A new passive method reveals and decodes 5G scheduling control signals
5GDescrambler: Locating, Descrambling, and Decoding 5G Scheduling Information (long version)
Cryptography and Security
Summary
Tracking users in 5G networks can expose personal information, but prior methods needed weak configurations or slow trial-and-error techniques. The authors developed a new way to decode 5G control signals using a mathematical approach that avoids guesswork and does not rely on accidental data leaks. Their method works well even when signal quality is low and is integrated into open-source tools. This improvement can help with monitoring and understanding 5G user activity more efficiently and privately.
What this means in practice
- •For network security teams: Detect and monitor 5G user activity by passively decoding control messages without requiring vulnerable network setups.
- •For telecom network engineers: Evaluate and configure 5G control channels by automatically identifying their scrambling parameters in live deployments.
Authors
Fritz Windisch, Thorsten Strufe
Abstract
Tracking users in 5G NR has recently been successfully demonstrated by exploiting various side-channels. This allows for identification of individuals, classification of user activity in real time as well as tracking by fingerprinting, affecting billions of users with a 5G subscription and companies with private 5G deployments. However, previous work relies on weak operator configurations that leak networking parameters--either the radio network temporary identifier (RNTI) or scrambling factor ($N_{ID}$) during handshake--or to inefficiently brute-force Downlink Control Information (DCI). In this paper we present a novel technique exploiting algebraic structure to reverse DCI scrambling, fully integrated into an open-source end-to-end binary DCI sniffing pipeline. It provides enabling input for subsequent attacks like live tracking of users and supports automatic detection of control channel configurations used. We demonstrate the robustness and performance of our approach with measurement campaigns against deployments of srsRAN, OpenAirInterface5G, and two commercial vendors. It reaches block error rates of less than $1\%$ at SNRs below expected values for efficient communication, while performing significantly faster on a reference sample than a previously suggested passive technique brute-forcing the required parameters. In addition, it is entirely passive and does not rely on any side-channel leakage.