LTE Denial-of-Service Attacks

1. The Vulnerability: Pre-Authentication Signaling

In the previous lesson, the core vulnerability was the optional integrity protection on the user plane. A similar weakness exists on the control plane. Before a device (UE) and the network can establish a secure, encrypted, and integrity-protected connection, they must exchange several initial messages. This initial "handshake" happens in the clear, creating a window of opportunity for an attacker.

The protocol used for this core communication between the UE and the Mobility Management Entity (MME) in the core network is the Non-Access Stratum (NAS) protocol. NAS messages handle critical functions like attaching to the network, authenticating, and managing the connection state.

The key vulnerability is that several crucial NAS messages, particularly those that can reject a connection attempt, are not integrity-protected. The UE is designed to accept and act upon these messages without being able to verify they came from the legitimate network. This is the "attack space" that enables Denial-of-Service.

2. The Attack: Spoofing NAS Reject Messages

The attack leverages a rogue base station (eNodeB) to inject malicious NAS messages. Since you're familiar with IP networking and tools like Wireshark, you can think of this as analogous to injecting forged TCP RST packets to tear down a connection, but executed at the cellular protocol layer.

The general flow of the attack is:

1. The attacker sets up a rogue eNodeB that impersonates a legitimate cell tower.
2. A victim's UE attempts to communicate with the network by sending a NAS request (e.g., to attach or update its location).
3. The rogue eNodeB intercepts this request. Instead of forwarding it, the attacker crafts and sends a spoofed NAS reject message back to the UE.
4. Because this message is not integrity-protected, the UE accepts it as legitimate.
5. The UE acts on the cause code within the reject message, which can instruct it to stop trying to connect to the network, effectively denying service.

The diagram below from Fox-IT shows a clean visualization of a DoS attack using a spoofed Tracking Area Update (TAU) Reject message.

The following reading from the paper "Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems" details the background for these attacks, confirming that messages like "TAU Reject" are not integrity protected.

3. Types of NAS Reject Attacks and Their Impact

An attacker can use several different NAS reject messages to achieve DoS. The specific message and the EMM (EPS Mobility Management) cause code within it determine the exact impact on the UE.

Key Attack Variants:

• Attach Reject: This attack targets a UE during its initial network entry. After the UE sends its Attach Request, the attacker replies with a forged Attach Reject.
• Tracking Area Update (TAU) Reject: This targets a UE that is already registered but is either moving between tracking areas or performing a periodic TAU. The attacker spoofs a TAU Reject in response to the UE's TAU Request.
• Service Reject: This is a particularly efficient attack that targets an idle UE attempting to transition to an active state (e.g., to fetch an email or push notification). The attacker responds to the UE's Service Request with a Service Reject.

The real power of this attack lies in the EMM cause codes. The 3GPP standards define these codes for legitimate network management—for example, to tell a phone an area has no service to prevent its radio from draining the battery by searching fruitlessly. Attackers simply abuse this mechanism.

This screenshot from the Amarisoft network analysis tool shows a captured Attach reject message and its cause code.

Let's explore these specific cause codes and their devastating impact.

As the video and research papers highlight, certain cause codes have a persistent effect:

• Cause #7: "LTE services not allowed": The UE stops trying to connect to 4G LTE but may search for 2G/3G networks. This is also a downgrade attack.
• Cause #8: "LTE and non-LTE services not allowed": The UE is told no service of any kind is available. It stops searching altogether.
• Cause #3: "Illegal UE" or Cause #6: "Illegal ME": The UE is told it is a forbidden device. It will not attempt to reconnect to this network (PLMN) until it is restarted or a long timer expires.

The practical effect of these attacks is severe. The following research provides experimental results showing just how persistent the DoS can be.

Conclusion

In this lesson, we have explored a critical availability attack against 4G LTE networks. Unlike the user-plane manipulation of the aLTEr attack, spoofing NAS reject messages targets the control plane to deny a user network access entirely.

Key Takeaways:

• Denial-of-Service attacks in LTE can be executed by spoofing Non-Access Stratum (NAS) messages that are sent before a security context is established.
• Messages like Attach Reject, TAU Reject, and Service Reject are vulnerable because they lack mandatory integrity protection.
• An attacker using a rogue base station can inject these reject messages with specific EMM cause codes to control the victim device's behavior.
• Cause codes like "Illegal UE" or "services not allowed" can cause a persistent DoS, forcing a device offline for hours until it is manually rebooted.
• This vulnerability stems from a legitimate design feature meant to save battery, which is abused by attackers.

Preview of the Next Lesson:

We have now covered the theoretical basis for several major 4G attack types: IMSI catching, user-plane manipulation, and denial-of-service. In our next lesson, we will finally move into our lab environment. We'll begin by learning how to configure srsENB to act as a rogue base station, the foundational step for performing many of the attacks we've discussed, including the IMSI catch and DoS attacks you'll execute later in the course.