Date Published: September 30, 2026
Comments Due:
Email Comments to:
Author(s)
Michael Bartock (NIST), Jeffrey Cichonski (NIST), Parisa Grayeli (MITRE), Sanjeev Sharma (MITRE)
Announcement
This initial public draft details how the availability of inexpensive, off-the-shelf hardware and software tools allows attackers to mimic legitimate carrier equipment to intercept and disrupt cellular communications. The paper evaluates how 5G devices respond to six simulated false base station scenarios and examines protections available to mitigate risks.
Background
This white paper is part of the NCCoE’s work to accelerate the adoption of 5G security features by demonstrating their implementation on NCCoE’s operational 5G security testbed and providing actionable implementation guidelines to help network operators and other stakeholders enhance the cybersecurity and privacy of 5G systems and supporting infrastructures.
A false (aka Rogue or Fake) Base Station (FBS) impersonates a real carrier radio access network. It transmits and receives radio signals that mimic a legitimate 5G cell and tricks unsuspecting User Equipment (UE) to connect to it. This can result in cybersecurity risks, including service degradation, privacy breaches, and location tracking for the user. Although 5G standards include greater security features than previous generations to protect subscribers, they are still susceptible to Denial-of-Service (DoS) attacks.
About the White Paper
This white paper evaluates six FBS scenarios (simulated in the NCCoE’s 5G Security lab) to assess how the tested 5G devices respond to FBS attacks and identify areas for improvement in standards and available device-configurable protections.
By demonstrating security features on our operational 5G Testbed, we aim to deliver real-world implementation insights to advance 5G security and inform the next generation of wireless security technologies and standards.
NIST is particularly interested in your feedback on the following questions:
- How do you envision using this paper? What changes would you like to see to improve that use?
- What additional information would you like this paper to provide?
- What other 5G cybersecurity and privacy capabilities are you most interested in learning more about?
Submit Your Feedback!
This white paper is available for public comment through October 30, 2026. Visit the NCCoE project page to learn more and download the white paper today!
This white paper is part of a series called Applying 5G Cybersecurity and Privacy Capabilities, which covers 5G cybersecurity- and privacy-supporting capabilities that were implemented as part of the 5G Cybersecurity testbed at the National Cybersecurity Center of Excellence (NCCoE). This white paper provides details regarding security risks posed by False Base Stations (FBS) in 5G networks. It details how the availability of inexpensive, off-the-shelf hardware and software tools allows attackers to simulate legitimate cells and exploit pre-authentication vulnerabilities. Incremental standards improvements over several generations have addressed many of the risks posed by FBS, limiting privacy breaches and location tracking for users and making FBS less effective against 5G devices. This white paper evaluates multiple FBS scenarios using the NCCoE 5G Cybersecurity testbed to assess how the tested 5G devices respond to FBS attacks, including when they are still vulnerable to Denial-of-Service (DoS) attacks. It identifies areas for improvement in standards and available device-configurable protections.
This white paper is part of a series called Applying 5G Cybersecurity and Privacy Capabilities, which covers 5G cybersecurity- and privacy-supporting capabilities that were implemented as part of the 5G Cybersecurity testbed at the National Cybersecurity Center of Excellence (NCCoE). This white...
See full abstract
This white paper is part of a series called Applying 5G Cybersecurity and Privacy Capabilities, which covers 5G cybersecurity- and privacy-supporting capabilities that were implemented as part of the 5G Cybersecurity testbed at the National Cybersecurity Center of Excellence (NCCoE). This white paper provides details regarding security risks posed by False Base Stations (FBS) in 5G networks. It details how the availability of inexpensive, off-the-shelf hardware and software tools allows attackers to simulate legitimate cells and exploit pre-authentication vulnerabilities. Incremental standards improvements over several generations have addressed many of the risks posed by FBS, limiting privacy breaches and location tracking for users and making FBS less effective against 5G devices. This white paper evaluates multiple FBS scenarios using the NCCoE 5G Cybersecurity testbed to assess how the tested 5G devices respond to FBS attacks, including when they are still vulnerable to Denial-of-Service (DoS) attacks. It identifies areas for improvement in standards and available device-configurable protections.
Hide full abstract
Keywords
3GPP; 5G; cybersecurity; privacy; False Base Station; Fake Base Station; Rogue Base Station; Software Defined Radio
Control Families
None selected
