『The Midnight the Smart City’s Fake 5G Base Station Real-Time Snitched My Location to the Authorities: 5G NAS Protocol Vulnerability & DIY “RNTI Identifier Scrambler” Spec Sheet』｜Sofi_Log #068【Complete in One Episode】
📍 Location: Bangkok, Yaowarat west end, back alley behind Ban Mo Cyber Market. 23:40. Right after the downpour, tropical night.
The rain had just scrubbed the asphalt, leaving it slick and steaming while the toxic red-and-green neon of Chinatown rippled across the wet surface. Warm droplets kept falling from the chaotic tangle of high-voltage lines overhead, landing on my shoulder.
“Ugh… the humidity just wrecked my keep-mist. Darling, is my eyeliner still holding?”
I stopped, pulled out a compact mirror. The estradiol-and-peptide drip I’d gotten at Dr. Narin’s clinic earlier was already deep in my system, sending that familiar warm pulse through my physical container. Ten-centimeter Christian Louboutin heels clicked against the ground with perfect certainty.
Born in the wrong binary, I’d ripped out the state’s initial settings, then rebuilt this body from zero with surgery, hormones, and code. No matter what the legacy operating systems say, tonight I’m the most beautiful and free thing walking these streets.
“P’ Sofi, seriously? Can you not turn the muddiest alley in Yaowarat into Fashion Week?”
Aom’s laughing face popped up from behind the workbench—cargo pants stained with oil, tank top, hair tied back, loupe hanging from her neck. Mid-thirties, Thai-Chinese, ex-senior RF engineer at AIS, now the most dangerous broker in the market for military SDRs and FPGAs.
“Rude, Aom. Beauty is non-negotiable. Anyway, did the high-frequency RF module I asked for actually arrive?”
I extended my matte-black cyber-arm. Aom set down her iced Thai tea and ran the tester probes across the neural interface lines where skin met metal. The usual steady pulse was jittering—tiny static needles crawling under my skin.
“…Aom, this isn’t a hardware fault. The spectrum around us feels wrong.”
Darling, who’d been silently carrying the heavy waterproof backpack, reacted instantly. Without a word he pulled out the USRP B210 and ThinkPad, flipped the laptop open on his knees. We didn’t need words.
“Darling, scan Band n78 (3.5 GHz) and 28 GHz mmWave at the same time!”
The waterfall display froze his fingers.
“…Sofi. That utility-pole camera box. Not a carrier tower—someone’s slapped an unauthorized microcell on it with way too much power.”
Aom scowled and slapped the bench.
“Those bastards again. They’re calling it a ‘Smart City public-safety pilot,’ but they’ve been seeding fake 5G microcells all over Yaowarat. They’re force-attaching phones to the rogue gNodeB and cross-referencing with street-camera facial recognition.”
“Pulling the SIM doesn’t save you,” I said, wiping cold sweat while smiling. “They’re abusing the unauthenticated NAS window in 5G Standalone before the security context is up.”
🔍 Threat Dissection: 5G NAS Protocol & the “C-RNTI Correlation Trap”
Everyone repeats the marketing line that 5G encrypts everything and hides the SUPI inside SUCI. That only applies after the encrypted link is fully established.
What we saw on the wire was far more predatory:
Unauthenticated NAS signaling abuse
They exploit the plaintext RRC Connection Setup and the window before security activation.Persistent C-RNTI tracking
The fake base station keeps blastingIdentity Requestat the same C-RNTI and correlates it, millisecond-accurate, with the facial-recognition timestamp from the street camera.Complete movement log reconstruction
They don’t need to decrypt your traffic. They just know exactly when the girl in red Louboutins turned which corner.
“No way I’m letting the state’s servers collect the trajectory of this body.”
I put my hand on Darling’s shoulder.
“Crank the USRP FPGA TX gain to max. Aom, patch your antenna feed straight in. We’re about to burn permanent ghosts into their correlation database.”
