arXiv subjects

Evangelos Bitsikas

Publications and source records attributed to Evangelos Bitsikas.

7 recordsLinked to original sources

arXiv2026

A Queryable Graph-Based Security Analysis Framework for O-RAN

The Open Radio Access Network (O-RAN) replaces vendor-locked RANs with a modular and interoperable architecture that fosters competition and accelerates innovation. With this openness comes increased complexity and a larger attack surface, making security a critical concern. Today, assessing O-RAN security requires manually cross-referencing dozens of specifications, vendor whitepapers, and academic studies, which is error-prone and static. In this paper, we present a graph-based framework that transforms this static corpus into a single, queryable database. Our graph representation contains over 350 nodes and more than 1,250 relationships, distilled from specifications, academic papers, open-source projects, and vulnerability databases. To keep this resource current, we integrate a hybrid data extraction pipeline that couples deterministic parsing of structured specifications with Large Language Model (LLM)-assisted extraction for evolving specifications and unstructured literature. Querying the graph reveals three actionable findings within our curated corpus: critical infrastructure such as the O-DU, SMO, and O-Cloud carries dozens of specification-level threats yet has little or no empirical coverage; memory-safety weaknesses account for 11 of the 21 CWE occurrences associated with the analyzed CVEs; and fuzzing uncovered 18 of the 20 CVEs attributed to research papers. We provide the database, pipeline, and queries as open-source artifacts.

cs.CR↗

arXiv2026

Security Analysis of LTE Connectivity in Connected Cars: A Case Study of Tesla

Modern connected vehicles rely on persistent LTE connectivity to enable remote diagnostics, over-the-air (OTA) updates, and safety-relevant services. While mobile network vulnerabilities are well documented in the smartphone ecosystem, their impact in safety-relevant automotive settings remains insufficiently examined. We conduct a black-box case study of LTE security in Tesla's Model 3 and Cybertruck, revealing systemic protocol weaknesses and architectural misconfigurations in connected vehicles. We find that Tesla's telematics stack is susceptible to IMSI catching, rogue base station hijacking, and insecure fallback mechanisms that may silently degrade service availability. Furthermore, legacy control-plane configurations allow for silent SMS injection and broadcast message spoofing without driver awareness. While the vulnerabilities are grounded in Tesla, this case study suggests broader implications for connected-vehicle telematics and for regulatory frameworks such as ISO/SAE 21434 and UN R155/R156, which assume secure, traceable, and resilient telematics in modern vehicles.

cs.CR↗

arXiv2026

Dyna-5G: Dynamic Role Switching for Self-Organizing 5G M2M Networks

M2M deployments such as drone swarms demand mission-critical communication: km-scale range, strong per-device identity and mutual authentication, and deterministic QoS for bandwidth-intensive payloads. Cellular 5G uniquely satisfies all of these, yet it has seen limited adoption in autonomous fleets. The barrier is not capability but resilience: today's 5G networks assume fixed infrastructure, and when the base station fails, recovery is uniquely complex. Unlike simpler wireless protocols where devices can transparently switch nodes, 5G failure requires reconstructing distributed state such as authentication contexts, QoS bindings, tunnels, and RRC state machines across the fleet, a process that no existing system automates. We present Dyna-5G, which makes this happen. Dyna-5G is the first 5G Standalone-compliant framework for dynamic role switching in M2M fleets, where any device can assume the role of 5G Core, RAN, or UE at runtime. It orchestrates failure detection, leader selection, and coordinated state teardown and re-establishment, all without modifying 3GPP protocols. We evaluate Dyna-5G on a high-fidelity software emulation testbed, with Open5GS and srsRAN, across hundreds of trials with up to 10 drones. Control-plane overhead averages 0.47 Mb/s (approximately 0.47% of a 100 Mb/s bearer), while failure recovery completes in about 2.5 s, of which approximately 86% is due to stack-dependent cellular procedures. Dyna-5G's orchestration logic itself adds only about 175 ms per reconfiguring role. All tested missions complete successfully, even under injected leader crashes.

