{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,10]],"date-time":"2026-03-10T14:57:36Z","timestamp":1773154656759,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":57,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3765206","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:33:16Z","timestamp":1763854396000},"page":"231-245","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Uncovering Hidden Paths in 5G: Exploiting Protocol Tunneling and Network Boundary Bridging"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2657-6975","authenticated-orcid":false,"given":"Altaf","family":"Shaik","sequence":"first","affiliation":[{"name":"Technische Universit\u00e4t Berlin, Berlin, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-5115-761X","authenticated-orcid":false,"given":"Robert","family":"Jaschek","sequence":"additional","affiliation":[{"name":"Technische Universit\u00e4t Berlin, Berlin, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5372-4825","authenticated-orcid":false,"given":"Jean-Pierre","family":"Seifert","sequence":"additional","affiliation":[{"name":"Technische Universit\u00e4t Berlin, Berlin, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2024. 3GPP TS 38.413 V18.3.0: NG-RAN; NG Application Protocol (NGAP). Technical Report TS 38.413. 3GPP. https:\/\/www.3gpp.org\/ftp\/Specs\/archive\/38_series\/38. 413\/38413-g30.zip Release 18."},{"key":"e_1_3_2_1_2_1","unstructured":"2024. IR.88 EPS Roaming Guidelines Version 28.0. Technical Report. GSMA. https:\/\/www.gsma.com\/newsroom\/wp-content\/uploads\/\/IR.88-v28.0.pdf"},{"key":"e_1_3_2_1_3_1","unstructured":"27Robert99. 2025a. [Bug] UPF Crash Due to Exceeding PFCP Session Limit 3964. https:\/\/github.com\/open5gs\/open5gs\/issues\/3964. Accessed: 2025-09-09."},{"key":"e_1_3_2_1_4_1","unstructured":"27Robert99. 2025b. UPF Crash on Empty PFCP Session Establishment Request 927. https:\/\/github.com\/omec-project\/upf\/issues\/927. Accessed: 2025-09-09."},{"key":"e_1_3_2_1_5_1","unstructured":"3GPP. 2023. System Architecture for the 5G System (Release 17). Technical Report TS 23.501. 3rd Generation Partnership Project (3GPP). https:\/\/www.3gpp.org\/ftp\/Specs\/archive\/23_series\/23.501\/."},{"key":"e_1_3_2_1_6_1","volume-title":"Technical Specification Group Core Network and Terminals","author":"Generation Partnership","unstructured":"3rd Generation Partnership Project (3GPP). 2023. Technical Specification Group Core Network and Terminals; GPRS Tunnelling Protocol User Plane (GTPv1-U) (3GPP TS 29.281 version 18.3.0 Release 18). Technical Specification TS 29.281. 3GPP. https:\/\/www.3gpp.org\/ftp\/Specs\/archive\/29_series\/29.281\/ Accessed: 2025-02-14."},{"key":"e_1_3_2_1_7_1","unstructured":"3rd Generation Partnership Project (3GPP). 2024. TS 33.501: Security architecture and procedures for 5G System (5GS). Technical Report 33.501. 3rd Generation Partnership Project (3GPP). https:\/\/www.3gpp.org\/ftp\/Specs\/archive\/33_series\/33.501\/33501-g40.zip 3GPP TS 33.501 version 18.4.0 Release 18."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1186\/s13638-022-02204-5"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670320"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3448300.3467826"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11235-023-01018-0"},{"key":"e_1_3_2_1_12_1","unstructured":"Patrick Donegan. 2011. IPsec Deployment Strategies for Securing LTE Networks. White Paper. Heavy Reading. https:\/\/go.radisys.com\/rs\/radisys\/images\/paper-seg-ipsec-deployment.pdf Commissioned by Radisys."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3495243.3560525"},{"key":"e_1_3_2_1_14_1","unstructured":"ETSI. 2024. ETSI TS 129 244. Technical Standard 129 244. ETSI. https:\/\/www.etsi.org\/deliver\/etsi_ts\/129200_129299\/129244\/18.06.00_60\/ts_129244v180600p.pdf Version 18.6.0 Release 18 (2024-07)."