Researchers Show How a Low-Cost Fake Base Station Can Track Some 5G Subscribers
Summary
Researchers used 5G-Shark to test commercial 5G networks. Predictable temporary IDs enabled tracking on some networks, while crafted reject messages caused service loss, retry loops, or modem freezes on tested devices. The work is a preprint.
Key points
- 5G-Shark uses a fake base station, open-source network software, and low-cost software-defined radio to lure nearby idle phones onto a controlled cell.
- Tests of three operators found permanent subscriber IDs were concealed in all but one case, but predictable temporary IDs still enabled tracking on some networks.
- Researchers collected 3,742 temporary IDs; on some networks, 84–96% of consecutive re-registrations could be linked by identifier value.
- One operator’s more randomized temporary IDs left only 7% of consecutive registrations linkable by value.
- Crafted Registration Reject messages caused a Samsung Galaxy S23 to lose data service, enter an infinite retry loop, or freeze and require a manual reset.
- The researchers tested their own phones on live commercial networks; the operators were anonymized, and the attack requires a nearby idle target.
- The preprint has not been peer reviewed and covers seven devices.
Article Details
- Attack Vectors
- 5G-Shark advertises a high-priority cell with a decent signal to lure an idle phone onto a fake base station, exploiting unauthenticated broadcast messages used in cell reselection.
- After the phone camps on the fake cell, researchers observe its temporary GUTI; predictable GUTI rotation can allow consecutive registrations to be linked.
- Crafted Registration Reject messages can cause limited service, infinite retry loops, or a frozen modem on tested devices.
- Defensive Notes
- Operators should use unpredictable temporary subscriber IDs; the article reports that predictable GUTI rotation enabled tracking on some tested networks.
- The researchers distinguish operator-configurable issues, such as predictable temporary IDs, from rejection-message behaviors they attribute to the design and modem firmware.