How Feasible are Passive Network Attacks on 5G Networks and Beyond? A Survey

TL;DR

This survey evaluates the feasibility of passive network attacks on 5G and future networks, highlighting current constraints and gaps in understanding potential threats due to technological features and hardware limitations.

Contribution

It provides a comprehensive analysis of passive attack methods in 5G and beyond, emphasizing the impact of advanced radio features and hardware costs on attack feasibility.

Findings

Passive attacks are theoretically possible in 5G but are practically constrained.

Beamforming and encryption significantly limit attack success.

Future networks like B5G/6G face high hardware barriers, reducing attack feasibility.

Abstract

Privacy concerns around 5G, the latest generation of mobile networks, are growing, with fears that its deployment may increase exposure to privacy risks. This perception is largely driven by the use of denser deployments of small antenna systems, which enable highly accurate data collection at higher speeds and closer proximity to mobile users. At the same time, 5G's unique radio communication features can make the reproduction of known network attacks more challenging. In particular, passive network attacks, which do not involve direct interaction with the target network and are therefore nearly impossible to detect, remain a pressing concern. Such attacks can reveal sensitive information about users, their devices, and active applications, which may then be exploited through known vulnerabilities or spear-phishing schemes. This survey examines the feasibility of passive network attacks in 5G and beyond (B5G/6G) networks, with emphasis on two major categories: information extraction (system identification, website and application fingerprinting) and geolocation (user identification and position tracking). These attacks are well documented and reproducible in existing wireless and mobile systems, including short-range networks (IEEE 802.11) and, to a lesser extent, LTE. Current evidence suggests that while such attacks remain theoretically possible in 5G, their practical execution is significantly constrained by directional beamforming, high-frequency propagation characteristics, and encryption mechanisms. For B5G and early 6G networks, the lack of public tools and high hardware cost currently renders these attacks infeasible in practice, which highlights a critical gap in our understanding of future network threat models.