# Survey on 5G Physical Layer Security Threats and Countermeasures
## 4 mmWave and MIMO-Specific Attacks
### User Tracking  
In [67], the authors identified several vulnerabilities in L2 MAC procedures with a combination of NR MIMO technology. One of the vulnerability is the potential to track users using SRS reference signals. SRS are applied to report channel state information, and for resource allocation optimization. SRS can be transmitted periodically, semi-persistently, or a-periodically. These modes are driven by secured RRC messages. Semi-persistent reference signals are sent at regular intervals and can be enabled or disabled via an MAC Control Element (Semi-Presistent (SP)-SRS Activation/Deactivation) [67]. Aperiodic reference signals, on the other hand, are initiated by DCI and require a single transmission. Here is an overview of the most important related threats:  
* Tracking using SRS signals: SRS is applied for assessing the channel conditions over the entire UL frequency range and for transmitting UL mMIMO pilot signals. The attacker can use this in three ways. Firstly, since it is an unexpected UL transmission by the BS, it can cause interference with other UL communications arranged by the BS. This interference results in either the jamming of user data or contamination of other users' SRSs, leading to a disruption in the CSI that has been gathered. Secondly, an attacker can interrupt ongoing semi-persistent SRS transmissions by issuing a deactivation MAC Control Element to a UE. This action can significantly impair the channel estimation process at the BS, which in turn can drastically reduce the data throughput for the UE, especially in MIMO scenarios where beamforming is utilized. Lastly, the SRS is composed of a pre-established wideband Zadoff-Chu sequence, known for its excellent cross-correlation characteristics. Despite its original design not being intended for localization purposes, an attacker could exploit this signal to pinpoint the location of a specific user with a high degree of precision by measuring the differences in signal arrival times [84].
* Leakages in CSI-RS: DL channel measurement differs from SRS. CSI-RS signals are sent by the base station, and the UE reports them back. This report includes beam identifiers and signal-strength RSRP, which can be used by an attacker to track user locations. The attacker first fingerprints the cell beam layout, then decodes the UE's CSI report to obtain beam information. The authors in [67] applied a _BeamToPath_ algorithm to outlier sporadic signals and discarded impossible beam transitions. Finally, they computed path coordinates and interpolated the path for location tracking with 14 m in 90.32%, with an average error of 5.34 m, compared to the Global Positioning System (GPS)-recorded path.  
* Beam Failure Recovery (BFR) DoS: Beam management requires rapid, dynamic reconfiguration to respond the changes in the wireless environment, like signal blockage. Typically, the gNB triggers beam management processes, such as beam swapping. However, if a UE detects beam failure, it measures the strongest beam and initiates an RA procedure, including the BFR MAC control element in Msg3, signaling that the user is switching to a different beam. This process can be exploited by an attacker, causing a misalignment between the beams at the UE and gNB, since the legitimate UE is unaware of the beam switch.  
With the standardization efforts towards the 5G-Advanced and Sixth Generation (6G) of mobile communications, the Reconfigurable Intelligent Surfaces (RIS) PHY layer security must not be neglected in order to ensure secure and reliable communications in advanced wireless networks. Metasurface manipulation attacks pose potential vulnerabilities to RIS in terms of jamming [85], eavesdropping [86], pilot spoofing [87], and pilot contamination [88] attacks.