cs.NI↗

arXiv2025

Security Analysis of 5G NR Device-to-Device Sidelink Communications

5G NR sidelink communication enables new possibilities for direct device-to-device interactions, supporting applications from vehicle-to-everything (V2X) systems to public safety, industrial automation, and drone networks. However, these advancements come with significant security challenges due to the decentralized trust model and increased reliance on User Equipment (UE) for critical functions like synchronization, resource allocation, and authorization. This paper presents the first comprehensive security analysis of NR V2X sidelink. We identify vulnerabilities across critical procedures and demonstrate plausible attack, including attacks that manipulate data integrity feedback and block resources, ultimately undermining the reliability and privacy of sidelink communications. Our analysis reveals that NR operational modes are vulnerable, with the ones relying on autonomous resource management (without network supervision) particularly exposed. To address these issues, we propose mitigation strategies to enhance the security of 5G sidelink communications. This work establishes a foundation for future efforts to strengthen 5G device-to-device sidelink communications, ensuring its safe deployment in critical applications.

cs.CR↗

arXiv2023

Freaky Leaky SMS: Extracting User Locations by Analyzing SMS Timings

Short Message Service (SMS) remains one of the most popular communication channels since its introduction in 2G cellular networks. In this paper, we demonstrate that merely receiving silent SMS messages regularly opens a stealthy side-channel that allows other regular network users to infer the whereabouts of the SMS recipient. The core idea is that receiving an SMS inevitably generates Delivery Reports whose reception bestows a timing attack vector at the sender. We conducted experiments across various countries, operators, and devices to show that an attacker can deduce the location of an SMS recipient by analyzing timing measurements from typical receiver locations. Our results show that, after training an ML model, the SMS sender can accurately determine multiple locations of the recipient. For example, our model achieves up to 96% accuracy for locations across different countries, and 86% for two locations within Belgium. Due to the way cellular networks are designed, it is difficult to prevent Delivery Reports from being returned to the originator making it challenging to thwart this covert attack without making fundamental changes to the network architecture.

cs.CR↗

arXiv2022

You have been warned: Abusing 5G's Warning and Emergency Systems

The Public Warning System (PWS) is an essential part of cellular networks and a country's civil protection. Warnings can notify users of hazardous events (e.g., floods, earthquakes) and crucial national matters that require immediate attention. PWS attacks disseminating fake warnings or concealing precarious events can have a serious impact, causing fraud, panic, physical harm, or unrest to users within an affected area. In this work, we conduct the first comprehensive investigation of PWS security in 5G networks. We demonstrate five practical attacks that may impact the security of 5G-based Commercial Mobile Alert System (CMAS) as well as Earthquake and Tsunami Warning System (ETWS) alerts. Additional to identifying the vulnerabilities, we investigate two PWS spoofing and three PWS suppression attacks, with or without a man-in-the-middle (MitM) attacker. We discover that MitM-based attacks have more severe impact than their non-MitM counterparts. Our PWS barring attack is an effective technique to eliminate legitimate warning messages. We perform a rigorous analysis of the roaming aspect of the PWS, incl. its potentially secure version, and report the implications of our attacks on other emergency features (e.g., 911 SIP calls). We discuss possible countermeasures and note that eradicating the attacks necessitates a scrupulous reevaluation of the PWS design and a secure implementation.

cs.CR↗

arXiv2022

Hope of Delivery: Extracting User Locations From Mobile Instant Messengers

Mobile instant messengers such as WhatsApp use delivery status notifications in order to inform users if a sent message has successfully reached its destination. This is useful and important information for the sender due to the often asynchronous use of the messenger service. However, as we demonstrate in this paper, this standard feature opens up a timing side channel with unexpected consequences for user location privacy. We investigate this threat conceptually and experimentally for three widely spread instant messengers. We validate that this information leak even exists in privacy-friendly messengers such as Signal and Threema. Our results show that, after a training phase, a messenger user can distinguish different locations of the message receiver. Our analyses involving multiple rounds of measurements and evaluations show that the timing side channel persists independent of distances between receiver locations -- the attack works both for receivers in different countries as well as at small scale in one city. For instance, out of three locations within the same city, the sender can determine the correct one with more than 80% accuracy. Thus, messenger users can secretly spy on each others' whereabouts when sending instant messages. As our countermeasure evaluation shows, messenger providers could effectively disable the timing side channel by randomly delaying delivery confirmations within the range of a few seconds. For users themselves, the threat is harder to prevent since there is no option to turn off delivery confirmations.

cs.CR↗