A 20 July 2026 arXiv preprint describes an attack dubbed DoSQ that can reduce a 5G user's video stream quality by roughly half. The method works by observing scheduling data that a base station transmits unencrypted, then transmitting interference on the precise radio resources allocated to that user in the same one-millisecond window [S1]. No decryption is required, no rogue base station is needed, and the victim's encrypted traffic is never accessed. The exploit targets a foundational 5G assumption: that the scheduling metadata a tower broadcasts to all nearby devices carries nothing worth concealing. What happens when that assumption breaks?

The broadcast everyone ignored

In 3GPP terms, the 5G base station is the gNB. It continually sends out Downlink Control Information, DCI, instructing each connected handset which frequency bands and time slots are available for its transmissions and receptions [S1]. This transmission reaches every device within range. The design philosophy behind 5G held that these scheduling broadcasts, viewed in isolation, disclose nothing meaningful about a connected device's actual activity [S1].

The DoSQ paper confronts that premise head-on. Using only features extracted from DCI, a trained classifier can predict a victim's Goodput, the volume of useful data successfully delivered to the application, without ever examining an encrypted payload byte [S1]. The tower's openly broadcast resource assignments give away enough to deduce how well a user's video stream is faring.

The one-millisecond window

5G NR structures time into one-millisecond slots. The attack works by parsing the DCI for a particular slot, determining which Physical Resource Blocks, the frequency-time units the network reserved for the victim, are in use, and directing interference at precisely those blocks during that identical 1 ms slot [S1].

The classifier that determines the optimal moment to act reaches 0.87 precision at its top 1% confidence cutoff, which is 4.21 times the base rate [S1]. At its highest confidence levels, the model is over four times as likely as random selection to identify the correct instant for jamming.

On a private 5G NR testbed using YouTube Live as the target, the method reduced the victim's Goodput by as much as 50% even with infrequent jamming [S1]. The low hit-rate is significant: the attacker need not interfere with every slot, only enough of them to harm the video experience. A separate device co-located with the target was largely unaffected [S1], confirming the attack is targeted rather than a broad-spectrum jammer.

Why lower layers stayed open

This is not an isolated finding. A related preprint from the same research period notes that as 3GPP strengthened security at the upper layers of the cellular stack, the plaintext physical and medium access control layers remained relatively understudied [P5]. Another preprint, 5Gone, demonstrated uplink overshadowing attacks in 5G standalone networks without relying on fake base stations [P2]. The pattern is consistent: hardening 5G's encryption and authentication pushed researchers toward the layers below, where plaintext signals still travel over the air.

The DoSQ authors state this represents the first empirical demonstration of a radio-to-application side channel exploitable by any protocol-aware adversary [S1]. That novelty claim has not been peer-reviewed.

What it means

The core finding flips a design assumption on its head. 5G networks were built with strong encryption for user data and robust authentication for devices. But the scheduling metadata that coordinates who talks when travels in the clear, by necessity, because every device needs to hear it. DoSQ shows that this metadata is not noise. It is a signal that leaks application-layer performance, and that leakage can be weaponised.

For a regular person, the practical risk today is low. This is a lab result on a private testbed, not a confirmed attack on commercial networks. But the mechanism is real and does not require exotic equipment: a protocol-aware radio that can decode DCI and transmit interference in the same millisecond slot. The countermeasure the authors propose, SSB frequency-time-hopping, would raise the cost for an attacker trying to resynchronise with a target [S1], but it has not been standardised or deployed in commercial equipment.

What it means for business

For telecom operators and enterprise 5G deployments, the paper identifies a class of risk that current monitoring tools may not catch. A DoSQ-style attack degrades service quality without triggering traditional security alarms. There is no intrusion to detect, no encryption to break, no fake base station to flag. The victim's video just gets worse.

Who feels this first:

  • Private 5G network operators running mission-critical services over 5G NR, where the standard is critical to those services [S1], should note that quality-of-service degradation can propagate from the radio layer to applications running on top.
  • Enterprise video streaming or real-time communications over 5G could see performance drops that look like congestion but are actually targeted interference.
  • Security teams should watch for anomalous Goodput patterns that do not correlate with network load, as these could indicate targeted jamming rather than capacity issues.

What we don't know yet

The paper is an arXiv preprint that has not completed peer review [S1]. All technical claims, including the 50% Goodput degradation and the 0.87 classifier precision, come from the authors' own private testbed under specific conditions [S1]. Independent replication has not occurred.

Several questions remain open:

  • Whether the attack generalises beyond the YouTube Live test case to other real-time applications.
  • Whether commercial 5G deployments with their own scheduling configurations and interference management would produce the same side-channel leakage.
  • Whether the proposed SSB frequency-time-hopping countermeasure can be implemented without degrading legitimate service or requiring hardware changes in deployed base stations.
  • Whether equipment vendors can detect or mitigate DCI-based side-channel analysis in current-generation baseband processors.

The next concrete event to watch is whether this preprint enters formal peer review and whether independent security labs attempt replication on their own 5G testbeds. Until then, DoSQ is a proof of concept, not a confirmed threat.

If this kind of security research is useful to you, subscribe to keep reading as we track it from preprint to peer review.

Sources

More from Not A Tech Guy

Generated from an audited evidence pack with primary-source research. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.