← Back to TelcoSec Arsenal
5G-NIDD
5G NR / NB-IoTNon-IP Data Delivery testing framework for auditing 5G IoT NB-IoT and LTE-M NIDD bearer establishment, SGW tunneling, and SCEF API security.
⚡ Quick Telecom Protocol Brief5G NR / NB-IoT
5G-NIDD is an open-source IoT Protocol Testing component included in TelcoChisel for telecommunications security auditing. It targets 5G NR / NB-IoT infrastructure for compliance with 3GPP and GSMA telecom security standards.
Primary Binary:
nidd-clientHardware: USRP B210 / LimeSDR5G-NIDD — Non-IP Data Delivery Security Testing
5G-NIDD enables security auditing of Non-IP Data Delivery bearers used by NB-IoT and LTE-M cellular IoT devices. Within TelcoChisel, the tool is preconfigured to test NIDD bearer establishment via the NEF/SCEF exposure APIs, inspect SGW-level tunneling, and identify authentication bypass vectors in constrained IoT device communication.
Key Capabilities & Security Vectors
- NIDD Bearer Hijacking: Test unauthorized NIDD session establishment by spoofing device identities (IMSI/SUPI) against the SCEF/NEF.
- SGW Data Injection: Inject crafted non-IP payloads through GTP tunnels targeting the Serving Gateway, bypassing IP-layer firewalls.
- SCEF/NEF API Fuzzing: Fuzz 3GPP T8 API endpoints for authentication and authorization flaws in IoT device management.
- Constrained Device Impersonation: Simulate rogue NB-IoT endpoints to test network-side device verification mechanisms.
TelcoChisel Execution Cheatsheet
1. Start NIDD Bearer Test
# Initiate NIDD bearer establishment against test core
nidd-client --config /etc/nidd/default.yaml --mode bearer-test
2. SCEF API Endpoint Discovery
# Enumerate SCEF/NEF T8 API endpoints
curl -k https://127.0.0.1:8443/3gpp-nidd/v1/
3. Non-IP Payload Injection
# Send crafted non-IP payload through NIDD bearer
nidd-client --mode inject --payload /opt/nidd/payloads/coap-malformed.bin
No community field notes posted yet. Be the first telecom engineer to leave feedback!