm Attacks against 4G/LTE Networks
• LTE Public Warning System Attacks
• Hacking Public Warning System in LTE
• Analysis of the LTE Control Plane
• Baseband Attacks: Remote Exploitation
• Hiding in Plain Signal: Physical Signal Overshadowing
• LTE Security Disabled—Misconfiguration in Commercial Network
• All The 4G Modules Could Be Hacked
• BaseSAFE: Baseband Fuzzing

Radio Jamming Attacks

• NIST SP 800-187

Attack Vectors

5G Security Research

• Privacy Attacks on 4G/5G Paging Protocols

LTE/4G Security Research

• New Vulnerabilities in 4G and 5G Cellular Access Network Protocols
• Full Chain Baseband Exploits - click RCE in baseband and Android runtime
• Unburdened By What Has Been: Exploiting L2 for Baseband RCE on Samsung Exynos - 2023-41111, CVE-2023-41112

Overshadowing Attacks (2024-2026)

• AdaptOver: Adaptive Overshadowing Attacks

Automotive and Industrial Cellular

Security Advisories

• Security Analysis of LTE Connectivity in Connected Cars: Tesla Case Study

🚗 Automotive & Industrial Cellular

Security Alerts & Advisories

• V2X Security Research - Vehicle-to-everything communications
• Cellular-V2X Attack Vectors - Automotive cellular security

Cellular IoT and NB-IoT Security

Security Advisories

• Monitoring 5G Core Networks Vulnerabilities With eBPF

📱 Cellular IoT & NB-IoT Security

Security Alerts & Advisories

• NB-IoT Security Analysis Framework - Narrowband IoT security research

CERT/Media Alerts

• Voice over LTE implementations contain multiple vulnerabilities - CERT ALERT

Community

Conferences and Competitions

• OffensiveCon
• Pwn2Own Ireland - focused; $100K for baseband RCE exploits
• CanSecWest
• NDSS

Conferences to Follow

• DEF CON
• Black Hat USA/Europe
• WiSec

IRC and Chat

• DEF CON RF Village
• Osmocom IRC - time support for Osmocom tools

Mailing Lists and Forums

• Osmocom Mailing Lists
• srsRAN Discussions
• OpenAirInterface Forum
• Reddit r/RTLSDR
• Reddit r/cellmapper

Notable Researchers and Organizations to Follow

• Website
• GitHub
• Twitter
• Website
• Twitter
• Website
• Website

🎤 Conference Talks

Additional Conference Resources

• Side Channel Analysis in 4G and 5G
• RF Exploitation: IoT/OT Hacking with SDR
• Bye-Bye-IMSI-Catchers
• NSA PLAYSET GSM

Black Hat 2021

• Over The Air Baseband Exploit: 5G RCE
• Technical White Paper

Black Hat 2022

• Attacks from a New Front Door in 4G & 5G Networks

Black Hat 2024

• 5G Baseband Vulnerability Research by Penn State

DefCon 32 (2024)

• Economizing Mobile Network Warfare: Budget-Friendly Baseband Fuzzing

TROOPERS 2013

• Dirty Use of USSD Codes in Cellular Networks

Conference Talks

Black Hat Asia 2026

• Qualcomm BootROM Vulnerability (CVE-2026-25262)

Black Hat USA 2025

• Slides
• Uncovering Threats and Exposing Vulnerabilities in Next-Gen Cellular RAN

DEF CON 32 (August 2024)

• RF Attacks on Aviation's Defense Against Mid-Air Collisions

DEF CON 33 (August 2025)

• Gateways to Chaos: How We Proved Modems Are a Ticking Time Bomb - Lin "Steven Meow" Yu, Trend Micro
• Hacking Hotspots: Pre-Auth RCE and Arbitrary SMS on 4G/5G Routers

OffensiveCon 2025

• No Signal, No Security: Dynamic Baseband Vulnerability Research
• Mobile Network Attacks: Exploiting Smartphones Through Baseband

USENIX Security 2023

• BASECOMP: A Comparative Analysis for Integrity Protection in Cellular Baseband Software

Detection and Defense

Protection from Stingrays and IMSI Catchers

• Documentation - rayhunter-new-open-source-tool-eff-detect-cellular-spying)

🛡️ Detection & Defense

IMSI Catcher Detection & Research

• SeaGlass Research Paper
• SeaGlass: City-Wide IMSI-Catcher Detection
• White-Stingray Detection App Evaluation

🚨 Protection from Stingrays & IMSI Catchers

• CellGuard - NEW 2024 🔥
• Website & Documentation
• TestFlight Beta

📊 Equipment & Hardware

Research Equipment Used in "Over The Air Baseband Exploit"

• Product Page
• GitHub
• Project Page
• Tutorial
• GitHub
• Play Store

🔍 Forensics & Investigation

Security Alerts & Advisories

• XRY Mobile Forensics - Commercial cellular forensics platform
• Cellebrite UFED - Mobile device extraction tools
• MSAB Cellular Evidence Analysis - Network evidence collection
• NIST Mobile Forensics Guidelines - Mobile device forensics standards
• Cellebrite UFED - Mobile device extraction tools

Getting Started

Key Concepts to Understand First

• IMSI, IMEI, TMSI
• AKA Protocol
• AKA Protocol

🔧 Hardware Setup

SDR Hardware Options

• Ettus
• Ettus
• Nuand
• Nuand
• Nuand
• GSG
• GSG
• Lime Micro
• Lime Micro
• Lime Micro
• Lime Micro
• Analog Devices
• RTL-SDR
• RTL-SDR
• Airspy
• SDRplay
• Red Pitaya

