Experimental Study of Spoofing Alerts in 4g Lte Networks

Modern mobile phones should receive and display alert messages, such as AMBER alerts, emergency alerts, and (unblockable) presidential alerts, under the mandate of the Warning, Alert, and Response Act of 2006. In January 2018, an alert message that a ballistic missile was heading to Hawaii had been sent out in Hawaii state. Although it turned out to be caused by human error, it showed how this alert message could affect people. In addition, in October 2018, a test to broadcast unblockable presidential alert messages to all of the United States was conducted. These cases have raised concerns about what problems might arise when alert messages are misused or spoofed. In this thesis, we investigate the alert spoofing attacks in 4G LTE networks and provide 1) the detailed analysis of this attack, 2) design and implementation of such systems, 3) possible counter measures, and most importantly 4) the impact of such attacks in both indoor and outdoor environments. Our attack can be carried out using a software defined radio, and our modifications to the open source NextEPC and srsLTE software libraries. We evaluate our attack in a controlled environment and estimate the impact of such an attack based on empirical measurements. We find that with only four malicious portable base stations of a single Watt of transmit power each, almost all of the 50,000-seat stadium can be attacked with 90% success rate. The true impact of such an attack would, of course, depend on the density of cell phones in the range: false alerts in crowded cities or stadiums could potentially result in cascades of panic. Solving this problem will require large collaborative efforts among government, standardization organizations, network providers, and manufacturers. We also provide possible solutions to defend against such a spoofing attack.