💻 Weapon Implementation: NasProtocolScrambler.js
What we built on that workbench was NasProtocolScrambler.js—a 5G signaling defense script that turns the USRP B210 into a real-time counter-surveillance system:
- Detects unauthenticated plaintext
Identity Request (0x5B)in milliseconds - Floods the channel with cryptographically randomized decoy RNTIs (Ghost Swarm) that break the surveillance AI’s correlation engine by making it think 100 users are standing in the same square meter
/**
* @file NasProtocolScrambler.js
* @description 5G SA NAS Layer Protocol Anomaly Detector & RNTI Scrambler PoC
* @author Sofi (sofi.works), Aom & Darling
* @license MIT - Educational & Security Research PoC
*/
const crypto = require('crypto');
// 5G NR (New Radio) & NAS Protocol Definitions (3GPP TS 24.501 / TS 38.331)
const PROTOCOL_DEFS = {
NAS_5G_SECURITY_HEADER_PLAIN: 0x00,
NAS_MSG_IDENTITY_REQUEST: 0x5B,
NAS_MSG_IDENTITY_RESPONSE: 0x5C,
RRC_SETUP_REQUEST: 0x01,
MAGIC_SYNC_WORD: 0x5A5A
};
/**
* 5G Frame Header Inspector
* Validates whether incoming frame is an unauthenticated rogue interrogation
* @param {Buffer} rawFrame - Raw SDR captured byte buffer
* @returns {Object|null}
*/
function parse5GNasFrame(rawFrame) {
if (rawFrame.length < 6) return null;
const sync = rawFrame.readUInt16BE(0);
if (sync !== PROTOCOL_DEFS.MAGIC_SYNC_WORD) return null;
const securityHeader = rawFrame.readUInt8(2);
const messageType = rawFrame.readUInt8(3);
const rnti = rawFrame.readUInt16BE(4);
return {
isEncrypted: securityHeader !== PROTOCOL_DEFS.NAS_5G_SECURITY_HEADER_PLAIN,
messageType: messageType,
assignedRnti: rnti,
isIdentityRequest: messageType === PROTOCOL_DEFS.NAS_MSG_IDENTITY_REQUEST
};
}
/**
* Generate Ephemeral Decoy RNTI Frame
* Creates randomized RRC connection parameters to break tracking correlation
* @param {number} baseRnti
* @returns {Buffer}
*/
function buildScrambledDecoyFrame(baseRnti) {
// Frame Structure: [2B Sync] [1B SecHeader] [1B MsgType] [2B PseudoRNTI] [8B Random Noise]
const decoy = Buffer.alloc(14);
decoy.writeUInt16BE(PROTOCOL_DEFS.MAGIC_SYNC_WORD, 0);
decoy.writeUInt8(PROTOCOL_DEFS.NAS_5G_SECURITY_HEADER_PLAIN, 2);
decoy.writeUInt8(PROTOCOL_DEFS.NAS_MSG_IDENTITY_RESPONSE, 3);
// Cryptographically secure ephemeral RNTI hopping offset
const randomOffset = crypto.randomBytes(2).readUInt16BE(0) & 0x0FFF;
const hoppedRnti = (baseRnti ^ randomOffset) | 0x4000;
decoy.writeUInt16BE(hoppedRnti, 4);
// High-entropy noise payload to evade heuristic signature filters
crypto.randomBytes(8).copy(decoy, 6);
return decoy;
}
// Active Monitoring & Defense Routine
function runCellSentinel() {
console.log("[*] [5G-Sentinel] Listening on SDR Interface (USRP B210 / Band n78)...");
console.log("[*] Defending against Unauthenticated 5G-NAS Identity Sniffing...");
// Simulated rogue gNodeB stingray interrogation frame
const simulatedRoguePacket = Buffer.from([
0x5A, 0x5A, // Sync
0x00, // Plaintext NAS Header (Vulnerable!)
