Unprotected F1 midhaul lets a rogue O-DU intercept 6G testbed traffic
Original title: Security evaluation of 6G-oriented and O-RAN networks through targeted attacks
The chain was shown on Open5GS, srsRAN, FlexRIC and an OCPP 1.6 EV charging setup, not a production network.
A paper evaluates a targeted attack against a virtualized, 6G-oriented O-RAN testbed whose F1 midhaul is reachable and lacks transport-layer protection. The chain breaks the legitimate O-DU association, stands up a rogue O-DU from observed configuration parameters, and intercepts user-plane traffic. The authors present it as input for defense and mitigation work.
Unconfirmed: The attack was evaluated only in a virtualized testbed, not on live operator networks.
- The attacker needs access to the F1 midhaul interface.
- Transport-layer protection was not enabled in the test.
- The rogue O-DU reuses observed configuration parameters.
- An OCPP 1.6 EV charging system was part of the testbed.
Impact: intercepts user-plane traffic after inserting a rogue O-DU
| Product | Affected |
|---|---|
| 6G-oriented O-RAN F1 midhaul | transport-layer protection not enabled |
- 1.Enable transport-layer protection on the F1 midhaul interface
From the original article
1 min read at arxiv.orgThe sixth generation (6G) of networks is supported by increased bandwidth, automation through the use of O-RAN technologies. Simultaneously though autonomous operation leads to an extensive threat surface and sophisticated attacks.
By Apostolos Valiakos · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.