{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,22]],"date-time":"2026-04-22T19:29:08Z","timestamp":1776886148133,"version":"3.51.2"},"publisher-location":"New York, NY, USA","reference-count":36,"publisher":"ACM","license":[{"start":{"date-parts":[[2019,5,15]],"date-time":"2019-05-15T00:00:00Z","timestamp":1557878400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2019,5,15]]},"DOI":"10.1145\/3317549.3319728","type":"proceedings-article","created":{"date-parts":[[2019,5,17]],"date-time":"2019-05-17T12:52:21Z","timestamp":1558097541000},"page":"221-231","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":109,"title":["New vulnerabilities in 4G and 5G cellular access network protocols"],"prefix":"10.1145","author":[{"given":"Altaf","family":"Shaik","sequence":"first","affiliation":[{"name":"Technische Universit\u00e4t Berlin"}]},{"given":"Ravishankar","family":"Borgaonkar","sequence":"additional","affiliation":[{"name":"SINTEF Digital"}]},{"given":"Shinjo","family":"Park","sequence":"additional","affiliation":[{"name":"Technische Universit\u00e4t Berlin"}]},{"given":"Jean-Pierre","family":"Seifert","sequence":"additional","affiliation":[{"name":"Technische Universit\u00e4t Berlin"}]}],"member":"320","published-online":{"date-parts":[[2019,5,15]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"{n. d.}. SPEEDTEST. http:\/\/speedtest.net\/. ({n. d.}).  {n. d.}. SPEEDTEST. http:\/\/speedtest.net\/. ({n. d.})."},{"key":"e_1_3_2_1_2_1","unstructured":"{n. d.}. GSMArena.com. https:\/\/www.gsmarena.com\/team.php3. ({n. d.}).  {n. d.}. GSMArena.com. https:\/\/www.gsmarena.com\/team.php3. ({n. d.})."},{"key":"e_1_3_2_1_3_1","unstructured":"{n. d.}. WikiDevi. https:\/\/wikidevi.com\/wiki\/Main_Page. ({n. d.}).  {n. d.}. WikiDevi. https:\/\/wikidevi.com\/wiki\/Main_Page. ({n. d.})."},{"key":"e_1_3_2_1_4_1","unstructured":"2018. Nighthawk\u00c2\u0151 M1 Mobile Router. http:\/\/www.za.netgear.com\/landings\/nighthawk-mr1100-mobile-router\/. (2018).  2018. Nighthawk\u00c2\u0151 M1 Mobile Router. http:\/\/www.za.netgear.com\/landings\/nighthawk-mr1100-mobile-router\/. (2018)."},{"key":"e_1_3_2_1_5_1","first-page":"36300","volume-title":"Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal Terrestrial Radio Access Network (E-UTRAN)","author":"GPP.","unstructured":"3 GPP. 2013. Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal Terrestrial Radio Access Network (E-UTRAN) ; Overall description; Stage 2. TS 36.300. 3rd Generation Partnership Project ( 3GPP). http:\/\/www.3gpp.org\/DynaReport\/ 36300 .htm 3GPP. 2013. Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal Terrestrial Radio Access Network (E-UTRAN); Overall description; Stage 2. TS 36.300. 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/36300.htm"},{"key":"e_1_3_2_1_6_1","first-page":"36331","volume-title":"Evolved Universal Terrestrial Radio Access (E-UTRA)","author":"GPP.","unstructured":"3 GPP. 2013. Evolved Universal Terrestrial Radio Access (E-UTRA) ; Radio Resource Control (RRC); Protocol specification. TS 36.331.3rd Generation Partnership Project ( 3GPP). http:\/\/www.3gpp.org\/DynaReport\/ 36331 .htm 3GPP. 2013. Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification. TS 36.331.3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/36331.htm"},{"key":"e_1_3_2_1_7_1","first-page":"45820","volume-title":"Technical Specification Group GSM\/EDGE Radio Access Network","author":"GPP.","unstructured":"3 GPP. 2015. Technical Specification Group GSM\/EDGE Radio Access Network ; Cellular system support for ultra-low complexity and low throughput Internet of Things (CIoT) (Release 13). TS 45.820. 3rd Generation Partnership Project ( 3GPP). http:\/\/www.3gpp.org\/DynaReport\/ 45820 .htm 3GPP. 2015. Technical Specification Group GSM\/EDGE Radio Access Network; Cellular system support for ultra-low complexity and low throughput Internet of Things (CIoT) (Release 13). TS 45.820. 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/45820.htm"},{"key":"e_1_3_2_1_8_1","volume-title":"3rd Generation Partnership Project","author":"GPP.","unstructured":"3 GPP. 2016. 