Technique reverses 5G control data to improve user tracking and decoding
5GDescrambler: Locating, Descrambling, and Decoding 5G Scheduling Information (long version)
Cryptography and Security
Summary
It can be hard to understand and track signals in 5G wireless networks because important control information is scrambled for privacy and security. The authors developed a new method that uses math tricks to unscramble these control signals without needing to guess. Their technique works well with different 5G systems and is much faster and more reliable than older methods. This helps reveal details about user activity and network setup while remaining completely passive, meaning it doesn't interfere with the network or rely on leaks.
5G NRDownlink Control Information (DCI)ScramblingRadio Network Temporary Identifier (RNTI)Signal-to-Noise Ratio (SNR)srsRANOpenAirInterface5GPassive eavesdroppingScheduling informationAlgebraic decoding
Authors
Fritz Windisch, Thorsten Strufe
Abstract
Tracking users in 5G NR has recently been successfully demonstrated by exploiting various side-channels. This allows for identification of individuals, classification of user activity in real time as well as tracking by fingerprinting, affecting billions of users with a 5G subscription and companies with private 5G deployments. However, previous work relies on weak operator configurations that leak networking parameters--either the radio network temporary identifier (RNTI) or scrambling factor ($N_{ID}$) during handshake--or to inefficiently brute-force Downlink Control Information (DCI). In this paper we present a novel technique exploiting algebraic structure to reverse DCI scrambling, fully integrated into an open-source end-to-end binary DCI sniffing pipeline. It provides enabling input for subsequent attacks like live tracking of users and supports automatic detection of control channel configurations used. We demonstrate the robustness and performance of our approach with measurement campaigns against deployments of srsRAN, OpenAirInterface5G, and two commercial vendors. It reaches block error rates of less than $1\%$ at SNRs below expected values for efficient communication, while performing significantly faster on a reference sample than a previously suggested passive technique brute-forcing the required parameters. In addition, it is entirely passive and does not rely on any side-channel leakage.