Abstract:Fake base stations comprise a critical security issue in mobile networking. A fake base station exploits vulnerabilities in the broadcast message announcing a base station's presence, which is called SIB1 in 4G LTE and 5G NR, to get user equipment to connect to the fake base station. Once connected, the fake base station can deprive the user of connectivity and access to the Internet/cloud. We discovered that a fake base station can disable the victim user equipment's connectivity for an indefinite period of time, which we validated using our threat prototype against current 4G/5G practices. We designed and built a defense scheme which detects and blacklists a fake base station and then, informed by the detection, avoids it through link routing for connectivity availability. For detection and blacklisting, our scheme uses the real-time information of both the time duration and the number of request transmissions, the features of which are directly impacted by the fake base station's threat and which have not been studied in previous research. Upon detection, our scheme takes an active measure called link routing, which is a novel concept in mobile/4G/5G networking, where the user equipment routes the connectivity request to another base station. To defend against a Sybil-capable fake base station, we use a history–reputation-based link routing scheme for routing and base station selection. We implemented both the base station and the user on software-defined radios using open-source 5G software (srsRAN v23.10 and Open5GS v2.6.6) for validation. We varied the base station implementation to simulate legitimate vs. faulty but legitimate vs. fake and malicious base stations, where a faulty base station notifies the user of the connectivity disruption and releases the session, while a fake base station continues to hold the session. We empirically analyzed the detection and identification thresholds, which vary with the fake base station's power and the channel condition. By strategically selecting the threshold parameters, our scheme provides zero errors, including zero false positives, to avoid blacklisting a temporarily faulty base station that cannot provide connectivity at the time. Furthermore, our link routing scheme enables the base station to switch in order to restore the connectivity availability and limit the threat impact. We also discuss future directions to facilitate and encourage R&D in securing telecommunications and base station security.

5G SUCI-catchers: still catching them all?

IMSI Catchers in the wild: A real world 4G/5G assessment

The Impact of IMSI Catcher Deployments on Cellular Network Security: Challenges and Countermeasures in 4G and 5G Networks

Towards Safer Connections: Secure Authentication in 5G Networks Leveraging Radio Frequency Fingerprinting

Easy 4G/LTE IMSI Catchers for Non-Programmers

Nori: Concealing the Concealed Identifier in 5G

Device Authentication for 5G Terminals Via Radio Frequency Fingerprints

UniID: Spoofing Face Authentication System by Universal Identity

Securing Channel State Information in Multiuser MIMO with Limited Feedback.

The GSM/UMTS Phone Number Catcher

You Can Call but You Can't Hide: Detecting Caller ID Spoofing Attacks

Attacks Against Security Context in 5G Network

Concealing IMSI in 5G Network Using Identity Based Encryption

Unprotected 4G/5G Control Procedures at Low Layers Considered Dangerous

Defeating the Downgrade Attack on Identity Privacy in 5G

A formal security analysis of the fast authentication procedure based on the security context in 5G networks

IMS is Not That Secure on Your 5G/4G Phones

Security Vulnerabilities in 5G Non-Stand-Alone Networks: A Systematic Analysis and Attack Taxonomy

SecureSIM

Fake Base Station Detection and Link Routing Defense

AdaptOver: Adaptive Overshadowing Attacks in Cellular Networks