Security1 publisher2 min readPublished
Near-sequential temporary IDs let a fake 5G cell trail subscribers across registrations
Academics built a fake 5G base station from open-source software and cheap radio hardware, then measured how three commercial operators hand out the temporary IDs that are supposed to keep subscribers untraceable. One of the three got it right.
The Watch · Security desk
What happened
- Researchers at the i2CAT Foundation, the University of Murcia and NEC Laboratories Europe built 5G-Shark, a fake base station that lures a phone and questions it, and used it to audit commercial 5G networks.
- On the standalone networks tested, operators concealed the permanent subscriber identity correctly in every case but one, closing most of the IMSI-catching hole 5G was standardized to end.
- From 3,742 temporary identifiers collected across three operators, successive values on some deployments advanced by at most 0.11 percent of the range in use, against roughly 29 percent for random reassignment.
- A crafted Registration Reject dropped a Samsung Galaxy S23 into a limited-service 3G state with no data, and other cause codes produced an infinite retry loop or a modem that needed a manual reset.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability Subscriber-level tracking here runs on open-source network software and inexpensive software-defined radio, so the capability is not gated by a signals-intelligence budget.
- contradiction The paper's own split puts predictable temporary identifiers among the operator and vendor choices, so the tracking it demonstrates is a configuration failure one of the three measured operators has already avoided.
- constraint The two requirements the authors trace to the design, answering an identity request and handling an unauthenticated reject, are beyond operator configuration, so the reject-driven device failures wait on modem firmware or a specification change.
- exposure A subscriber idle within range has nothing to detect and nothing to switch off, which puts every mitigation on the operator core or the handset vendor.
Cell reselection is the way in. An idle phone chooses its own cell from broadcast messages it does not authenticate, so a cell advertising high priority and a usable signal can pull the handset over with no jamming and no malformed packets [2]. Once camped, the phone presents its GUTI, the temporary identifier the network rotates so the permanent one stays hidden [5]. The user sees no warning and takes no action [4].
The rotation is what the audit measured. On the deployments where successive identifiers advanced in near-sequential steps, 84 to 96 percent of a subscriber's consecutive re-registrations could be linked on value alone [8]. One operator behaved differently: its identifiers moved about 29 percent of the range each time, and 7 percent of consecutive registrations stayed linkable [9]. That operator's link rate is roughly one twelfth to one fourteenth of the others' [18].
The authors sort every exposure into two buckets, the ones that survive full compliance with the specification and the ones operators and vendors chose, and predictable temporary identifiers sit in the second bucket [10]. Three measured deployments took the near-sequential path: one operator on both its network types, and a second on its older network [7]. So the subscriber tracking demonstrated here is an allocation decision inside the core network, and one of the three audited operators already makes it differently [9].
Two exposures do come from the design. A phone must present an identity when asked, and it must process an unauthenticated rejection message before any security context exists [11]. No operator configuration reaches either one, and in this audit they produced the device-level failures. The same reject behaviour appeared on both standalone operators tested, and the authors attribute it to modem firmware, not operator policy [13].
The work is a preprint submitted to IEEE and has not been peer reviewed [14]. The team tested its own phones on live commercial networks and identified the operators only as A, B and C [15]. The attack needs the target nearby and idle, and the tested population is seven devices [16].
What to watch
- Whether peer review changes the measured linkability figures when the preprint clears IEEE review.
- Whether the two operators with near-sequential allocation change how their cores assign GUTIs, and whether anyone publishes before-and-after numbers.
- Whether Samsung or the modem vendors ship firmware that stops a crafted Registration Reject from downgrading or freezing the baseband.