NRF abuse and false-NF registration

The False-NF Registration Threat

In a 5GC deployment, NRF maintains a registry of all NFs. When SMF needs to call AUSF, it queries NRF and gets back a list of registered AUSF instances. If an attacker can register a malicious NF with NRF, that NF becomes part of the discovery pool. Other NFs will route some calls to it. Consequences: traffic interception (the malicious NF sees real subscriber authentication or session data); traffic manipulation (the malicious NF can return crafted responses that cause downstream failure or expose data); denial of service (the malicious NF can drop or delay requests); information gathering…