Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 45

5G Bidding-Down Attacks Explained

Recommended resources

Introduction

Welcome to our new module on 5G vulnerabilities. In the previous lesson, we concluded our look at 5G's architectural security enhancements, establishing how features like SUPI concealment and User Plane Integrity Protection were designed to fix known 4G weaknesses. However, we ended on a critical note: the need for backward compatibility with older, less secure networks remains a significant challenge.

This lesson dives straight into the most potent threat that arises from this backward compatibility. Our learning outcome is to explain how bidding-down attacks can force a 5G device to connect to a lower-generation network. These attacks, also known as downgrade attacks, are a cornerstone of modern cellular interception, as they allow an adversary to bypass 5G's advanced protections and force a target device onto a network like 4G or even 2G, where well-known vulnerabilities can be exploited.

The Vulnerability Window: Unprotected Signaling

Before we break down the attack, it's essential to understand why it's possible. The vulnerability lies in the very first steps of the network registration process. When your phone first tries to connect to a network, it exchanges a series of essential messages before any encryption or integrity protection is activated.

This initial exchange is a classic "chicken-and-egg" problem: the device and network need to communicate to establish a secure channel, but that initial communication is itself insecure. An attacker can exploit this window by impersonating a legitimate base station and injecting malicious messages.

5G Initial Registration and Security Setup Signaling Flow
This diagram shows the simplified sequence for establishing a secure connection in 5G. The key takeaway is that authentication and security controls (steps 2 and 3) happen *after* the initial `Registration Request` (step 1). Bidding-down attacks exploit this unprotected initial phase.

The following reading provides a concise overview of this vulnerability window.

Demystifying 5G Security: Understanding the Registration Protocol

The article 'Demystifying 5G Security' from Bishop Fox provides a clear explanation of the 5G registration process and where the security gap lies.

Please read the sections 'The 5G Registration Protocol' and 'Critical Security Vulnerabilities'. Focus on the paragraph that begins 'This means steps 1 and 2...'. It perfectly summarizes the unprotected phase that attackers exploit.

The "Downgrade Dance": Forcing a Fallback

Now that we understand the vulnerability window, let's explore how an attacker uses it. The most common technique for an inter-generation downgrade attack involves sending a spoofed NAS Reject message. This tricks the device into thinking it cannot use the modern network. The entire process is sometimes called a "Downgrade Dance" because the attacker leads the device step-by-step down the network generation ladder.

Let's examine this process using an in-depth research paper that systematically analyzed these attacks.

[PDF] Bidding-Down Attacks and Mitigations in 5G and 4G - Montsecure

The paper 'Bidding-Down Attacks and Mitigations in 5G and 4G' offers a definitive look at these attacks. We'll focus on the sections explaining the core mechanism.

Please read the following sections from the PDF: Section 3.3.1 'DoS / Downgrade': This section details how NAS Reject messages can be used to initiate a downgrade. Section 4.3.5 'Downgrade to a Lower Generation': This section presents the real-world test results, identifying the specific reject causes that successfully trigger a downgrade. Focus on the concepts of 'high-impact reject causes' and the specific examples given, like cause #27 for 5G-to-4G and cause #42 for 4G-to-2G.

To summarize and visualize the attack flow you just read about:

Step 1: Downgrade from 5G to 4G

  1. The attacker sets up a rogue 5G base station (gNB) broadcasting with a stronger signal than legitimate towers nearby.
  2. The victim's UE, seeking the best signal, attempts to connect and sends a Registration Request to the rogue gNB.
  3. Because this message is unprotected, the attacker can simply discard it and reply with a spoofed Registration Reject message. This message contains Reject Cause #27: "N1 Mode Not Allowed."
  4. As defined in the 3GPP standards, this cause code instructs the UE to disable its 5G Standalone capabilities and search for a 4G (or older) network.

Step 2: Downgrade from 4G to 2G

The dance continues. The attacker anticipates the UE's next move.

  1. The attacker also operates a rogue 4G base station (eNB), to which the UE now attempts to connect.
  2. The UE sends an Attach Request or Tracking Area Update (TAU) Request.
  3. The attacker's rogue eNB intercepts this and replies with a spoofed Tracking Area Update Reject message. This time, it uses Reject Cause #42: "Severe network failure."
  4. This cause code instructs the UE to stop trying to connect to any 4G networks from that operator and fall back further. The next logical step for the UE is to search for a 2G/GSM network.

At this point, the device connects to the attacker's 2G base station, where decades-old vulnerabilities (like weak A5/1 encryption and lack of mutual authentication) can be used to intercept calls, texts, and data.

The following diagram from the research paper perfectly illustrates this two-step process.

5G Downgrade Dance Attack Sequence Diagram
This protocol flow diagram shows the 'Downgrade Dance' from 5G to 4G using Reject Cause #27, and then from 4G to 2G using Reject Cause #42. Each step exploits an unprotected NAS message to force the UE to a lower, less secure generation.

Practical Demonstration: 5Ghoul

These attacks are not just theoretical. Open-source and commercial tools exist to execute them. Your experience with command-line tools in cybersecurity will make this next resource particularly interesting. It's a demonstration of the 5Ghoul framework, which implements several 5G attacks, including a downgrade.

While the video is a detailed technical walkthrough, focus on the high-level goal and the final outcome. The operator uses an SDR (like your RTL-SDR, but a more advanced one capable of transmitting) to run a rogue gNB.

WarDragon 5Ghoul: Setup for 5G NR Vulnerabilities and Security Testing (B210, GL-M2)

This video from cemaxecuter, 'WarDragon 5Ghoul', demonstrates a real-world downgrade attack that disables 5G on a commercial modem.

Watch the demonstration from 06:35 to 17:30. You don't need to follow every single command, but observe the overall process: The attacker starts the rogue base station software (5G fuzzer). The modem manager indicates the modem is present and trying to connect. The attacker launches the exploit (vulnerability 7) just as the modem attempts to register. Observe the logs: the gNB starts, waits for the UE, launches the exploit, and then the target modem is 'not responding'. The modem is successfully prevented from using 5G. This is a practical example of the first step in our 'Downgrade Dance'.

This demonstration shows how readily available software and hardware can be used to force a modern 5G device off the 5G network, opening the door for further attacks on lower generations.

Conclusion

In this lesson, we've dissected one of the most persistent and practical threats against modern cellular networks. While 5G's architecture is a significant leap forward, its required backward compatibility provides a powerful attack vector for a determined adversary.

Key Takeaways:

  • Bidding-down (or downgrade) attacks exploit the fact that initial cellular registration messages are sent without encryption or integrity protection.
  • The primary mechanism is for a rogue base station to send a spoofed NAS Reject message with a specific cause code that forces the UE to stop trying to connect to the current network generation.
  • Attackers can chain these attacks in a "Downgrade Dance," forcing a device from 5G -> 4G -> 2G.
  • Commonly used reject causes are #27 (N1 Mode Not Allowed) to force a 5G-to-4G downgrade and #42 (Severe network failure) for a 4G-to-2G downgrade.
  • Tools like 5Ghoul demonstrate that these attacks are practical and can be executed with SDR hardware and open-source software.

Preview of the Next Lesson:

Forcing a device to a lower generation is a powerful but noisy attack. What if an attacker wants to compromise a 5G connection without such a drastic step? In our next lesson, we will explore privacy weaknesses related to null-scheme encryption and SUCI de-anonymization. These are examples of intra-generation bidding-down attacks, where the goal is not to change the network but to weaken the security within the 5G connection itself.