PaperlayerView exact revision on arXiv

Source-linked AI summary

Security evaluation of 6G-oriented and O-RAN networks through targeted attacks

Apostolos Valiakos, Dimitrios Psaltis, Alexios Lekidis, Nikolaos Kekatos, Elpiniki Papageorgiou

arXiv:2610.33526v1cs.CRcs.NI

TL;DR

Insufficient protection for O-RAN midhaul interfaces expands the attack surface, with particular relevance to private 5G and 6G-oriented deployments. This paper evaluates a targeted F1 attack in a virtualized O-RAN testbed, demonstrating plaintext OCPP interception under the tested configuration. The result is scoped to unprotected F1 transport and disabled user-plane ciphering.

  • Problem

    O-RAN’s exposed IP-based interfaces can be vulnerable when insufficiently protected, and the security implications matter in critical infrastructure scenarios such as EV charging.

    Source: §I · p. 1

  • Method

    The paper evaluates an F1 midhaul attack in a virtualized O-RAN testbed, disrupting the legitimate O-DU association and introducing a rogue O-DU using observed configuration parameters.

    Source: §I · p. 1, D. F1 Spoofing and Introduction of a… · p. 3

  • Results

    Plaintext OCPP payloads were intercepted at F1-U in the evaluated configuration with user-plane ciphering disabled and F1 transport unprotected.

    Source: §I · p. 1, B. User Plane Interception and Data… · p. 5

  • Takeaways & Limitations

    In EV-charging environments, an underlying RAN compromise can expose operational data, authentication identifiers, and metering information.

    Source: §I · p. 1

    The attack’s stated scope assumes unprotected F1-C and F1-U transport and disabled PDCP ciphering; it makes no claim of success when the specified protections are enforced.

    Source: A. Attacker Model and Scope · p. 2

Abstract

from arXiv · show

The sixth generation (6G) of networks is supported by increased bandwidth, automation through the use of O-RAN technologies. Simultaneously though autonomous operation leads to an extensive threat surface and sophisticated attacks. Understanding the attack impact, the Tactics, Techniques and Procedures that are used by attackers is extremely challenging, but however is crucial for developing defense and mitigation strategies against them. This paper evaluates a targeted attack chain against a virtualized, 6G-oriented O-RAN testbed in which the F1 midhaul interface is accessible to an attacker and transport-layer protection is not enabled. The attack disrupts the legitimate O-DU association, introduces a rogue O-DU using observed configuration parameters, and intercepts user-plane traffic. The attack was evaluated in a fully virtualized testbed based on Open5GS, the srsRAN Project, FlexRIC, and an Electric Vehicle (EV) charging infrastructure based on OCPP 1.6.

I. INTRODUCTION

O-RAN’s openness and disaggregation expand the attack surface when midhaul interfaces lack protection. This paper evaluates a targeted F1 attack in a virtualized 6G-oriented testbed and demonstrates plaintext OCPP interception under the tested configuration.

I. INTRODUCTION

  • O-RAN’s component openness and standardized interfaces support flexible deployment, lower vendor dependency, and applications such as industrial IoT and EV charging.Source: §I · p. 1
  • O-RAN’s IP-based midhaul and fronthaul interfaces can expose signaling and enable disruption or impersonation when insufficiently protected.The risk is especially relevant to private 5G and 6G-oriented deployments that prioritize low latency, lower computational overhead, or simpler configuration.Source: §I · p. 1
  • The reproducible emulation testbed separates the O-CU, O-DU, core network, Near-RT RIC, user equipment, and adversarial node across virtualized components.Source: §I · p. 1
  • The attack combines reconnaissance, transport-layer disruption, and rogue O-DU impersonation to demonstrate plaintext EV-charging traffic interception in an emulated 6G-oriented O-RAN testbed.The testbed uses Open5GS, the srsRAN Project, and FlexRIC.Source: §I · p. 1

II. PROPOSED ATTACK METHODOLOGY

The proposed methodology targets trust between the O-CU and O-DU: it disrupts the legitimate association, impersonates the DU, and accesses F1 signaling and user-data streams. Plaintext interception depends on the evaluated configuration’s lack of user-plane encryption.

