DEMO: Radio Unit Activity Fingerprinting through Electromagnetic Side-Channel Analysis in O-RAN Networks

While the disaggregated architecture of the industry-driven Open Radio Access Network (O-RAN) promises to foster vendor competition, accelerate innovation, and reduce cost for 5G/6G cellular network deployments, it also exposes the cellular network to various new cybersecurity and privacy vulnerabilities. This demo paper highlights one such new potential cybersecurity vulnerability in the Radio Unit (RU) of O-RAN networks, where an adversary can infer RU activity by analyzing electromagnetic side-channel emissions. We present a custom-built, open-source cellular O-RAN testbed equipped with EM measurement capabilities that enables direct observation of the FPGA-based RU during operation. By capturing EM emissions from the RU, we extract side-channel traces that reveal the underlying RU activity. These traces are then analyzed using a Random Forest-based machine learning classifier, which accurately distinguishes between different RU activity patterns. Our preliminary findings demonstrate the feasibility of inferring RU-level operations via passive EM observation, highlighting a previously unexplored security threat in O-RAN systems. All code and experimental artifacts are made publicly available at https://github.com/SPIRE-GMU/NextGRadio_Sidechanel.