Positive Technologies Exposes GTP/GRX Mobile-Internet Hijacking via Internet-Reachable GTP Nodes
Positive Technologies' 2014 report "Vulnerabilities of Mobile Internet (GPRS)", publicized in February 2015, showed that GPRS Tunnelling Protocol (GTP) nodes reachable from the internet and the GRX roaming network let attackers brute-force subscriber identities, hijack or block mobile data sessions and obtain subscriber data — building on P1 Security's 2011 "Attacking GRX" research. A 2020 Positive Technologies assessment found every one of 28 tested operators still exploitable via GTP.
02Deep-Dive Technical Analysis
GTP control plane (GTP-C, UDP 2123) messages traverse inter-operator GPRS Roaming Exchanges (GRX) and IP eXchange (IPX) networks to establish subscriber data tunnels between the Serving GPRS Support Node (SGSN) / Serving Gateway (SGW) and the Gateway GPRS Support Node (GGSN) / Packet Data Network Gateway (PGW). Positive Technologies found more than 200,000 internet-facing hosts answering on GTP ports, including operator gateway nodes. Because GTP carries no cryptographic origin authentication, spoofed `Create PDP Context Request`, `Delete PDP Context Request` and `Modify Bearer Request` messages with guessed IMSIs or brute-forced Tunnel Endpoint Identifiers (TEIDs) were accepted, allowing attackers to disconnect or hijack subscriber sessions, consume data at another subscriber's expense, or impersonate MNO APNs.
03Vulnerability & Exploit Flow
Unauthenticated GTP-C signaling injection across IPX peering points and TEID prediction.
04Recommended Defense & Mitigation Protocol
Deploy GSMA FS.20 compliant GTP firewalls, enforce IPX source IP anti-spoofing, and validate TEID state consistency.
05Security Impact & Geopolitical Consequence
Fed into GSMA FS.20 (GPRS Tunnelling Protocol Security, first issued 2017), which calls for GTP-aware stateful carrier firewalls and strict TEID/IMSI consistency checks on inter-PLMN S8/Gp interfaces; Positive Technologies' 2020 follow-up showed the problem persisting into LTE and early 5G deployments.
06Authoritative Standards & External References
- 01Positive Technologies — Vulnerabilities of Mobile Internet (GPRS), 2014 (Kurbatov, Puzankov, Novikov)
- 02P1 Security (Philippe Langlois) — Attacking GRX: GPRS Roaming eXchange (slides, 2011)
- 03SecurityWeek — GTP Vulnerabilities Expose 4G/5G Networks to High-Impact Attacks (2020 follow-up)
- 043GPP — TS 29.274: Evolved GPRS Tunnelling Protocol for Control plane (GTPv2-C)
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.