},{"key":"e_1_3_2_1_15_1","unstructured":"Ettus Research. 2023. USRP B210: Universal Software Radio Peripheral. https:\/\/web.archive.org\/web\/20230901000000\/https:\/\/www.ettus.com\/all-products\/usrp-b210\/. Accessed: 2025-04-12."},{"key":"e_1_3_2_1_16_1","unstructured":"FD.io Project. 2024. Vector Packet Processing (VPP). https:\/\/fd.io\/. Accessed: 2025-04-12."},{"key":"e_1_3_2_1_17_1","unstructured":"FGSecT. 2023. scat. https:\/\/github.com\/fgsect\/scat. Accessed: 2025-04-12."},{"key":"e_1_3_2_1_18_1","unstructured":"free5GC Project. 2024. free5GC: An Open Source 5GC Implementation. https:\/\/www.free5gc.org\/. Accessed: 2025-04-12."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/2444776.2444779"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23118"},{"key":"e_1_3_2_1_21_1","unstructured":"HaxRob. 2024. GTPDoor: A Novel Backdoor Tailored for Covert Access Over the Roaming Exchange. https:\/\/haxrob.net\/gtpdoor-a-novel-backdoor-tailored-for-covert-access-over-the-roaming-exchange\/ Accessed: 2025-04-12."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.34"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354263"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813718"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00038"},{"key":"e_1_3_2_1_26_1","unstructured":"Sukchan Lee. 2023. Support - Open5GS. https:\/\/web.archive.org\/web\/20230930053106\/https:\/\/open5gs.org\/open5gs\/support\/. Accessed: 2025-04-12."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/2565585.2565599"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813618"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3448300.3467817"},{"key":"e_1_3_2_1_30_1","unstructured":"MITRE. 2025a. FiGHT Framework Discover TEID. https:\/\/fight.mitre.org\/techniques\/FGT5031\/ Accessed: 2025-04-14."},{"key":"e_1_3_2_1_31_1","unstructured":"MITRE. 2025b. FiGHT Framework Network Boundary Bridging. https:\/\/fight.mitre.org\/techniques\/FGT1599 Accessed: 2025-01-09."},{"key":"e_1_3_2_1_32_1","unstructured":"MITRE. 2025c. FiGHT Framework Protocol Tunneling. https:\/\/fight.mitre.org\/techniques\/FGT1572 Accessed: 2025-01-09."},{"key":"e_1_3_2_1_33_1","unstructured":"MITRE. 2025d. MITRE FiGHT Framework. https:\/\/fight.mitre.org\/ Accessed: 2025-01-09."},{"key":"e_1_3_2_1_34_1","unstructured":"ONF Aether Project. 2024a. Aether SD-Core: Cloud-Native 5G Core for Private Networks. https:\/\/opennetworking.org\/aether\/. Accessed: 2025-04-12."},{"key":"e_1_3_2_1_35_1","unstructured":"ONF Aether Project. 2024b. ARAFest: The Edge Automation Festival. https:\/\/aetherproject.org\/wp-content\/uploads\/sites\/11\/2024\/09\/ARAFest.pdf. Accessed: 2025-04-12."},{"key":"e_1_3_2_1_36_1","unstructured":"Open5GS Project. 2024. Open5GS: Open Source 5G and EPC Core Network. https:\/\/open5gs.org\/. Accessed: 2025-04-12."},{"key":"e_1_3_2_1_37_1","unstructured":"OpenAirInterface. n.d.. OSA Members - OpenAirInterface. https:\/\/web.archive.org\/web\/20231226212507\/https:\/\/openairinterface.org\/osa-members\/. Accessed: 2025-04-12."},{"key":"e_1_3_2_1_38_1","unstructured":"OpenAirInterface Software Alliance. 2024. OAI 5G Core Network. https:\/\/openairinterface.org\/oai-5g-core-network\/. Accessed: 2025-04-12."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108137"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382220"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660346"},{"key":"e_1_3_2_1_42_1","unstructured":"Positive Technologies. 2017. GTP Protocol Vulnerabilities: Risk of Subscriber Data Interception and Fraud. Technical Report. Positive Technologies. https:\/\/www.gsma.com\/get-involved\/gsma-membership\/wp-content\/uploads\/2017\/09\/Positive-Technologies-White-Paper.pdf White Paper."