Talk to a security specialist
Field reports, security research, and technical analysis from our work auditing telecom networks
A SIM clone is supposed to need the operator's secret key. The Ghost SIM attack doesn't — it registers on a live network whenever a weak authentication policy forgets to challenge the card. How it works across 2G–5G, why it bypasses SMS 2FA, and how operators and users shut the window.
The 5G core stopped being a monolith — it's now a mesh of services talking over HTTP/2, the same protocols that run the web. A security walkthrough of a 5G Standalone core: how its network functions communicate, why HTTP/2 widens the attack surface, and why most cores still ship without encryption or authorization enabled.
SCTP-Hijacker tears down the legitimate gNB–AMF association with a forged ABORT, then rebuilds it from the attacker's own host using SCTP multihoming and a crafted NGAP Setup Request — impersonating the base station outright. Validated on a commercial 4G network.
5G's SUCI was supposed to retire the IMSI Catcher. We bought SIM cards over the counter in Madrid, Berlin and London, set up a portable fake 5G network in a Faraday cage, and proved the promise does not hold. Four operators tested, four vulnerable.
.png)
