A low-cost rogue 5G cell can silently track subscribers, force downgrades and freeze modems on commercial networks.
Idle and inactive phones can camp on the transmitter automatically, before authentication and without warning.
Commercial 5G SA and NSA networks and ordinary consumer phones or cellular modems operating within a rogue base station's coverage.
User-invisible subscriber tracking, radio-generation downgrade and persistent modem denial of service
A low-cost rogue 5G cell can silently track subscribers, force radio-generation downgrades and persistently disrupt modems on commercial networks. Researchers demonstrated the attack against commercial networks and off-the-shelf devices using open-source cellular stacks and inexpensive SDR hardware.
Detail and 2 sources
The attacker observes the operator identifiers, spectrum and reselection priorities, then broadcasts a stronger or higher-priority cell with an open-source stack and inexpensive SDR hardware. A phone in RRC_IDLE or RRC_INACTIVE camps on it without warning or interaction.
The rogue cell can request permanent, concealed or temporary subscriber identifiers and correlate successive GUTIs. Unauthenticated Registration Reject causes can then force an LTE or UMTS downgrade, trap the modem in a retry loop or leave it frozen until the user manually resets its radio state.
- access:radio:cellular
- able to present a cellular signal to the target
- interaction:none
- no user action required
- state:device:powered-on-idle
- device powered on and idle