GTP-C abuse — tunnel hijacking, location tracking

GTP-C — The Long-Standing Vulnerability

GTP-C (GPRS Tunneling Protocol — Control) has been a major signaling-layer attack vector for decades. In 4G EPC, GTP-C carries session establishment, modification, and release between MME, SGW, and PGW. In 5G non-standalone (NSA) and during 4G/5G interworking, GTP-C continues to flow. The historical vulnerability: GTP-C messages lacked authentication. An attacker with access to the interconnect could forge messages that manipulated session state — redirecting tunnels, modifying QoS, even deleting sessions. The GSMA recommends strong perimeter security and IPsec for interconnect GTP-C, but…