A cheap fake base station can still track 5G subscribers
Researchers from the i2CAT Foundation, the University of Murcia, and NEC Laboratories Europe built a low-cost tool called 5G-Shark that lures a target phone onto a fake base station and questions it, then used it to audit commercial 5G networks.
On the standalone-5G networks they tested, operators concealed the phone’s permanent identity correctly in every case but one. The same networks still handed out temporary IDs in a pattern predictable enough that an observer can follow one subscriber from registration to registration.
5G was standardized to end IMSI catching, the trick of coaxing a phone into revealing the permanent subscriber number that older networks broadcast in the clear. On the networks this team measured, that hole is mostly closed. The tracking problem it was meant to solve is not, and the reason sits in the standard itself.
Here is how the tool gets its vantage point. When your phone sits idle, it decides on its own which cell to camp on, following a routine called cell reselection. Those decisions rest on broadcast messages the phone does not authenticate, so a fake cell that advertises high priority and a decent signal can pull the phone over to it. 5G-Shark does exactly that. It needs no jamming and no malformed packets, runs on open-source network software and inexpensive software-defined radio hardware, and stays invisible to the user, who sees no warning and takes no action.
Once a phone camps on the fake cell, it hands over a temporary identifier, the GUTI, that the network rotates to avoid exposing the permanent one. That rotation is where the tracking lives. The team collected 3,742 of these identifiers across three operators. For one operator across both its network types, and a second on its older network, successive temporary IDs advance in near-sequential steps, at most 0.11 percent of the range in use, against the roughly 29 percent you would expect from a properly random reassignment. The result: between 84 and 96 percent of a subscriber’s consecutive re-registrations can be linked by value alone. Chain those links and you have followed the phone, permanent ID or not.
One operator did it right. Its temporary IDs moved by about 29 percent of the range each time, and only 7 percent of consecutive registrations stayed linkable, which collapses value-based tracking. If you take one thing from the numbers, take that gap: the same standard produced a network you can trail and a network you cannot, depending on a choice the operator made.
That split is the paper‘s organizing idea. The authors sort every exposure into one of two buckets. Some survive full compliance with the specification: a phone must present an identity when asked, and it must process an unauthenticated rejection message before any security context exists. Those are properties of the design, and no operator can configure them away. Others are choices, like predictable temporary IDs, and those land on operators and vendors to fix.
The rejection messages produce the uglier failures. By sending a crafted Registration Reject, 5G-Shark pushed a Samsung Galaxy S23 down to a limited-service 3G state with no data, and, with other cause codes, into an infinite retry loop or a frozen modem that needed a manual reset. Those behaviors showed up the same way on both standalone operators tested, which points at the modem firmware, not operator policy.
A few limits are worth keeping in view. The work is a preprint submitted to IEEE and has not been peer reviewed. The team tested its own phones on live commercial networks, not strangers’, and named the operators only as A, B, and C. The attack needs the target nearby and idle, and it reaches a small set of seven devices.
