Golden Sniffer: Low-Complexity 5G New Radio Signal Interception Exploiting Gold Sequences

Sniffing 5G New Radio (NR) transmissions presents a significantly greater challenge compared to LTE, primarily due to the concealment of Radio Network Temporary Identifiers and relevant scrambling parameters. Existing techniques rely on exhaustive searches and simplifying assumptions that often do not hold in real deployments. In this paper, we propose a fundamentally different approach that exploits the linearity and non-cryptographic nature of the Gold sequences used in 5G NR for scrambling, drastically reducing the sniffer parameter space to a handful of test alternatives. We also propose and assess a countermeasure that disrupts the phase-based demodulation reference signal reconstruction used by our approach, with only minor impact on legitimate users.