Passive Multi-Target GUTI Identification via Visual-RF Correlation in LTE Networks
Byeongdo Hong
Network and Distributed System Security (NDSS) Symposium 2026 · Day 3 · Covert Sensing
This research demonstrates a **fully passive** method to identify users' **GUTI (Globally Unique Temporary Identifier)** in LTE networks by correlating **camera observations** with **RF signal captures**. By watching when users interact with their phones (visual events) and matching those to data scheduling bursts on the air interface (RF events), an attacker can progressively narrow down which GUTI belongs to which person. The method achieves **97% GUTI extraction success** and **94% verification success** for up to **10 devices simultaneously** within a single camera field of view, typically requiring only about **three interactions per device**.
AI review
A practical passive GUTI identification attack using camera + SDR correlation that achieves 97% success on up to 10 simultaneous targets. The FSM-based approach requiring only ~3 interactions per device is operationally viable, and the attack enables location tracking, targeted DoS, and traffic fingerprinting. The Q&A revealing that even 5G operators don't update GUTIs despite mandatory requirements makes this immediately relevant.