🌍 International Research

Stingray/IMSI Catchers

• China Mobile Security Research - Chinese cellular security papers
• European Cybersecurity Agency (ENISA) 5G Reports - EU 5G security assessments
• Korean KISA Mobile Security - Korean mobile security research
• Japanese 5G Security Guidelines - Japan cybersecurity strategy

International Research

CVE Resources

• Penn State SyNSec Lab
• ASSET Research Group (Singapore)

Stingray / IMSI Catchers

• KAIST SysSec Lab

[JAMMING SPECIFC ATTACKS](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-187.pdf)

• srsENB
• CoIMS

⚖️ Legal Notice

Legal & Regulatory

• @W00t3k

Misc

• AT&T Microcell FAIL - fail0verflow (Older blog article, but still a good read)

🌐 Network Slicing & Edge Security

Security Alerts & Advisories

• 5G Network Slicing Attack Research - IEEE research papers
• Multi-Access Edge Computing (MEC) Vulnerabilities - ETSI MEC security specs
• Network Function Virtualization (NFV) Attacks - Virtual network function security

🆕 Recent CVEs & Updates

Stingray/IMSI Catchers

• CVE Database Search - Search for cellular-related vulnerabilities
• Project Zero Cellular Security Research - Google's ongoing mobile security research
• SIMjacker and Simswap Updates - Evolution of SIM-based attacks

🆕 Recent Updates (2024-2025)

Latest Base Station Software & Tools

• LimeNET CrowdCell - in-a-box solution with integrated LimeSDR for small cell deployments
• Amarisoft LTEENB/gNB - grade LTE/5G NR base station software
• DragonOS - based SDR distribution with preinstalled cellular tools
• Magma Core Network

🏢 Private 5G Network Security

Security Alerts & Advisories

• O-RAN Security Research - Open RAN security specifications
• Campus 5G Security Assessment - NIST private 5G security guidance

Private 5G Network Security

Security Advisories

• O-RAN Alliance Security Update 2025
• O-RAN Security Risks and Vulnerabilities
• Open RAN: Attack of the xApps - RT RIC vulnerabilities
• End-to-End O-RAN Security Architecture
• Security Implications of 5G Communication in Industrial Systems

Recent CVEs and Updates

2024-2025 Notable CVEs

• CVE-2024-55568
• CVE-2024-25073
• CVE-2025-58349
• Open5GS CVEs (2024-2025)

2026 Notable CVEs

• CVE-2026-21385
• MediaTek March 2026 Bulletin - 2026-20423 through CVE-2026-20445 affecting MT7902, MT7920, MT7921, MT7922, MT7925, MT7927

CVE Resources

• Free5GC CVEs

Recent Updates (2024-2025)

New Research (2025)

• RANsacked: 100+ Flaws in LTE and 5G Implementations
• CITesting: Context Integrity Violations in LTE Core Networks
• Uncovering Hidden Paths in 5G: Protocol Tunneling and Network Boundary Bridging
• BaseBridge: Over-the-Air and Emulation Testing for Cellular Baseband Firmware
• 5G Network Slicing: Security Challenges, Attack Vectors, and Mitigation
• Survey on 5G Physical Layer Security Threats and Countermeasures

Recent Updates (2024-2026)

Base Station Software and Tools (Updated)

• DragonOS - based SDR distro with cellular tools pre-installed; supports RTL-SDR, HackRF, LimeSDR, BladeRF; latest release is DragonOS Noble (24.04). Website
• WarDragon - enhanced cellular survey capabilities; integrates with TAK; includes Ransack for multi-RAT survey
• Ransack - RAT cellular survey/recon platform; unifies LTE/5G NR/GSM/NB-IoT observations from SDRs, Qualcomm phones, and Rayhunter into SQLite with REST API

New Research (2024)

• Hermes: Unlocking Security Analysis of Cellular Network Protocols
• GitHub
• CellularLint: Identifying Inconsistent Behavior in Cellular Network Specifications
• GitHub
• Logic Gone Astray: Security Analysis of 5G Basebands
• ASTRA-5G: Automated Over-the-Air Security Testing
• Research Paper

New Research (2025-2026)

• SNI5GECT: Sniffing and Injecting 5G Traffic Without Rogue Base Stations
• GitHub
• 5Gone: Uplink Overshadowing Attacks in 5G-SA
• Kairos: Timing-Induced Interaction Failures in LTE and 5G Core Networks
• LLFuzz: LLM-Guided Baseband Firmware Fuzzing
• BaseBridge: Over-the-Air and Emulation Testing for Cellular Baseband Firmware
• From Control to Chaos: Formal Analysis of 5G Access Control
• Devilray: Adversarial Model Revealing Blind Spots in Fake Base Station Detection
• GLaDoS: Location-aware Denial-of-Service of Cellular Networks
• Breaking 5G on The Lower Layer

📚 Research Papers

2024 Research

• 5GBaseChecker Tool Release - Penn State University

NDSS 2025

• Starshields for iOS: Navigating the Security Cosmos in Satellite Communication

Research Papers

2019-2022

• FirmWire: Transparent Dynamic Analysis for Cellular Baseband Firmware

2024

• Catch You Cause I Can: Busting Rogue Base Stations using CellGuard
• The Impact of IMSI Catcher Deployments on Cellular Network Security

2025

• SNI5GECT: A Practical Approach to Inject aNRchy into 5G NR

2026

• Security Overview and Analysis of 3GPP 5G MAC CE
• Semantics Over Syntax: Uncovering Pre-Authentication 5G Baseband Vulnerabilities

🔗 Resources

Development & Analysis Tools

• RFSec-ToolKit - RF security testing tools
• MCC-MNC Database - Mobile Country/Network Code reference