Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The authors design an end-to-end, fully passive sniffing pipeline that exploits the algebraic structure of 5G NR Downlink Control Information (DCI) scrambling to intercept scheduling telemetry without relying on handshake leaks or weak configurations. By eliminating dependencies on side-channels and costly brute-forcing, this technique systematically exposes cellular subscribers to real-time traffic classification and physical-layer tracking across commercial and private deployments. Evaluated against srsRAN, OpenAirInterface5G, and two proprietary commercial networks, the system achieves block error rates under 1% at low signal-to-noise ratios while running substantially faster than prior brute-force baselines.
Passive 5G user tracking no longer requires side-channel leaks or intractable brute-force searches: exploiting the algebraic structure of DCI scrambling unlocks real-time scheduling interception with sub-1% block error rates.
Tracking users in 5G NR has recently been successfully demonstrated by exploiting various side-channels. This allows for identification of individuals, classification of user activity in real time as well as tracking by fingerprinting, affecting billions of users with a 5G subscription and companies with private 5G deployments. However, previous work relies on weak operator configurations that leak networking parameters--either the radio network temporary identifier (RNTI) or scrambling factor ($N_{ID}$) during handshake--or to inefficiently brute-force Downlink Control Information (DCI). In this paper we present a novel technique exploiting algebraic structure to reverse DCI scrambling, fully integrated into an open-source end-to-end binary DCI sniffing pipeline. It provides enabling input for subsequent attacks like live tracking of users and supports automatic detection of control channel configurations used. We demonstrate the robustness and performance of our approach with measurement campaigns against deployments of srsRAN, OpenAirInterface5G, and two commercial vendors. It reaches block error rates of less than $1\%$ at SNRs below expected values for efficient communication, while performing significantly faster on a reference sample than a previously suggested passive technique brute-forcing the required parameters. In addition, it is entirely passive and does not rely on any side-channel leakage.