# Survey on 5G Physical Layer Security Threats and Countermeasures
## 3 Possible Attack Types on Physical and MAC Layer
### Spoofing  
* Synchronization signal spoofing is a more effective attack in contrast to a simple injection of wideband noise by the jammer. Attackers are able to effective transmit fake PSS/SSS signals, as it does not require cell synchronization and requires less power. Note that PSS and SSS are detectable at low SNR [19], and their successful jamming would require a higher \(J/S\) ratio. Spoofing involves transmitting asynchronous fake PSS signals at higher power, potentially causing denial of service during the initial cell search [76]. The 5G NR specifications do not detail UE behavior upon detecting a valid PSS without an associated SSS [75], making the impact of PSS spoofing implementation specific. More sophisticated blacklisting is needed to mitigate the effects of increased fake PSS transmissions. * Physical Broadcast Channel (PBCH) sniffing and spoofing can be processed similarly to the LTE [19]. A Master Information Block (MIB), providing information about System Information Block (SIB) mappings in the time-frequency grid, represents the information that can be sniffed and spoofed. SIB provides information such as the idle timer configuration of the network, unique identifiers of the cell, and the RB mapping of critical control channels, and it also provides information on the received power threshold that can trigger a handover to another cell. Contrary to LTE, the NR SIB and RRC messages introduce new parameters, such as a whitelist or blacklist of cells. These unprotected messages can be exploited for security breaches against the NR protocol by spoofing SIB messages or impersonating a base station during the RRC handshake [67; 77]. * Physical Downlink Control Channel (PDCCH) spoofing is analyzed in [67], which describes several vulnerabilities linked with DCI carried by PDCCH, such as the following:
* Attacks on resource scheduling: For the DL, this has limited value as the UE fails to decode data in incorrect slots. However, for the UL, it is more effective as an attacker can cause multiple UEs to transmit over the same resources, leading to jamming and battery drain. The attacker crafts and injects UL DCI into each time slot, making Induced-Jammer UEs (IJ-UEs) transmit data, even without pending data. To amplify the attack, the attacker manipulates the Transmit Power-Control (TPC) field within the same DCI to force the IJ-UEs to transmit at maximum power. This severely impacts the SNR of other devices and reduces their throughput. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Channel/Signal** & **Modulation** & **\% of REs** & **Sync.** & **Params. Required** & \(\mathbf{J/S_{CH}}\) & \(\mathbf{J/S_{F}}\) \\ \hline PDSCH (DL) & [4; 16; 64; 256]-QAM & 90\% & No & None & 0 dB & \(-1\) dB \\ \hline PBCH & QPSK & 1.7\% & Yes & None & 0 dB & \(-17\) dB \\ \hline PDCCH & QPSK & 7\% & Yes & Medium & 0 dB & \(-11\) dB \\ \hline PUSCH (UL) & [4; 16; 64; 256]-QAM & \(\sim 90\%\) & No & None & 0 dB & \(-1\) dB \\ \hline PUCCH & QPSK & \(\sim 10\%\) & Yes & High & 0 dB & \(-10\) dB \\ \hline PRACH & Zadoff-Chu Sequence & \(\sim 2\%\) & Yes & Medium & 10 dB & \(-7\) dB \\ \hline PSS (Spoofing) & M-Sequences & 0.1\% (3 (PSSs)\) & No & None & 10 dB & \(-20\) dB \\ \hline SSS & Gold Sequences & 0.3\% & Yes & None & 10 dB & \(-15\) dB \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Jamming spoofing parameters and \(J/S\) values for a FR1 channel bandwidth of 20 MHz and SCS of 30 KHz, reprinted with permissions from [56]. PDCCH Order (PO): This is a special DCI that instructs a specific UE to initiate an RA procedure to update synchronization. As the only unprotected control procedure for triggering RA, it efficiently and stealthily induces RA, causing resource drain and potential disconnections and can be used for triggering localization attacks. * Bandwidth Part (BWP) Switching Attack: This exploits a 5G feature dividing total bandwidth into multiple parts for different users.