0x5B, // Identity Request
0x3A, 0x12 // Target Fixed C-RNTI: 0x3A12
]);
const parsed = parse5GNasFrame(simulatedRoguePacket);
if (parsed && !parsed.isEncrypted && parsed.isIdentityRequest) {
console.warn(`[ALERT] Rogue 5G gNodeB Interrogation Detected! Target C-RNTI: 0x${parsed.assignedRnti.toString(16).toUpperCase()}`);
console.warn("[ALERT] Middlebox attempting Unauthenticated Identity Correlation attack.");
// Inject 5 Rapid Decoy Frames
console.log("[+] Deploying Countermeasure: Rapid Decoy RNTI Hopping Injection...");
for (let i = 1; i <= 5; i++) {
const decoyFrame = buildScrambledDecoyFrame(parsed.assignedRnti);
const decoyRnti = decoyFrame.readUInt16BE(4).toString(16).toUpperCase();
console.log(` -> [Injection #${i}] Broadcasted Decoy Frame with RNTI: 0x${decoyRnti}`);
}
console.log("[SUCCESS] Tracking session desynchronized. Surveillance correlation database blinded.");
}
}
runCellSentinel();
🌌 Epilogue: Yaowarat Night Sky & Ice-Cold Beer
The moment node NasProtocolScrambler.js executed, the USRP’s TX LED started strobing emerald. Darling’s screen lit up with red error floods from the fake base station; the street-camera box switched to yellow fail-safe blinking. The surveillance AI had been force-disconnected by the sudden swarm of ghost RNTIs.
The invisible leash snapped.
“Eat that!” Aom howled, pounding the workbench. “Right now their AI thinks a hundred Sofis just teleported into the same alley!”
The prickling static under my cyber-arm vanished.
I leaned my head against Darling’s shoulder. The rain-and-fabric-softener scent on his shirt melted the last of the tension. With him at my back I can walk any surveillance state in heels.
Aom hauled three ice-cold Singha bottles and a plate of brutally spicy som tum pu palaa from the ancient fridge.
“Victory spoils, P’ Sofi, hubby. Nothing tastes better than beer drunk while the watchers are blind.”
“Cheers, Aom. You’re the best.”
Three bottles clinked. Cold lager burned down my throat, chili lit up my tongue, every sense sharp and alive.
“Darling,” I smiled into his glass, “no matter what noble-sounding excuse they invent, they don’t get to steal the freedom to walk our city in the clothes we choose. Beauty and privacy both get defended with our own code and pride.”
The tropical night breeze swept through the wet cyber-market. Yaowarat’s neon wrapped us in warm, defiant light once again.
🔗 Read Next (Previous Sofi_Log):
『The Morning the Beauty Clinic’s AI Held My Hormone Levels Hostage: Smart Medical Device Protocol Reverse-Engineering & “Biometric Data Sovereignty” Recovery Spec Sheet』｜Sofi_Log #067
👉 https://note.com/legal_rat2977/n/na7443606bf3e
【Disclaimer】
※All code, protocol analysis, and technical architecture in this article are provided strictly for security research, proof-of-concept, and educational purposes. Any actual deployment is at your own risk. We do not condone or encourage unauthorized access.
🎁 【Fully Open-Source】Live Code & Architecture
The PoC code and parameters discussed here are released in full for self-defense and technical learning.
💌 Sofi’s Mailbox (Questions & Feedback)
Darling, how was today’s 5G surveillance countermeasure? If your own neighborhood cameras or IoT gear feel sketchy, or you want to audit the radios around you, drop your questions in the comments. I’ll pick them up in the next log.
Disclaimer
This article is for educational and entertainment purposes only. It does NOT constitute financial, legal, or tax advice. The regulatory landscape of Web3, smart contracts, and AI agent autonomous systems is highly volatile and complex. Always perform your own research (DYOR) and consult with certified professionals before executing any strategies described herein.