3rd Generation Partnership Project ; Technical Specification Group Radio Access Network ; Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) radio access capabilities (Release 13). TS 36.306. 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/36306.htm 3GPP. 2016. 3rd Generation Partnership Project; Technical Specification Group Radio Access Network; Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) radio access capabilities (Release 13). TS 36.306. 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/36306.htm"},{"key":"e_1_3_2_1_9_1","first-page":"24008","volume-title":"Digital cellular telecommunications system (Phase 2+) (GSM)","author":"GPP.","unstructured":"3 GPP. 2017. Digital cellular telecommunications system (Phase 2+) (GSM) ; Universal Mobile Telecommunications System (UMTS); LTE; Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 (3GPP TS 24.008 version 14.4.0 Release 14). TS 24.008. 3rd Generation Partnership Project ( 3GPP). http:\/\/www.3gpp.org\/DynaReport\/ 24008 .htm 3GPP. 2017. Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 (3GPP TS 24.008 version 14.4.0 Release 14). TS 24.008. 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/24008.htm"},{"key":"e_1_3_2_1_10_1","volume-title":"3rd Generation Partnership Project (3GPP)","author":"Evolved Universal Terrestrial Radio GPP.","unstructured":"3 GPP. 2017. LTE; Evolved Universal Terrestrial Radio Access (E-UTRA); Packet Data Convergence Protocol (PDCP) specification (3GPP TS 36.323 version 14.3.0 Release 14). TS 36.323. 3rd Generation Partnership Project (3GPP) . http:\/\/www.3gpp.org\/DynaReport\/36323.htm 3GPP. 2017. LTE;Evolved Universal Terrestrial Radio Access (E-UTRA); Packet Data Convergence Protocol (PDCP) specification (3GPP TS 36.323 version 14.3.0 Release 14). TS 36.323. 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/36323.htm"},{"key":"e_1_3_2_1_11_1","first-page":"401","article-title":"3GPP System Architecture Evolution (SAE); Security architecture","volume":"33","author":"GPP.","year":"2018","unstructured":"3 GPP. 2018 . 3GPP System Architecture Evolution (SAE); Security architecture . Technical Specification (TS) 33 . 401 . 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/33401.htm 3GPP. 2018. 3GPP System Architecture Evolution (SAE); Security architecture. Technical Specification (TS) 33.401. 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/33401.htm","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_12_1","first-page":"501","article-title":"Security architecture and procedures for 5G System","volume":"33","author":"GPP.","year":"2018","unstructured":"3 GPP. 2018 . Security architecture and procedures for 5G System . Technical Specification (TS) 33 . 501 . 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/33501.htm 3GPP. 2018. Security architecture and procedures for 5G System. Technical Specification (TS) 33.501. 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/33501.htm","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_13_1","first-page":"185","article-title":"Service requirements for V2X services","volume":"22","author":"GPP.","year":"2018","unstructured":"3 GPP. 2018 . Service requirements for V2X services . Technical Specification (TS) 22 . 185 . 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/22185.htm 3GPP. 2018. Service requirements for V2X services. Technical Specification (TS) 22.185. 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/22185.htm","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_14_1","first-page":"501","article-title":"System architecture for the 5G System (5GS)","volume":"23","author":"GPP.","year":"2018","unstructured":"3 GPP. 2018 . System architecture for the 5G System (5GS) . Technical Specification (TS) 23 . 501 . 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/23501.htm 3GPP. 2018. System architecture for the 5G System (5GS). Technical Specification (TS) 23.501. 