SNI5GECT: A Practical Approach to Inject aNRchy into 5G NR (USENIX Security 2025)

SNI5GECT passively sniffs pre-authentication 5G NR traffic and tracks protocol state to inject targeted downlink messages without operating a rogue base station. The authors evaluate the framework on five 5G devices with open-source and commercial base stations.

34th USENIX Security Symposium (USENIX Security 25), pp. 5385–5404