0•Bytes•1

Attack on false buffer status report🍩

The buffer state report is used as input to the packet scheduling, load balancing, and tolerance management algorithms.

An attacker can modify the behavior of these algorithms by sending false buffer state reports on behalf of another normal UE.

Although the impact of this threat depends on the implementation algorithms, several possible attacks can be illustrated.
The first attack is to steal bandwidth by

changing the packet scheduling behavior.

Using the C-RNTI of another UE, the attacker

 can send buffer status reports on behalf of other UEs. This can make the network believe that the other UEs have nothing to transmit (buffers are empty). As a result, the packet scheduling algorithm in eNB does not allocate/allocate less resources to these other UEs, but allocates more resources to the malicious UE .

The second attack is to change the

behavior of load balancing/access control algorithms in eNBs.

On behalf of real UEs, the attacker claims that they have more data in their sending buffers than is actually buffered in them.

Multiple such buffer status reports from various UEs,

 lead the network to believe that there is a load on that cell.

Consequently

, new incoming UEs cannot be accepted by this cell.

These types of attacks are difficult to detect , they reduce the throughput/capacity of the system.

The attack may even be considered more harmful than jamming, since it requires less energy to perform. 💥

But in practice, it is difficult for a malicious UE(or a malicious user) to execute such an attack.

When a UE communicates with the eNB serving it, a fake buffer report will collide with a packet from a normal UE.

But, as discussed above, an attacker can inject a fake buffer report when the UE enters a long DRX period. This report would not cause any conflict with the control signal from the normal UE.

Another example of a different attack⚡️

If the user plane (RLC, PDCP) or control plane (RRC, NAS) packet sequence numbers are continuous before and after handover, an attacker can guess the mapping between old and new C-RNTIs

based on the continuity of packet sequence numbers.

The more bits used for the sequence number on the radio channel, the higher the probability of an enogo.

This is especially true for

EUTRAN and similar high bandwidth networks since the sequence number must be longer for ARQ to work properly.

This type of UE tracking is also applicable to state transitions between idle and active,

 as long as the sequence numbers are kept continuous of course.

A radio link attacker

 can track UEs based on continuous sequence numbers of packets in packet streams.

This attack seems particularly interesting for

E-UTRAN because UEs will be active for long periods of time.

It is also expected that UEs will receive more packets from the network in E-UTRAN than in UTRAN, for example.

This was just a theoretical part of the ss7 series to give you an idea about the attacks and how they work. In the future I will describe more practical applications.
For more details about the attacks, defense architecture, and more, read the articles in the archive below.🧩❤️‍🔥

And that's it, thanks for reading ❤️.
And remember : If the evil dove says you are a snake she is wrong, even if you also eat eggs🐦🐍
#lte #network #ss7 #mobile #attacks #dos

👍1

482 views05:28