Transmissions Attacks: openran security, 5g radio hacking, massive mimo security

The Radio Access Network (RAN) represents the air interface between user equipment and the cellular core — the only attack surface that requires no physical access to operator infrastructure. An attacker equipped with a Software Defined Radio (SDR) and appropriate open-source software can passively monitor, actively manipulate, and selectively jam radio communications from a public location.

IMSI catchers (false base stations) exploit the absence of mutual authentication in 2G networks and the ability to trigger downgrade attacks in multi-generation devices. By broadcasting a stronger signal than the legitimate cell, a rogue base station forces nearby devices to associate, enabling IMSI collection, real-time location tracking, and in some configurations, active man-in-the-middle interception of voice and SMS. 5G NR includes 5G-GUTI mechanisms and SUCI/SUPI concealment to mitigate IMSI exposure, but implementation gaps and fallback attacks remain active research vectors.

The transition to Open RAN (O-RAN) introduces significant new attack surface at the xHaul fronthaul and midhaul interfaces between the Radio Unit (RU), Distributed Unit (DU), and Centralized Unit (CU). Where these interfaces rely on commodity IP transport without strong mutual authentication, adversaries can intercept user-plane traffic, inject false control-plane messages, or disrupt timing synchronization to degrade service across an entire cell sector.

Defense standards for RAN security include 3GPP TS 33.501 (5G Security Architecture), the O-RAN Alliance Security Work Group specifications, and NIST SP 800-187. Detecting rogue base stations in practice requires monitoring for anomalous RSRP/RSRQ signal levels, unexpected EARFCN/NR-ARFCN changes, or rapid PLMN changes — capabilities being incorporated into commercial Cellular Network Monitoring (CNM) platforms.