A critical vulnerability has been identified in 5G TDD-based systems affecting both the DL and UL. Dubbed “Scrubbing,” this attack utilizes a USRP to artificially suppress the number of active network users in a macro cell. By forcing legitimate users off the cell, the attacker can execute a Man-in-the-Middle (MitM) exploit, sniffing and decoding RLC payloads and SDAP packets to extract sensitive data, including passwords. While severe, a viable machine learning-based mitigation strategy has been developed and needs to be validated.
The attack targets the Physical Broadcast Channel (PBCH) to disrupt cell acquisition.
-
Cell Suppression: The attacker uses a USRP tuned to the carrier frequency of 3.5 GHz, transmitting specifically across a 7.2 MHz bandwidth (240 subcarriers PBCH).
-
Sync Loss: This targeted interference distorts the PBCH in specific subframes. As a result, the PBCH RSRP drops significantly below -118 dBm.
-
Cell Selection Failure: Legitimate UEs attempting to connect fail the S-Criterion check due to the low RSRP, preventing them from detecting or joining the cell. They are forced to hand over or connect to neighboring cells.
-
Packet Sniffing & Decryption: Existing users with active sessions do not experience immediate call drops, masking the attack. However, for dropped or target users, the attacker sniffs the RLC payloads. By running long-duration checksum analysis, the attacker can compromise security keys, de-authenticate SDAP packets, and decrypt user data.
During a live network log analysis , the following exposed the attack:
-
Network-Side Logs: Showed no unusual data drops, and active users maintained stable traffic without call drops.
-
UE-Side Logs: Exhibited highly anomalous behavior, failing cell selection despite a seemingly healthy macro environment.
-
Fronthaul (FH) Capture: A deep-dive Fronthaul packet capture revealed that the 240 subcarriers dedicated to the PBCH were heavily distorted only during specific subframes, confirming localized, deliberate interference rather than general path loss.
Mitigating this exploit at the UE level requires advanced, computationally heavy processing to filter out the malicious distortion.
- Uplink : To combat Uplink distortion (specifically targeting the PUCCH), a 3-Layer Neural Network was developed. It was trained on historical dataset formats for all PUCCH variations.
- Downlink : The same neural network architecture was applied to the PBCH, utilizing previously stored Cell IDs from historical logs.
Results: Python simulations yielded highly successful results, allowing the UE to accurately decode the distorted PBCH and successfully attach to the network despite the presence of the USRP jammer. The solution is also designed to scale seamlessly for Massive MIMO environments.
The Algorithm took around 20 mins to train the network with previous data and was able to reach epoch in approximately 7.2ms which is sub-optimal.
The code is developed in Python and will share this in git sometime.
LinkedIn: 