II. PROPOSED ATTACK METHODOLOGY

  • The work adapts Moheddine and Loscri from NGAP control-plane DoS to the O-RAN F1 interface and subsequent user-plane interception using NEA0 [2].Source: §II · p. 1
  • The EV-charging attack framing draws on OCPP vulnerability research and availability and control-plane studies,, while rogue-DU spoofing has been studied by Saedi et al. and Fue et al.,.Source: §II · pp. 1–2
  • A Protocol-Aware DoS attack at SCTP disconnects the legitimate O-DU, followed by midhaul impersonation that grants access to F1-C signaling and F1-U user-data streams.Source: §II · p. 2
  • The rogue O-DU uses Null Ciphering (NEA0) and disabled PDCP encryption to observe forwarded traffic, including plaintext OCPP messages such as idTag and metering data.The paper states that integrity manipulation was not experimentally evaluated.Source: §II · pp. 1–2
  • The attack is presented as a sequence from network reconnaissance to rogue base-station impersonation, with targeted SCTP Abort and Rogue O-DU insertion on the F1 interface.Source: §II · p. 2, Figure 1 · p. 2

A. Attacker Model and Scope

The evaluated attacker has access to the IP midhaul and can observe or inject traffic, but need not compromise the 5G Core, subscriber credentials, or legitimate RAN software. The results concern an unprotected or misconfigured deployment, not one enforcing the stated protections.

A. Attacker Model and Scope

  • The attacker is assumed to access the O-CU–O-DU IP midhaul and can observe F1 traffic, spoof ARP, inject forged SCTP packets, and launch a preconfigured rogue O-DU.Possible access routes include a compromised VM host, misconfigured virtual switch, insufficient segmentation, insider access, or another compromised node on the transport network.Source: A. Attacker Model and Scope · p. 2
  • The scenario assumes no F1-C or F1-U transport protection and disabled PDCP user-plane ciphering for plaintext OCPP interception; it does not claim success against authenticated, encrypted F1 transport, strong CU–DU identity validation, and PDCP ciphering.It does not assume compromise of the 5G Core, subscriber credentials, or legitimate O-CU and O-DU software binaries.Source: A. Attacker Model and Scope · pp. 2–3

B. Reconnaissance and Parameter Extraction

The attack chain first gathers F1 setup parameters, then terminates the legitimate SCTP association, and finally uses the extracted identifiers to establish a rogue DU association.

B. Reconnaissance and Parameter Extraction

C. Targeted Denial of Service (SCTP Abort)

  • A forged SCTP ABORT packet spoofing the legitimate O-DU’s source IP makes the O-CU terminate the SCTP connection and delete that DU’s F1 frame.The attacker exploits the interval while the O-CU awaits reconnection.Source: C. Targeted Denial of Service (SCTP… · p. 3

D. F1 Spoofing and Introduction of a Rogue DU

  • Using the extracted gNB ID, PLMN, and NCI, the rogue O-DU sends a falsified F1SetupRequest that the O-CU accepts in the evaluated environment, establishing an association and a path to observe control- and user-plane traffic.Source: D. F1 Spoofing and Introduction of a… · p. 3

III. 6G EMULATION TESTBED DESIGN

The testbed uses virtualized, open-source components to model a disaggregated 6G-oriented RAN and core network. Its topology includes a spoofed gNB positioned as an adversarial node outside the legitimate RAN.

A. Design Principles

  • Virtualized Open5GS and srsRAN components provide a reproducible, hardware-independent test environment built around 3GPP Release 15 NR SA and anticipated 6G principles.The design avoids proprietary RF hardware and spectrum licenses, while separating the O-CU and O-DU into distinct virtual environments for controlled observation of F1 traffic.Source: §III · p. 3, A. Design Principles · p. 3

B. Network Topology

  • The topology divides core, RAN, user equipment, and RAN-intelligence functions across VMs, with the RAN split between CU and DU over F1.The core provides AMF and UPF functions; the UE attaches through srsUE, and FlexRIC provides E2 monitoring and control hooks.Source: B. Network Topology · pp. 3–4
  • The topology figure highlights the spoofed gNB within the emulated network testbed.The testbed nodes use software and parameters selected to maintain protocol correctness while enabling the security scenario.Source: Figure 2 · p. 3, B. Network Topology · p. 4
  • A Kali Linux VM hosts a spoofed gNB that operates independently of the legitimate RAN and has no core-network connection.It broadcasts on the legitimate DU’s frequency band and is intended to lure the UE away from the authentic network.Source: B. Network Topology · p. 4

1) 5G Core Network through Open5GS (VM 1)

Open5GS provides the testbed’s 5G standalone core, with AMF and UPF functions hosted together on VM 1.

1) 5G Core Network through Open5GS (VM 1)

2) Central Unit through srsRAN CU (VM 2)

The srsRAN CU connects the control plane to the AMF and exposes F1-C for DU associations, while its user plane anchors the N3 tunnel.

