A Physical-Layer Attack on 5G MIMO via Perturbation of Silent Pilots

Abstract

5G NR achieves high spectral efficiency through advanced multi-antenna techniques that rely on accurate Channel State Information (CSI) feedback. This paper presents a live demonstration of a PHY-layer attack targeting the CSI Reference Signal (CSI-RS) acquisition process in 5G NR. The attack specifically exploits vulnerabilities inherent in the Zero Power CSI-RS (ZP-CSI-RS) resources acquisition process of a victim UE. The goal of the demonstrated attack is to selectively perturb the ZPCSI-RS resources. Indeed, an attacker can bias the UE channel quality estimation through narrowband, time-frequency-selective jamming, leading to a reduction of the reported Rank Indicator (RI) and a forced downgrade of the MIMO configuration.The demonstration is implemented on a commercial 5G SA network using software-defined radios and a dashboard to visualize, in real time, the impact of the attack on the victim UE. By monitoring throughput, MIMO rank, and spectral occupancy, the live demonstration shows an immediate transition from multilayer to single-layer transmission and throughput losses of up to 70%. These results highlight a vulnerability in 5G NR and motivate the need for enhanced protection mechanisms for silent reference signals in future mobile networks.