Massive MIMO systems, where base stations are equipped with hundreds of antennas, are an attractive way to handle the rapid growth of data traffic. As the number of user equipments (UEs) increases, the initial access and handover in contemporary networks will be flooded by user collisions. In this paper, a random access protocol is proposed that resolves collisions and performs timing estimation by simply utilizing the large number of antennas envisioned in Massive MIMO networks. UEs entering the network perform spreading in both time and frequency domains, and their timing offsets are estimated at the base station in closed-form using a subspace decomposition approach. This information is used to compute channel estimates that are subsequently employed by the base station to communicate with the detected UEs. The favorable propagation conditions of Massive MIMO suppress interference among UEs whereas the inherent timing misalignments improve the detection capabilities of the protocol. Numerical results are used to validate the performance of the proposed procedure in cellular networks under uncorrelated and correlated fading channels. With $2.5\times10^3$ UEs that may simultaneously become active with probability 1\% and a total of $16$ frequency-time codes (in a given random access block), it turns out that, with $100$ antennas, the proposed procedure successfully detects a given UE with probability 75\% while providing reliable timing estimates.