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/23501.htm","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_15_1","first-page":"24301","volume-title":"Universal Mobile Telecommunications System (UMTS);LTE","author":"GPP.","unstructured":"3 GPP. 2018. Universal Mobile Telecommunications System (UMTS);LTE ; 5G; Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 Release 15. TS 24.301. 3rd Generation Partnership Project ( 3GPP). http:\/\/www.3gpp.org\/DynaReport\/ 24301 .htm 3GPP. 2018. Universal Mobile Telecommunications System (UMTS);LTE; 5G; Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 Release 15. TS 24.301. 3rd Generation Partnership Project (3GPP). http:\/\/www.3gpp.org\/DynaReport\/24301.htm"},{"key":"e_1_3_2_1_16_1","unstructured":"Apple Inc. {n. d.}. Apple security updates. https:\/\/support.apple.com\/en-us\/HT201222. ({n. d.}).  Apple Inc. {n. d.}. Apple security updates. https:\/\/support.apple.com\/en-us\/HT201222. ({n. d.})."},{"key":"e_1_3_2_1_18_1","unstructured":"Ettus. {n. d.}. USRP B210. ({n. d.}). http:\/\/www.ettus.com\/product\/details\/UB210-KIT  Ettus. {n. d.}. USRP B210. ({n. d.}). http:\/\/www.ettus.com\/product\/details\/UB210-KIT"},{"key":"e_1_3_2_1_19_1","unstructured":"Google Inc. {n. d.}. Android Security Bulletin. https:\/\/source.android.com\/security\/bulletin. ({n. d.}).  Google Inc. {n. d.}. Android Security Bulletin. https:\/\/source.android.com\/security\/bulletin. ({n. d.})."},{"key":"e_1_3_2_1_20_1","unstructured":"GSM-R. {n. d.}. ({n. d.}). https:\/\/en.wikipedia.org\/wiki\/GSM-R  GSM-R. {n. d.}. ({n. d.}). https:\/\/en.wikipedia.org\/wiki\/GSM-R"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/TWC.2010.01.090935"},{"key":"e_1_3_2_1_24_1","volume-title":"2008 3rd International Symposium on Communications, Control and Signal Processing. 1096--1102","author":"Haataja K. M. J.","unstructured":"K. M. J. Haataja and K. Hypponen . 2008. Man-In-The-Middle attacks on bluetooth: a comparative analysis, a novel attack, and countermeasures . In 2008 3rd International Symposium on Communications, Control and Signal Processing. 1096--1102 . K. M. J. Haataja and K. Hypponen. 2008. Man-In-The-Middle attacks on bluetooth: a comparative analysis, a novel attack, and countermeasures. In 2008 3rd International Symposium on Communications, Control and Signal Processing. 1096--1102."},{"key":"e_1_3_2_1_25_1","unstructured":"Huawei Technologies Co. Ltd. {n. d.}. All Bulletins - PSIRT. https:\/\/www.huawei.com\/en\/psirt\/all-bulletins. ({n. d.}).  Huawei Technologies Co. Ltd. {n. d.}. All Bulletins - PSIRT. https:\/\/www.huawei.com\/en\/psirt\/all-bulletins. ({n. d.})."},{"key":"e_1_3_2_1_26_1","volume-title":"eRAN2.0 Feature Description. https:\/\/www.scribd.com\/document\/132066434\/Huawei-LTE-eRAN2-1-Feature-Description-doc. (Sept","author":"HUAWEI TECHNOLOGIES CO., LTD.","year":"2010","unstructured":"HUAWEI TECHNOLOGIES CO., LTD. 2010. eRAN2.0 Feature Description. https:\/\/www.scribd.com\/document\/132066434\/Huawei-LTE-eRAN2-1-Feature-Description-doc. (Sept . 2010 ). HUAWEI TECHNOLOGIES CO., LTD. 2010. eRAN2.0 Feature Description. https:\/\/www.scribd.com\/document\/132066434\/Huawei-LTE-eRAN2-1-Feature-Description-doc. (Sept. 2010)."},{"key":"e_1_3_2_1_27_1","volume-title":"IoT SENTINEL: Automated Device-Type Identification for Security Enforcement in IoT. In 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS)","volume":"00","author":"Miettinen M.","unstructured":"M. Miettinen , S. Marchal , I. Hafeez , N. Asokan , A. Sadeghi , and S. Tarkoma . 2017 . IoT SENTINEL: Automated Device-Type Identification for Security Enforcement in IoT. In 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS) , Vol. 00 . 2177--2184. M. Miettinen, S. Marchal, I. Hafeez, N. Asokan, A. Sadeghi, and S. Tarkoma. 2017. IoT SENTINEL: Automated Device-Type Identification for Security Enforcement in IoT. In 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), Vol. 00. 2177--2184."},{"key":"e_1_3_2_1_28_1","volume-title":"Mobile Subscriber WiFi Privacy. In 2017 IEEE Security and Privacy Workshops (SPW). 169--178","author":"O\u00e2\u0102 P.","unstructured":"P. O\u00e2\u0102 ŹHanlon, R. Borgaonkar , and L. Hirschi . 