Tests conducted by the National Institute of Standards and Technology (NIST) found that 5G devices remain vulnerable to attacks that can knock them offline, despite security improvements designed to protect cellular communications.
In its draft white paper, NIST CSWP 36G, False Base Station, researchers tested six simulated attacks involving rogue cell towers, which impersonate legitimate cellular infrastructure. All six successfully disrupted service to the devices tested, even as 5G's stronger security protections have made it harder for attackers to intercept communications or access subscriber information.
The equipment needed to carry out these attacks is no longer limited to well-funded adversaries. Relatively inexpensive, commercially available radio hardware and open-source software have made rogue cell tower capabilities accessible to a wider group of potential attackers.
NIST's tests expose a weakness that stronger encryption and authentication alone can’t address—a cellular connection can be secure against unauthorized access and still be vulnerable to disruption.
How Rogue Cell Towers Exploit 5G Security Gaps
False base stations impersonate legitimate cell towers, broadcasting signals that can cause nearby phones to attempt to connect to them instead of their carrier's network. Once a device attempts to connect, an attacker can manipulate the connection process to disrupt service.
In earlier generations of cellular technology, these attacks could also expose subscriber identities, reveal users' locations and allow communications to be intercepted. 5G introduced stronger authentication and privacy protections to address many of those weaknesses. But a gap remains in the way devices establish connections.
Before a phone and cellular network authenticate each other, the phone must process certain signals that it cannot yet verify as legitimate. A rogue base station can exploit that window to interfere with the connection, causing a denial of service without breaking encryption or gaining access to protected data.
“Denial-of-service is the attack where a locked door is still a failure,” said Jacob Krell, Senior Director of Secure AI Solutions & Cybersecurity at Suzu Labs. “An attacker does not need to get inside. They only need to stand in the doorway and stop everyone else from getting through. That is why these attacks are so hard to prevent; normal security and recovery rules can become the thing that keeps legitimate users out.”
What NIST's Six Attack Scenarios Revealed
To see how these weaknesses play out, NIST researchers used their operational 5G security testbed to simulate dsix attacks targeting the connection and registration process. Each produced a denial-of-service condition, though the devices behaved differently depending on the attack.
In some scenarios, devices repeatedly tried to register with the rogue tower instead of connecting to a legitimate network. These continuous attempts could also increase battery consumption as devices repeatedly transmitted registration requests. In others, devices made several failed connection attempts, then stopped trying for approximately 12 minutes before repeating the cycle. In certain tests, devices remained disconnected until the timeout expired, even after researchers switched off the rogue tower.
The tests also showed that 5G's authentication defenses were working in some respects. In one test, a device rejected an attempt to bypass authentication. In another, the legitimate network rejected a tampered security message. Both attacks still disrupted connectivity.
The findings come with a limitation. NIST tested specific configurations and Samsung Galaxy S22 and S23 smartphones in a controlled laboratory. The results demonstrate exploitable weaknesses, but do not establish how every commercial 5G device or network would respond.
Why the Findings Matter for Organizations Relying on 5G
As more organizations rely on 5G and private cellular networks, the consequences of losing connectivity extend beyond dropped calls and interrupted internet access. In industrial facilities, an outage could disrupt connected equipment and monitoring systems. Similar interruptions could affect infrastructure operations and public safety communications that depend on reliable cellular service.
The availability of relatively inexpensive rogue base station equipment could also make localized attacks more feasible. An attacker using commercially available hardware could disrupt cellular service near a factory, utility facility, or other targeted location without gaining access to the organization's network.
NIST did not test attacks in these real-world environments, and the impact of any disruption would depend on how the affected networks are configured. Still, the findings give security teams reason to look beyond data theft and unauthorized access when assessing cellular risks.
How Organizations Can Reduce the Risk
NIST identifies several areas where cellular security standards and device-level protections could be improved. In the meantime, organizations can take steps to improve their ability to detect disruptions and maintain connectivity.
Network operators can monitor for suspicious base stations and unusual connection behavior that may signal an attack.
“Monitoring is how operators see someone blocking the doorway,” Krell said. “Repeated connection failures, one cell suddenly overpowering its neighbors, and many devices repeating the same failed process can distinguish an active attack from an ordinary outage. The lesson applies well beyond cellular networks. Encryption protects data after a connection exists. Monitoring tells defenders when the connection itself is being deliberately prevented.”
For enterprise security teams, the more immediate task is preparing for connectivity failures. Business continuity and incident response plans should account for cellular outages, particularly where 5G supports operations that cannot tolerate prolonged interruptions. Alternative connections, including Wi-Fi and other available networks, can help maintain essential services.
Separately, organizations can use mobile device management policies, where supported, to restrict connections to older cellular networks and reduce exposure to legacy security weaknesses.
Longer-term fixes will require cooperation among device manufacturers, carriers, and standards bodies. NIST is seeking public feedback on its proposed improvements as it works to identify ways to strengthen protections against false base station attacks.