2) Central Unit through srsRAN CU (VM 2)

  • The CU-CP connects to the AMF at 192.168.100.4:38412 and listens for DU F1-C associations at 192.168.100.17:38472.The CU uses srsRAN Project commit 4bf1543936 on the release_24_10 branch.Source: 2) Central Unit through srsRAN CU (VM 2) · p. 4
  • The CU-UP binds its F1-U GTP-U endpoint to 192.168.100.171:2152, separate from the N3/NGU interface at 192.168.100.17:2152.The distinct alias address avoids socket conflicts on shared UDP port 2152.Source: 2) Central Unit through srsRAN CU (VM 2) · p. 4
  • The CU-CP and CU-UP connect to the FlexRIC Near-RT RIC over the E2 interface for near-real-time RAN control and KPM collection.The E2 interface supports the CU’s connection to the RIC,.Source: 2) Central Unit through srsRAN CU (VM 2) · p. 4

3) Distributed Unit through srsRAN DU (VM 3)

The srsRAN DU, UE, and FlexRIC RIC provide the radio, client, and monitoring components of the virtualized testbed.

3) Distributed Unit through srsRAN DU (VM 3)

  • The srsRAN DU and CU run on separate VMs, with a 10 MHz band 3 FDD cell using 15 kHz subcarrier spacing.The 15 kHz spacing is required by srsUE’s NR SA implementation, which limits operation to FDD bands. The DU uses ZMQ for RF transport and E2 connections to FlexRIC.Source: 3) Distributed Unit through srsRAN DU… · p. 4

4) User Equipment through srsUE (VM 4)

  • The srsUE client searches for the band 3 NR cell with matching 15 kHz data and SSB spacing, and uses credentials matching the Open5GS subscriber record.Network slicing is enabled with NSSAI SST 1 and SD 66051, and attached UE traffic is isolated in the ue1 network namespace.Source: 4) User Equipment through srsUE (VM 4) · p. 4

5) Near-RT RIC through FlexRIC (VM 5)

  • FlexRIC connects to the CU and DU and collects cell- and UE-level KPMs, including throughput, BLER, and scheduling metrics.In this experiment, the RIC acts as a passive monitoring plane to contextualize anomalous conditions introduced by the rogue gNB.Source: 5) Near-RT RIC through FlexRIC (VM 5) · p. 4

6) Attacker Node and Rogue O-DU Emulation

A midhaul-positioned attacker uses packet capture and packet manipulation to disrupt the legitimate O-DU association and launch a rogue O-DU. In the evaluated unprotected configuration, the rogue is accepted and bridges signaling toward the legitimate O-CU.

6) Attacker Node and Rogue O-DU Emulation

  • The attacker runs Kali Linux on a midhaul-connected VM, using Wireshark to capture unencrypted F1AP/SCTP traffic and scripts to forge and inject SCTP packets.A preconfigured srsRAN instance acts as the rogue O-DU and uses ZMQ for a virtualized radio link.Source: 6) Attacker Node and Rogue O-DU… · pp. 4–5

IV. EXPERIMENTAL RESULTS AND EVALUATION

  • The demonstrated service disruption and plaintext exposure apply to the evaluated unprotected F1 configuration, not deployments enforcing relevant transport and RAN protections.Source: §IV · p. 5

A. Malicious Control Plane Establishment

  • The O-CU accepts the rogue O-DU using intercepted identifiers, and the rogue bridges the UE’s RRC connection while forwarding signaling to the legitimate O-CU.The attacker first extracts F1SetupRequest parameters during the legitimate O-DU outage.Source: A. Malicious Control Plane Establishment · p. 5

B. User Plane Interception and Data Compromise

With NEA0 disabling user-plane ciphering, the rogue O-DU captures F1-U traffic and reassembles plaintext IP packets, including OCPP payloads. The experiment demonstrates confidentiality exposure and availability disruption, while integrity and command-injection outcomes remain untested.

B. User Plane Interception and Data Compromise

  • Under NEA0, the rogue O-DU captures F1-U traffic and Wireshark reassembles the extracted RLC SDUs into plaintext IP packets, including OCPP payloads.The EV charger receives an active PDU session IP for communication with the CSMS; Fig. 5 depicts the plaintext payload interception.Source: B. User Plane Interception and Data… · p. 5, Figure 5 · p. 6

C. Impact Analysis

  • The captured plaintext JSON exposes EV-charger parameters including idTag, meterValues, and meterStop values.Source: C. Impact Analysis · p. 5
  • Integrity attacks and command injection are plausible implications, but were not experimentally validated and remain future evaluation targets.Source: C. Impact Analysis · pp. 5–6

V. CONCLUSION

The paper evaluates a targeted F1 midhaul spoofing attack that disrupts the legitimate O-DU connection and inserts a rogue O-DU. It identifies component authentication, F1 traffic security, and midhaul monitoring as ways to reduce insertion and interception risks.

V. CONCLUSION

  • The attack extracts F1AP parameters, disrupts the legitimate O-DU through ARP spoofing and SCTP Abort, and inserts a rogue O-DU by exploiting trust between O-CU and O-DU.Source: §V · p. 6
  • Future work will examine rogue O-RU insertion, E2 manipulation, Near-RT RIC interactions, and stronger anomaly detection and identity validation.Source: §V · p. 6
Loading 2610.33526v1…