Research indicates that 3GPP 5G/NR and IEEE 802.11 (WiFi) protocols are susceptible to passive, non-intrusive surveillance via physical (PHY) layer vulnerabilities. By exploiting Modulation and Coding Scheme (MCS) implementation flaws and analyzing Downlink/Uplink Channel State Information (CSI), attackers can execute "pseudo-ranging" to localize targets within precise geographic rings. Utilizing Machine Learning-based modulation classification and Software Defined Radio (SDR) IQ data, adversaries can transition from coarse localization to high-fidelity tracking of mobile assets, including drones and vehicles. This enables the unauthorized construction of malicious digital twin maps and facilitates undetectable mass surveillance of users in dense wireless environments, bypassing traditional upper-layer encryption.

• Research Overview: PHY Layer Vulnerability Landscape
  • Shift in focus from upper-layer protocol vulnerabilities to the fundamental broadcast nature of the wireless physical layer.
  • Exploitation of inherent "loose ends" in Modulation and Coding Scheme (MCS) implementations.
  • Targeting of both 3GPP 5G/NR and IEEE 802.11 standards via signal-level analysis.
• Methodology: Signal-Based Localization & Tracking
  • Use of ML-based modulation classification algorithms to identify downlink signal patterns.
  • Execution of pseudo-ranging mathematical models to narrow target locations to specific rings.
  • Refinement of spatial data through uplink sniffing and Signal-to-Noise Ratio (SNR) profiling.
  • Leveraging Software Defined Radio (SDR) IQ data captures for high-precision signal manipulation.
• Technical Artifacts: Exploitation Data Structures
  • Analysis of Downlink/Uplink Channel State Information (CSI) for environmental fingerprinting.
  • Monitoring of IEEE 802.11 pre-authentication handshake sequences to capture metadata.
  • Integration of MCS tables and pseudo-ranging models to facilitate automated tracking.
• Impact: Macro-Scale Surveillance & Infrastructure Risks
  • Transition from active network intrusion to undetectable, passive signal-level eavesdropping.
  • Unauthorized tracking of mobile and stationary assets, including drones, vehicles, and pedestrians.
  • Potential for the construction of malicious digital twin maps of physical environments.
  • Escalated risk to critical infrastructure utilizing 5G core networks and Industrial IoT (IIoT).
• Conclusion: Defensive Imperatives
  • Necessity for enhanced signal-level obfuscation and modulation security in future 3GPP releases.
  • Requirement for specialized detection mechanisms capable of identifying anomalous CSI or SNR profiles.