## 3 Attacks on 5G NSA
### Active Attacks
#### 3.1.2 Signal Overshadowing  
Signal overshadowing is a technique where the adversary overshadows a specific message without interfering with the synchronization between the BS and the victim UE [20]. Specifically, this technique leverages the capture effect by injecting a generated subframe at a higher power to precisely overshadow the legitimate subframe. The capture effect forces the decoding of the stronger signal when several simultaneous (wireless) signals collide in the air. The injected subframes are prepared such that the UEs that receive and decode them behave based on the (malicious) information included in the generated subframes. The victim UE involved in this attack maintains a secure signaling connection with the legitimate endoB and the MME, as opposed to the attacks involving fake BSs, where the UE is disconnected from the legitimate core network. Although attacks based on this technique are stealthier than those employing fake BSs and man-in-the-middle (MITM) relay (see below), in practice, these attacks are difficult to perform. There are two major technical challenges. First, there is a hard dependency on time and frequency synchronization for precise overshadowing. Second, the subframe needs to be carefully prepared so that it is successfully decoded by the victim UE. In recent years, several attacks have been  
Figure 3: Taxonomy of possible attacks which can be transferred from 4G to 5G NSA networks. reported using this technique that fall into three distinctive categories: attacks exploiting System Information Block (SIB) messages, attacks exploiting paging, and attacks exploiting unicast messages. Attacks Exploiting SIB Messages  
These attacks exploit the vulnerability arising from the lack of integrity protection for SIB messages through the signal overshadowing technique. By performing a so-called _Signaling Storm_, an adversary storms prepared messages towards the core network by repeatedly triggering the invalid TAU procedure [20]. In order to perform this attack, the adversary first needs to overshadow a paging message with the \"system_Info_Modification\" field set as true, which forces the UE to read the SIB1 message. Next, it overshadows SIB1 messages using a spoofed Tracking Area Code (TAC), which forces the UE to initiate a Tracking Area Update (TAU) request toward the legitimate enodeB. Repeating the above procedure leads to a signaling storm toward the core network. _Selective DoS through Access Barring_ exploits the lack of integrity check for SIB messages to modify a feature in SIB2 messages that can control the number of UEs that are able to access a cell [20]. Generally, MNOs manage the amount of traffic and maintain the stability of the network under specific conditions, e.g., a disaster, by using the Barring Factor parameter in SIB2 message. In this attack, the adversary exploits this feature by setting the Barring Factor to 0 and the Barring Time to 512 s (via signal overshadowing) to restrict all data traffic and signaling originating from the UE, leading to a Denial of Service (DoS). The adversary can also use this attack to perform a persistent DoS attack by repeating the attack before the expiry of the Barring Time. Moreover, it is also possible to selectively block only the targeted services (e.g., voice calls, video conferences, and SMS) using this attack. Attacks Exploiting Paging Messages  
These are attacks that exploit the specification flaw (decision) of keeping the paging messages cryptographically unprotected. The _DoS Attack by Overshadowing Paging with IMSI_ exploits the concept of paging with IMSI using the signal overshadowing technique to perform a limited time DoS on the victim UE [20]. When a UE receives a paging message that contains its IMSI, it terminates all sessions and initiates a registration procedure. To perform the attack, the adversary injects a paging message that contains the IMSI of the victim UE at its paging occasion (via signal overshadowing), which detaches the UE from the network.