5G and Cellular Network Security#
USENIX Security '25 (34th USENIX Security Symposium) digest Program Adjacent pick 13–15 August 2025
Multiple papers/teams — see below — Adjacent
- Why: A dense cluster of 5G/cellular protocol-security papers this cycle — worth a combined mention as a vertical, even though cellular/RAN isn't explicitly named in the PM's core interests, because the architectural patterns (control/data-plane separation, standardized network functions) echo cloud-native networking design.
- What:
AKMA+(Singapore Management University et al.) finds and fixes vulnerabilities in 5G's Authentication and Key Management for Applications protocol while preserving standards compatibility.SNI5GECT(SUTD) sniffs and injects into pre-authentication 5G NR messages without a rogue base station, achieving 70–90% attack success within 20m.CoreCrisis(Penn State) is a stateful fuzzer that found 13 crashing and 7 spec-deviation vulnerabilities across three open-source and one commercial 5G core implementation.GLaDoS(ETH Zurich / Oxford) is a full-scale deployed system for geofenced cellular denial-of-service in sensitive areas, neutralizing 99.3% of connections across 100+ commercial cells. (from abstract only) - How: Varies by paper — protocol formal analysis (AKMA+), pre-auth sniff-and-inject (SNI5GECT), stateful black-box fuzzing with FSM learning (CoreCrisis), and combined overshadowing + localization (GLaDoS). (from abstract only)
- Where applicable: 5G core/RAN operators and equipment vendors specifically; GLaDoS is also relevant to physical-security/sensitive-facility contexts wanting legal, geofenced cellular control.