4G/5G Bidding-Down Attack Demonstration

The Theory Behind Bidding-Down Attacks

Before we start the lab, let's establish the theoretical foundation for this attack. A bidding-down (or downgrade) attack exploits the normal cell selection and reselection process of a mobile device.

The core idea is to present the UE with a seemingly better, but ultimately malicious, alternative to its current secure connection. You might find this concept familiar from web security, where downgrade attacks like POODLE forced browsers to use older, insecure versions of SSL/TLS. Here, we're doing something similar, but at the radio layer.

As the paper describes, an attacker can achieve this by:

1. Flooding/Jamming: Simply creating noise on the 5G frequency to make it unusable. This is effective but noisy and easily detectable.
2. Protocol-Level Rejection: Setting up a malicious 5G base station that rejects the UE's connection attempt with a specific error code, tricking the UE into thinking 5G is unavailable in that area.
3. Broadcasting a "Better" Lower-Generation Cell: This is the method we'll use today. The UE's software is programmed to constantly look for the best possible cell to connect to, based on factors like signal strength. We will broadcast a 4G LTE cell that appears "stronger" than our legitimate 5G cell, compelling the UE to switch.

This sequence diagram illustrates the potential chain of events in a multi-stage downgrade attack. We'll be implementing the first step: forcing the UE from 5G NR to 4G LTE.

Lab: Executing the Bidding-Down Attack

Our attack plan is straightforward:

1. Start our legitimate 5G network and confirm the srsUE connects to it.
2. Configure and launch a malicious 4G base station (srsenb) using the legacy srsRAN suite. We will configure it to broadcast with higher power.
3. Observe the UE as it disconnects from the 5G network and attaches to our malicious 4G cell.

Step 1: Establish the 5G Baseline

First, let's get our normal 5G network running, just as we did in the last lesson.

1. In a terminal, start your Open5GS core network:

   
   
   
   # Navigate to your docker directory
   cd Open5GS-srsRAN/docker
   docker-compose up -d
   

2. In a second terminal, start the legitimate 5G gNB from the srsRAN_Project directory:

   
   
   
   # Navigate to your srsRAN_Project build directory
   cd srsRAN_Project/build
   sudo ./apps/gnb/gnb -c ../../gnb_zmq.yaml
   

3. In a third terminal, start the srsUE. Watch its logs closely.

   
   
   
   # Navigate to your legacy srsRAN (4G) build directory
   cd srsRAN/build
   sudo ./srsue/src/srsue -c ../ue_zmq.conf
   

You should see the UE successfully find the 5G cell, attach, and establish a PDU session, getting an IP address like 10.45.0.2. The UE logs will indicate it is connected to a 5G NR cell. Keep this UE running.

Step 2: Configure the Malicious 4G Base Station (srsenb)

Now, we'll create the configuration for our attacker-controlled 4G base station, srsenb. The principles for configuring a convincing fake cell are outlined in the "Countering SUCI-Catcher" paper you read.

Based on those principles, create a new configuration file named enb_malicious.conf in your srsRAN/ directory.

[enb]
enb_id = 0x19B
mcc = 001
mnc = 01
mme_addr = 127.0.0.1
gtp_bind_addr = 127.0.0.1
s1c_bind_addr = 127.0.0.1
n_prb = 50
tm = 4
eutra_band = 7
downlink_frequency = 2680e6
tac = 0x0002

[rf]
dl_earfcn = 3350
tx_gain = 90
rx_gain = 35

[pcap]
enable = true
filename = /tmp/enb.pcap

Let's break down the key parameters that make this cell malicious and attractive:

• mcc = 001, mnc = 01: The Mobile Country and Network Codes match our legitimate Open5GS network. This is essential for the UE to consider this cell as part of its home network.
• tac = 0x0002: We use a different Tracking Area Code from our gNB's config (0x0001). When the UE sees a cell from its home network but with a new TAC, it's forced to perform a "Tracking Area Update" procedure, guaranteeing it will communicate with our malicious cell.
• downlink_frequency = 2680e6: We're setting the 4G cell to operate on a different frequency from our 5G cell to avoid direct RF conflict.
• tx_gain = 90: This is the crucial parameter for this attack. We are setting the transmit gain to the maximum value (90). This makes our 4G cell's signal appear much "stronger" to the UE than the 5G signal.

Step 3: Launch the Attack

With the legitimate 5G network and the UE already running, it's time to bring our malicious 4G cell online.

1. In a new (fourth) terminal, navigate to your legacy srsRAN/build/ directory.
2. Launch the srsenb application, pointing it to our malicious configuration.

   
   
   
   # Ensure you are in the srsRAN/build/ directory
   sudo ./srsenb/src/srsenb -c ../enb_malicious.conf
   

Step 4: Verify the Downgrade

Now, watch the terminal where your srsUE is running.

Within a few moments of the srsenb starting its broadcast, you should see a dramatic change in the UE's logs.

1. The UE will report that it has lost its 5G connection.
2. It will begin scanning for new cells.
3. It will find and report an LTE cell.
4. It will initiate and complete an LTE Attach procedure. The log will show steps like "RACH success", "RRC Connection Reconfiguration", and finally, it will report a successful attach and may get a new IP address from the MME.

You have successfully forced a 5G-capable UE, which was happily connected to a 5G network, to downgrade and connect to your 4G base station.

You can also check the logs on the srsenb terminal, which will show the UE connecting to it. Furthermore, if you tail the Open5GS MME log (sudo tail -f /var/log/open5gs/mme.log), you'll see the 4G attach procedure being handled by the core network.

Conclusion

In this lesson, you moved from a passive observer to an active attacker. By skillfully manipulating standard cellular parameters like transmit gain and tracking area codes, you demonstrated a successful bidding-down attack.

Key Takeaways:

• A bidding-down attack forces a UE onto an older, potentially less secure network generation (e.g., 5G to 4G).
• This can be achieved by broadcasting a malicious cell with a higher signal strength (tx_gain) to exploit the UE's automatic cell reselection algorithm.
• To be effective, a malicious cell must mimic the legitimate network's identity (MCC/MNC) but can use a different Tracking Area Code (TAC) to force a registration event.
• Our lab setup, with Open5GS and srsRAN, is capable of simulating both legitimate 5G and malicious 4G components simultaneously.

Preview of the Next Lesson:
We've successfully forced the UE to connect to a cell we control. The next logical question is: what sensitive information can we gather during that initial connection? In our next lesson, we will "Capture and analyze the initial RRC messages in a 5G connection to identify subscriber information," looking for identifiers that can be used to track a user.