5G-Shark: A Network Security Auditor for 5G Subscriber Privacy and Unauthenticated Signalling Resilience
5G-Shark audit tool pulls 5G phones onto rogue cells via cell-reselection manipulation, exposing identifier linkability and downgrade flaws in commercial networks.
The paper presents 5G-Shark, a security assessment tool and methodology built from open-source stacks and SDR hardware that manipulates the standardized cell-reselection criterion to pull a target User Equipment onto a self-created rogue cell with minimal service disruption. Evaluated against commercial 5G Standalone deployments, it requests subscriber identifiers, forces Radio Access Technology downgrade via crafted Registration Reject codes, and induces denial-of-service states. It distinguishes protocol-design limitations from implementation non-compliance, and provides empirical evidence that several commercial deployments re-allocate temporary identifiers in near-sequential steps, keeping successive values linkable and enabling persistent tracking despite correct subscriber ID concealment.
- Turns legitimate mobility procedure against subscriber by manipulating cell-reselection criterion
- Built from open-source stacks and SDR; evaluated against commercial 5G SA deployments
- Forces RAT downgrade via crafted Registration Reject codes and induces DoS states
- Near-sequential temporary identifiers in several deployments enable persistent user tracking
From the original article
1 min read at arxiv.orgThe fifth generation of mobile networks was standardised with an explicit mandate to close long-standing privacy and security gaps, mandating the concealment of the subscriber's permanent identity, resistance to generational downgrade, and protection against location tracking.
By Oscar Lasierra · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.