## 7 Summary and Discussion  
5G networks are considered a cornerstone for the information exchange in our digital mobile societies. While the goal is to deploy 5G Stand-Alone networks to replace the LTE technology, 5G Non-Stand-Alone networks are widely in use to provide a smooth transition phase. The timeline for a complete shift from 5G NSA to 5G SA remains uncertain, underscoring the importance of 5G NSA security. Therefore, in this work, we investigate potential attacks against 5G NSA networks, specifically over the radio interface. Conducting an extensive literature review, we compiled the first taxonomy of possible attacks against 5G NSA networks and categorized them based on the attack vector. At the highest level, our taxonomy classifies attacks based on the attacker's capabilities, distinguishing between active or passive attacks. Within the realm of active attacks, we identified three techniques: radio jamming, signal overshadowing, and message attacks. Signal overshadowing attacks are grouped by the underlying common vulnerability they exploit. Message attacks involve three types of rogue devices--fake base station, fake UE, and MITM relay. Each rogue device is associated with potential attacks, which are further classified based on additional criteria. These rogue devices can be deployed using open-source hardware and software [11, 42]. Furthermore, we provide a succinct summary of all the attacks encompassed in our taxonomy, serving as a comprehensive reference and an analytical resource. Notably, our work reveals that a significant number of attacks from 4G networks can potentially be transferred to 5G NSA networks. To assess previously unexplored threats in 5G NSA networks, we selected and implemented three attacks. These attacks could be conducted with affordable resources and pose severe consequences for the user. We constructed a testbed and examined common 5G COTS smartphones to determine if they are vulnerable to these attacks. Our findings underscore the efficacy of these attacks. Specifically, the IMSI Leak attack performed as anticipated on all tested UEs with no apparent avenue for security patching in 5G NSA networks. This raises significant concerns about the ease of tracking individuals on current 5G networks. Regarding the Downgrade and Numb attacks, our findings indicated that half of the tested UEs did not employ a quick recovery timer to mitigate the effects of these attacks. For companies planning to invest in private 5G networks [13] (Campus Networks) and having flexibility in choosing between 5G SA and 5G NSA, we highly recommend opting for 5G SA over 5G NSA due to the described attacks in this work. Additionally, we advise thorough testing of the UEs intended for deployment to ensure they possess a fast recovery mechanism against attacks based on unauthenticated Reject [21] messages such as Authentication Reject messages, which could lead to a DoS attack and hamper the working on important tasks. Overall, we have demonstrated that current 5G networks can provide the user with a false sense of security since the new 5G security mechanisms are only available in 5G Stand-Alone networks. Multiple future tasks arise from the results of this study. Additional attacks that have been presented in this work should be validated against 5G NSA networks while the variety of investigated UEs should be increased. A valuable contribution might be to integrate the attacks into a security audit framework to automatically conduct such tests with every new generation of UEs to help track the vulnerabilities and mitigation capabilities of different UE implementations over time [26, 44]. Conceptualization, M.S.W., M.R. and M.K. ; methodology, M.S.W., M.R. and M.K. ; software, M.S.W. and T.H. ; validation, M.S.W. and T.H. ; investigation, M.S.W. and T.H. ; writing--original draft preparation, M.S.W., M.R., M.K. and T.H. ; writing--review and editing, M.S.W., M.R. M.K. and T.H. ; supervision, M.R. and M.K. ; project administration, M.R. and M.K. ; funding acquisition, M.R. and M.K.