3GPP TR 33.809

Q: What does the Scope section cover in 3GPP TR 33.809 — Study on 5G Security Enhancement against False Base Stations?

The Scope section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.809 — Study on 5G Security Enhancement against False Base Stations. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the False Base Station Attack Taxonomy section cover in 3GPP TR 33.809 — Study on 5G Security Enhancement against False Base Stations?

The False Base Station Attack Taxonomy section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.809 — Study on 5G Security Enhancement against False Base Stations. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Existing 5G Protections section cover in 3GPP TR 33.809 — Study on 5G Security Enhancement against False Base Stations?

The Existing 5G Protections section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.809 — Study on 5G Security Enhancement against False Base Stations. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Remaining Gaps Identified section cover in 3GPP TR 33.809 — Study on 5G Security Enhancement against False Base Stations?

The Remaining Gaps Identified section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.809 — Study on 5G Security Enhancement against False Base Stations. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Proposed Solutions section cover in 3GPP TR 33.809 — Study on 5G Security Enhancement against False Base Stations?

The Proposed Solutions section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.809 — Study on 5G Security Enhancement against False Base Stations. This content is part of the BLACKLABS 3GPP Security Library.

BLACKLABS

Study on 5G Security Enhancement against False Base Stations (FBS)

V18.0.0 (2023-12) — Release 18 Technical Report

1. Scope

▶

Studies threats from false base stations (IMSI catchers, Stingrays, rogue gNBs) against 5G NR, analyzes existing 5G protections, identifies remaining gaps, and proposes enhancements.

Real-world impact: False base stations (FBS) are actively used by law enforcement, intelligence agencies, and criminals worldwide. While 5G introduced SUCI encryption and improved integrity protection, this study finds residual vulnerabilities remain.

2. False Base Station Attack Taxonomy

▶

2.1 IMSI/SUPI Catching

▶

Attack: Identity Capture

Legacy (2G-4G): FBS sends Identity Request for IMSI → UE responds with plaintext IMSI.

5G mitigation: SUCI (Subscription Concealed Identifier) encrypts SUPI using home network public key (ECIES). FBS cannot decrypt.

Residual risk: 5G-GUTI reallocation patterns may allow correlation; SUCI scheme 0 (null encryption) still allowed in some configs.

2.2 Denial of Service

▶

Attack: RRC Reject / Redirect

FBS broadcasts stronger signal than legitimate gNB → UE camps on FBS → FBS sends RRC Reject or redirect to another frequency, denying service.

5G status: RRC Reject before security activation is not integrity protected. UE cannot verify legitimacy.

Attack: Registration Reject with Specific Causes

FBS impersonates AMF response via NAS Registration Reject with cause #3 (Illegal UE), #6 (Illegal ME), or #7 (5GS services not allowed).

Impact: UE enters deregistered state; may require manual intervention or USIM removal to recover.

5G status: TS 33.501 §6.1.4 — NAS Reject before authentication is not integrity protected. Timer-based recovery (T3247) added as partial mitigation.

2.3 Bidding-Down / Downgrade Attacks

▶

Attack: Force Fallback to 4G/3G/2G

FBS broadcasts that 5G is unavailable → UE falls back to 4G/3G → loses 5G security features (SUCI, UP integrity).

Residual risk: While Anti-bidding-down between architectures (ABBA) parameter exists in 5G, UE cannot verify "no 5G coverage" claims before falling back.

2.4 MITM Relay

▶

Attack: Full MITM Relay (Most Sophisticated)

FBS relays all messages between UE and legitimate gNB in real-time, acting as transparent proxy.

Capability: Can selectively modify unprotected messages, inject SIB changes, perform measurement manipulation.

5G countermeasure: Integrity protection of NAS and RRC prevents modification of protected messages, but pre-security messages remain vulnerable.

3. Existing 5G Protections

▶

Protection	Addresses	Spec Reference
SUCI Encryption	IMSI catching	TS 33.501 §6.12
NAS Integrity (mandatory)	NAS message modification	TS 33.501 §6.7
RRC Integrity (mandatory)	RRC message modification	TS 33.501 §6.8
UP Integrity (optional)	User data modification	TS 33.501 §6.6
ABBA Parameter	Bidding-down between architectures	TS 33.501 §6.1.3
T3247 Timer	NAS Reject recovery	TS 24.501

4. Remaining Gaps Identified

▶

Gap	Exploitable By	Severity
SIB (System Info Broadcast) not integrity protected	FBS broadcasting fake cells	High
RRC Reject before security — no integrity	FBS DoS on connection setup	High
Paging not authenticated	FBS paging to lure UEs	Medium
Cell reselection based on signal strength	FBS with stronger signal wins	High
Measurement reports before AS security	Measurement manipulation for tracking	Medium
SUCI scheme 0 (null) still permitted	IMSI catching when scheme 0 configured	Medium

5. Proposed Solutions

▶

Solution	Approach	Status
SIB Integrity Protection	Digital signature on SIB1/SIB2 using network public key	Under study — compute cost concern
Multi-SIM FBS Detection	UE uses multiple SIMs/radios to cross-check cell info	Proposed — device cost increase
Crowdsourced Detection	UEs report suspicious cells to network for analysis	Rel-18 contributions
Cell Authentication	gNB proves identity to UE before initial access	Fundamental redesign — long-term
AI-based Detection	UE/network ML models detect FBS patterns	Research phase

Key conclusion: Complete FBS protection requires authenticating the cell to the UE before any signaling — fundamentally inverting today's model where only the UE authenticates to the network. This remains an open research challenge.