## 3 Attacks on 5G NSA
### Active Attacks
#### 3.1.3 Message Attacks  
This is a technique of performing active attacks where the attacker sets up (and operates) fake device(s) to perform the attack. The adversary can spoof, replay, and/or tamper with traffic under its control. Message attacks are typically carried out using fake BS, fake UE, or an MITM relay. Fake Base Station  
A fake BS impersonates a legitimate BS by broadcasting system information with higher signal strength to lure a victim UE to connect to it. The adversary learns the appropriate parameters to configure the fake BS by sniffing public channels for the relevant broadcast messages. The attacks based on fake BS can be categorized into Unicast message attacks and Paging message attacks. 1. **Unicast Message Attacks. ** These are attacks where the attacker originates and sends a unicast message to the victim UE after it has camped on its cell (fake BS). The adversary exploits the fact that certain messages sent from the network are accepted by an UE without integrity protection [21]. Selected attacks in this category are described below. 2. The _Downgrade Attack_ allows the adversary to downgrade the user to a 2G/3G network [8]. The attack is based on the specification flaw that a UE accepts the TAU Reject message without an integrity check. Specifically, there is no need for the establishment of mutual authentication and security contexts between the UE and the network for accepting the message. In order to perform the attack, the adversary needs to operate a fake BS on a TAC different from the real enodeB to trigger a TAU message from the victim UE. Once the victim UE sends a TAU request, the fake BS replies with a TAU Reject message, including an EMM cause. If the cause included is \"EPS services not allowed,\" the victim UE disconnects from the current network and tries to connect to a nearby 2G/3G BS if available. Later, the UE tries to reconnect to the legitimate BS after the expiry of a timer [24]. Toggling airplane mode or rebooting the phone could nullify the effect of this attack. * The _Numb Attack_ allows an adversary to severely disrupt the service of a victim UE by performing a DoS attack [12]. The attack is based on the specification flaw that a UE accepts the Authentication Reject message without an integrity check. In order to perform the attack, the adversary needs to set up a malicious enodeB (BS). Once the UE connects to the fake enodeB, it needs to reply with the Authentication Reject message, irrespective of the victim UE context. After receiving this message, any cellular services on the UE are disabled as the UE enters the \"EU3 Roaming not allowed\" state. Later, the UE tries to reconnect to the 4G BS after the expiry of a timer [24]. Toggling airplane mode or rebooting the phone could nullify the effect of this attack. Similar attacks are also possible with Service Reject/Attach Reject messages. * The _Identity Leak Attack_ exploits a specification flaw of accepting an Identity Request for IMSI numbers without an integrity check [21]. In order to perform the attack, the adversary needs to operate a fake BS. Once the UE connects to such a prepared BS, it needs to send an Identity Request back to the UE. Upon receipt of the Identity Request, the victim UE replies with an Identity Response message containing its IMSI in plain text. * **Paging Message Attacks*
* Paging messages are cryptographically unprotected. A fake BS is required to perform these attacks. Selected attacks in this category are described below. * _Hijacking Paging Channels_ allows an adversary to deny any service to the UE (e.g., incoming call or SMS) [12]. To perform this attack, the adversary first needs to determine the UE's paging cycle. After that, the adversary needs to operate a fake BS and broadcast empty paging messages using higher signaling power at the paging occasions of the UE. * The _Stealthy Kicking-off Attack_ aims to force a victim UE to detach from a network surreptitiously [12]. In order to perform this attack, the adversary first needs to hijack the victim's paging channel.