## 3 Attacks on 5G NSA
### Active Attacks
#### 3.1.3 Message Attacks
After that, the adversary needs to send prepared paging messages with one of the paging records containing the IMSI of the victim UE. Upon the reception of the generated paging message containing its IMSI, the UE disconnects from the EPC and sends an Attach Request message. * The _Panic Attack_ allows an adversary to inject fake emergency paging messages [12]. It could be used by a malicious organization to create a situation of artificial emergency or chaos among the public. In order to perform the attack, the adversary needs to send paging messages with empty records but with fake emergency warnings on all possible paging occasions to ensure numerous UEs are affected. The paging messages can be generated by setting the bits related to earthquake and tsunami warning system (ETWS). Upon reception of this message, the UE displays warning messages sent by the attacker. Researchers further revealed that with four fake base stations operating at one-watt power, it is possible to send fake presidential warning messages to a stadium of 50,000 seat capacity with an impressive success rate of 90 percent [9]. * The _Energy Depletion Attack_ forces the victim UE to perform expensive cryptographic operations repeatedly, thus depleting its battery at a faster rate [12]. In order to perform the attack, the adversary can force the UE to carry out the expensive attach procedure repeatedly by sending a paging message containing the IMSI between two successive attach procedures. Alternatively, in case the adversary knows the Globally Unique Temporary Identifier (GUTI) of the victim, it can page the UE using the GUTI, which forces the UE to respond with a Service Request message. Fake User Equipment  
A fake UE is a device that tries to impersonate a legitimate UE. The adversaries usually use a Software-Defined Radio (SDR) along with software implementation of a UE modem to set up the fake UE. In this category, we list the attacks that mainly require a fake UE to perform the attack. However, some attacks may require a fake BS to gain initial insights, such as the victim's IMSI. Attacks that can be performed using a fake UE are listed below. A _BTS Resource Depletion Attack_ is based on the specification flaw of not verifying the subscriber/UE in the BS, i.e., the initial RRC connection procedure is unprotected. According to the standard [25], the initial authentication procedure takes place between the UE and the MME after the RRC connection procedure, thus allowing enodeB to accept connection requests from any UE. The goal of this attack is to deplete the capacity of active RRC connections at a base station and thus prevent legitimate users from connecting to it. A _Blind DoS Attack_ allows an adversary to establish an RRC connection by spoofing as the victim UE [26]. In order to perform this attack, the adversary first needs to determine the victim UE identity (S-TMSI) using a fake BS and then establish an RRC connection using this identity with the help of a fake UE. The impact of this attack varies based on the RRC connection state. When the victim UE is in the idle state, this attack changes the UE connection state in the MME to RRC connected and thus blocks any incoming traffic to the victim UE (no paging messages sent). If the victim UE is in the RRC connected state, this attack could lead to a limited time DoS attack. An _Authentication Synchronization Failure Attack_ forces the victim UE to suffer from service disruption [27]. The concept involves disrupting the attach procedure by intentionally creating a mismatch in the sequence numbers stored in the UE and the HSS. This is achieved by exploiting the sequence number during the UE sanity check. In order to perform the attack, the adversary sends several Attach Request messages using the victim's IMSI (malicious UE) but with different security capabilities between successive attach messages. Sending such Attach Request messages forces the network to drop the previous Attach Request, consider the new request as valid, and increase the sequence number in the HSS.