5G-Shark: cheap fake base station still tracks 5G subscribers

Researchers from i2CAT, the University of Murcia and NEC Labs Europe built 5G-Shark, a low-cost SDR tool that lures phones onto a fake base station and tracks them via predictable temporary IDs. On three commercial networks, 84–96% of consecutive re-registrations were linkable, and crafted Registration Reject messages crashed a Samsung Galaxy S23 into retry loops or a frozen modem.

• 5G-Shark runs on open-source software and cheap SDR hardware, no jamming needed
• Team collected 3,742 temporary GUTI identifiers across three operators
• Two operators left 84–96% of consecutive registrations linkable by ID value
• Crafted Registration Reject pushed a Galaxy S23 into 3G, retry loops or a frozen modem