},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24283"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00006"},{"key":"e_1_3_2_1_45_1","unstructured":"Salim S. I. 2023a. Attacks on 5G Infrastructure From Users' Devices. https:\/\/www.trendmicro.com\/en_us\/research\/23\/i\/attacks-on-5g-infrastructure-from-users-devices.html"},{"key":"e_1_3_2_1_46_1","unstructured":"Salim S. I. 2023b. A Deep Dive into the Packet Reflection Vulnerability Allowing Attackers to Plague Private 5G Networks textbar Trend Micro (US). https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/internet-of-things\/plague-private-5g-networks"},{"key":"e_1_3_2_1_47_1","unstructured":"SecurityGen. 2023. GTP Firewall Whitepaper. https:\/\/security-gen.com\/SecurityGen-whitepaper-gtp-firewall.pdf Industry analysis of GTP firewall deployments."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23236"},{"key":"e_1_3_2_1_49_1","unstructured":"Salim S.I. 2023. Attacks on 5G Infrastructure From User Devices: ASN. 1 Vulnerabilities in 5G Cores. https:\/\/www.trendmicro.com\/en_us\/research\/23\/j\/asn1-vulnerabilities-in-5g-cores.html Section: research."},{"key":"e_1_3_2_1_50_1","unstructured":"Software Radio Systems (SRS). 2024. srsRAN Project: Open Source 4G and 5G Radio Access Network Software. https:\/\/www.srsran.com\/. Accessed: 2025-04-12."},{"key":"e_1_3_2_1_51_1","unstructured":"Sysmocom GmbH. 2023. sysmoISIM-SJA5: 5G-Ready Programmable SIM Card. https:\/\/web.archive.org\/web\/20230901000000\/https:\/\/shop.sysmocom.de\/products\/sysmoisim-sja5. Accessed: 2025-04-12."},{"key":"e_1_3_2_1_52_1","unstructured":"The BESS Project. 2024. Berkeley Extensible Software Switch (BESS). https:\/\/bess.nu\/. Accessed: 2025-04-12."},{"key":"e_1_3_2_1_53_1","unstructured":"Kuo-Hui Tsai Chih-Cheng Lin and Po-Ching Lin. 2023. Machine Learning Based GTP Traffic Analysis for Anomaly Detection. Technical Report. SSRN Preprint. https:\/\/papers.ssrn.com\/sol3\/papers.cfm?abstract_id=5031398"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/2018436.2018479"},{"key":"e_1_3_2_1_55_1","first-page":"303","volume-title":"2024 USENIX Annual Technical Conference (USENIX ATC 24)","author":"Wen Zhixin","year":"2024","unstructured":"Zhixin Wen and Guanhua Yan. 2024. HiP4-UPF: Towards High-Performance Comprehensive 5G User Plane Function on P4 Programmable Switches. In 2024 USENIX Annual Technical Conference (USENIX ATC 24). USENIX Association, Santa Clara, CA, 303-320. https:\/\/www.usenix.org\/conference\/atc24\/presentation\/wen"},{"key":"e_1_3_2_1_56_1","first-page":"55","volume-title":"Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE. In 28th USENIX Security Symposium (USENIX Security 19)","author":"Yang Hojoon","year":"2019","unstructured":"Hojoon Yang, Sangwook Bae, Mincheol Son, Hongil Kim, Song Min Kim, and Yongdae Kim. 2019. Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE. In 28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA, 55-72. https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/yang-hojoon"},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00028"}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","location":"Taipei Taiwan","acronym":"CCS '25","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3765206","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:16:55Z","timestamp":1766441815000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3765206"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":57,"alternative-id":["10.1145\/3719027.3765206","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3765206","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}