We present the first open-source tool capable of efficiently sniffing 5G control channels, 5GSniffer and demonstrate its potential to conduct attacks on users privacy. 5GSniffer builds on our analysis of the 5G RAN control channel exposing side-channel leakage. We note that decoding the 5G control channels is significantly more challenging than in LTE, since part of the information necessary for decoding is provided to the UEs over encrypted channels. We devise a set of techniques to achieve real-time control channels sniffing (over three orders of magnitude faster than brute-forcing). This enables, among other things, to retrieve the Radio Network Temporary Identifiers (RNTIs) of all users in a cell, and perform traffic analysis. To illustrate the potential of our sniffer, we analyse two privacy-focused messengers, Signal and Telegram. We identify privacy leaks that can be exploited to generate stealthy traffic to a target user. When combined with 5GSniffer, it enables stealthy exposure of the presence of a target user in a given location (solely based on their phone number), by linking the phone number to the RNTI. It also enables traffic analysis of the target user. We evaluate the attacks and our sniffer, demonstrating nearly 100% accuracy within 30 seconds of attack initiation.

Bluetooth Low Energy advertisements are increasingly used for proximity privacy-preserving protocols. We investigate information leakage from BLE advertisements. Our analysis, among other things, reveals that the design of today’s Bluetooth chips enables the linking of BLE advertisements to Bluetooth Classic (BTC) frames, and to a globally unique identifier (BDADDR). We demonstrate that the inference of the BDADDR from BLE advertisements is robust achieving over 90% reliability across apps, mobile devices, density of devices, and tens of meters away from the victims. We discuss the implications of current chipsets vulnerability on privacy-preserving protocols. The attack, for instance, reveals the BDADDR of devices of infected users of contact-tracing apps. We also discuss how the vulnerability can lead to de-anonymization of victims. Furthermore, current mobile devices do not allow selective disabling of BTC independently of BLE which renders simple countermeasures impractical. We developed several mitigations for the Android OS and the Bluetooth stack and demonstrate their efficacy.

The 3GPP 5G cellular system is hailed as a major step towards more ubiquitous and pervasive communications infrastructure (including for V2X, Smart Grid, and Healthcare). We disclose and evaluate SigUnder, an attack that enables an adversary to overshadow the Signal Synchronization Block (SSB) with an injected signal at 3.4dB below the legitimate signal (prior work required 3dB above). The attack exploits the polar coding mechanism of 5G and the physical layer OFDM structure. It can be used to make previous DoS and over-shadowing attacks lower-power and stealthy, but also enables new attacks unique to 5G such as setting the cellBarred field in the 5G MIB (and blocking access to a cell). We develop techniques (e.g., phase prediction) to make the attack feasible in a practical setup, and evaluate its performance both in simulations and over the air experiments. We also introduce SICUnder, an extension of Successive Interference Cancellation (SIC) to be able to address the unique challenges that SigUnder poses and demonstrate it effectiveness relatively to standard SIC.

Precise localization is becoming an integral part of mobile network architectures, not only to provide location-based services but also to optimize the operation of the network itself through suitable context information. Location systems are of particular importance for indoor settings where GPS may be unavailable. While upcoming 5G systems will provide improved location accuracy, for a long time to come many areas will only have LTE coverage, and ubiquitous localization will thus also have to rely on LTE technology. To evaluate the location accuracy that can be achieved with current mobile systems, we implement a localization algorithm in a standard-compliant LTE testbed based on software-defined radios. We assess the localization accuracy in representative indoor scenarios. Despite a bandwidth of only 20MHz, the results show a good median error around 2m, but significantly larger errors may occur in non-line-of-sight cases. Nevertheless, the accuracy is sufficient for a range of potential applications.

Carrier aggregation increases the throughput of LTE mobile networks by aggregating bandwidth at different frequencies. The theoretical effectiveness of carrier aggregation has been widely studied in the literature and operators claim it substantially increases the network data rate. However, to the best of our knowledge no practical evaluation of the performance of carrier aggregation has been performed using real traffic data. We perform a thorough measurement-based study to assess how carrier aggregation improves the service offered in selected locations in Madrid, Spain. Although the best results for data rate boost are in line with the operator claims, we find that resource usage in aggregated bands is frequently suboptimal, and higher data rates could be achieved by simply overloading a single band. On the other hand, the quality of service achieved by users effectively exploiting carrier aggregation could not be achieved without it.