The fifth generation of cellular networks, 5G, is reshaping not just connectivity, but entire industries. Powering everything from autonomous vehicles to remote surgery, immersive AR/VR, and the rapidly expanding Internet of Things. But as 5G grows in scale and complexity, so do its risks and its attractiveness as a target for cyber adversaries.
How can researchers, operators, and vendors truly understand and secure this new digital backbone? The answer lies at the intersection of rigorous protocol analysis, actionable threat frameworks like MITRE FiGHT, and cutting-edge automated security testing platforms like Penzzer.
This post is your deep-dive guide to:
5G is far more than an incremental upgrade from 4G/LTE. Its new radio technology (NR), virtualized core networks, and "service-based" architecture are enabling critical infrastructure to move into the wireless domain for the first time.
But all this expansion means more to attack. New interfaces, protocols, and third-party integrations create new vulnerabilities - often in code or configurations that have never been tested at this scale.
5G is unique in that its ecosystem is driven not by a single standards body, but by a collaboration between telecommunications, networking, and Internet communities.
While 3GPP defines the mobile stack, it frequently relies on or references IETF standards for the underlying networking and security transport:
To secure 5G, we must understand how its protocols work—and where their complexity can be abused. Let’s break down three essential protocol layers and their critical fields.
The RRC protocol is fundamental to the interaction between a device (UE) and the 5G radio network. It governs everything from device registration to mobility, security setup, and bearer management.
Key Fields:
RRCConnectionRequest, RRCConnectionSetup, RRCConnectionReconfiguration, etc.)emergency, highPriorityAccess, mo-Signalling, etc.)Security Implication:
Improper handling of message types or unexpected values in establishment cause can lead to denial of service or unauthorized network access. Attackers might exploit edge-case field values or unexpected message sequences.
NAS sits between the user equipment (UE) and the core network, responsible for session management, authentication, and mobility.
Key Fields:
Registration Request, Authentication Request, Security Mode Command)initialRegistration, mobilityRegistrationUpdating)SUCI, GUTI, IMEISV)Plain, Integrity protected, Ciphered)Security Implication:
If an implementation mishandles unexpected message types or malformed mobile identity fields, attackers could bypass authentication, downgrade security, or trigger state confusion in the core.
GTP-U tunnels user data across the 5G core, linking radio and service gateways.
Key Fields:
G-PDU, End Marker)Security Implication:
Incorrect TEID handling can allow session hijacking, while flaws in flag parsing can trigger crashes or privilege escalation.
Each protocol field has a defined set of valid values - but often, security flaws are triggered by values that are:
These are precisely the issues that modern fuzzers target, surfacing vulnerabilities that static analysis or conformance tests will miss.
Traditional telecom security has relied on proprietary knowledge and vendor-specific incident reports. But with 5G, the attack surface is so broad—and the stakes so high—that the world needs a unified, open threat model. That’s where MITRE FiGHT comes in.
FiGHT™ (5G Hierarchy of Threats) is a comprehensive, open knowledge base of adversary Tactics and Techniques for 5G systems, curated by the MITRE Corporation. Modeled after the famous MITRE ATT&CK® framework, FiGHT catalogs how real or theoretical adversaries can compromise, disrupt, or exploit 5G networks.
FiGHT Technique Categories:
Each technique is labeled by category, giving defenders clarity on what’s possible, what’s been demonstrated, and what’s already happening.
Like ATT&CK, FiGHT is organized into Tactics (the "why") and Techniques (the "how"). Example tactics include:
Techniques under these tactics span everything from SIM-jacking and signaling abuse, to protocol fuzzing and service API exploitation.
FiGHT serves as the foundation for threat-informed defense in 5G, allowing security teams to:
Importantly: FiGHT is a living framework, evolving as new threats are discovered. MITRE invites contributions from the global telecom, research, and security communities.
Threat frameworks like FiGHT are only valuable if organizations can turn their intelligence into concrete, actionable testing. That’s where Penzzer delivers unique value.
Let’s map some of the top needs highlighted by FiGHT and show how Penzzer meets or exceeds them:
Penzzer operationalizes the "threat-informed defense" philosophy. While most fuzzers focus only on protocol conformance, Penzzer’s threat-aware fuzzing aligns with FiGHT to prioritize the highest-risk, most adversary-relevant scenarios. This means fewer wasted cycles and more impactful discoveries.
To illustrate how this threat-informed approach works in practice, let’s walk through how Penzzer could be used to test a 5G Registration procedure, a prime target in MITRE FiGHT.
FiGHT Example Technique:
Exploit malformed NAS Registration Request to trigger state confusion or DoS.
Registration Type, Mobile Identity, Security Header
Registration Type (e.g., out-of-range values, reserved codes).Mobile Identity fields with malformed lengths, encodings, or value overflows.Security Header values to test handling of improperly protected or ciphered messages.
This approach reveals not just if a vulnerability exists, but which adversary behaviors it enables. Organizations can prioritize remediation, detection engineering, and incident response directly based on FiGHT's real-world threat modeling.
5G is a leap forward in technology and opportunity but also in complexity and risk. The traditional security playbook is no longer sufficient. Threats are evolving faster than ever, and attackers are innovating just as quickly as vendors.
By combining:
… the security community can finally keep pace.
Identify security flaws before attackers do, automatically and at scale with Penzzer's intelligent fuzzing engine.
Unified Automotive and IoT Security Testing Tool
Accelerate Vulnerability Detection with Pen Testing and Dynamic Fuzzing
Find and fix vulnerabilities fast, only Penzzer unifies pen testing and dynamic fuzzing to meet compliance standards
Uncover hidden vulnerabilities in your IoT/automotive systems 5x faster than manual testing.
