The 5G attack surface — SBI, signaling, RAN, radio

Four Distinct Attack Surfaces

A 5G deployment exposes four major attack surfaces, each with different threat profiles and SOC visibility. SBI (Service-Based Interface) — HTTP/2-based service interactions between NFs in the 5GC. Threats: replay, NF impersonation, token reuse, malformed-request flooding, NRF abuse. SOC has strong visibility through NF access logs and HTTP/2 traffic capture. Signaling — control-plane protocols carrying mobility, session, and authentication messages: NGAP (UE↔AMF), NAS (UE↔core), GTP-C (interfaces between EPC NFs and to 5GC), Diameter (4G control plane and 5G interworking), SS7 (legacy…