2017 . Mobile Subscriber WiFi Privacy. In 2017 IEEE Security and Privacy Workshops (SPW). 169--178 . P. O\u00e2\u0102ŹHanlon, R. Borgaonkar, and L. Hirschi. 2017. Mobile Subscriber WiFi Privacy. In 2017 IEEE Security and Privacy Workshops (SPW). 169--178."},{"key":"e_1_3_2_1_29_1","unstructured":"Qualcomm Technologies Inc. {n. d.}. Qualcomm Technologies Inc. Security Bulletin. https:\/\/www.qualcomm.com\/company\/product-security\/bulletins. ({n. d.}).  Qualcomm Technologies Inc. {n. d.}. Qualcomm Technologies Inc. Security Bulletin. https:\/\/www.qualcomm.com\/company\/product-security\/bulletins. ({n. d.})."},{"key":"e_1_3_2_1_30_1","unstructured":"Quectel. {n. d.}. LTE BC68 NB-IoT Module. https:\/\/www.quectel.com\/product\/bc68.htm. ({n. d.}).  Quectel. {n. d.}. LTE BC68 NB-IoT Module. https:\/\/www.quectel.com\/product\/bc68.htm. ({n. d.})."},{"key":"e_1_3_2_1_31_1","volume-title":"LTE and IMSI catcher myths","author":"Borgaonkar R.","year":"2015","unstructured":"R. Borgaonkar , A. Shaik , N. Asokan , V. Niemi , J.P. Seifert . 2015. LTE and IMSI catcher myths ; Blackhat EU. https:\/\/www.blackhat.com\/docs\/eu-15\/materials\/eu-15-Borgaonkar-LTE-And-IMSI-Catcher-Myths.pdf. ( Nov. 2015 ). R.Borgaonkar, A.Shaik, N.Asokan, V.Niemi, J.P.Seifert. 2015. LTE and IMSI catcher myths; Blackhat EU. https:\/\/www.blackhat.com\/docs\/eu-15\/materials\/eu-15-Borgaonkar-LTE-And-IMSI-Catcher-Myths.pdf. (Nov. 2015)."},{"key":"e_1_3_2_1_32_1","volume-title":"Breaking LTE on Layer Two. In IEEE Symposium on Security & Privacy (SP). IEEE.","author":"Rupprecht David","year":"2019","unstructured":"David Rupprecht , Katharina Kohls , Thorsten Holz , and Christina P\u00f6pper . 2019 . Breaking LTE on Layer Two. In IEEE Symposium on Security & Privacy (SP). IEEE. David Rupprecht, Katharina Kohls, Thorsten Holz, and Christina P\u00f6pper. 2019. Breaking LTE on Layer Two. In IEEE Symposium on Security & Privacy (SP). IEEE."},{"key":"e_1_3_2_1_33_1","unstructured":"Samsung Electronics. {n. d.}. Android Security Updates - Samsung Mobile Security. https:\/\/security.samsungmobile.com\/securityUpdate.smsb. ({n. d.}).  Samsung Electronics. {n. d.}. Android Security Updates - Samsung Mobile Security. https:\/\/security.samsungmobile.com\/securityUpdate.smsb. ({n. d.})."},{"key":"e_1_3_2_1_34_1","unstructured":"Semtech Corporation. 2015. LoRa Modulation Basics - AN1200.22. (2015).  Semtech Corporation. 2015. LoRa Modulation Basics - AN1200.22. (2015)."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23236"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3212480.3212497"},{"key":"e_1_3_2_1_37_1","unstructured":"Sigfox S.A. 2017. Sigfox Technical Overview. (2017).  Sigfox S.A. 2017. Sigfox Technical Overview. (2017)."},{"key":"e_1_3_2_1_38_1","unstructured":"srsLTE. {n. d.}. ({n. d.}). https:\/\/github.com\/srsLTE\/srsLTE  srsLTE. {n. d.}. ({n. d.}). https:\/\/github.com\/srsLTE\/srsLTE"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1007\/s00779-017-1081-6"}],"event":{"name":"WiSec '19: 12th ACM Conference on Security and Privacy in Wireless and Mobile Networks","location":"Miami Florida","acronym":"WiSec '19","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control","SIGMOBILE ACM Special Interest Group on Mobility of Systems, Users, Data and Computing"]},"container-title":["Proceedings of the 12th Conference on Security and Privacy in Wireless and Mobile Networks"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3317549.3319728","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3317549.3319728","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T20:01:18Z","timestamp":1750276878000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3317549.3319728"}},"subtitle":["exposing device capabilities"],"short-title":[],"issued":{"date-parts":[[2019,5,15]]},"references-count":36,"alternative-id":["10.1145\/3317549.3319728","10.1145\/3317549"],"URL":"https:\/\/doi.org\/10.1145\/3317549.3319728","relation":{},"subject":[],"published":{"date-parts":[[2019,5,15]]},"assertion":[{"value":"2019-05-15","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}