# Survey on 5G Physical Layer Security Threats and Countermeasures
## 3 Possible Attack Types on Physical and MAC Layer
### Spoofing
An attacker can spoof this DCI, redirecting the UE to different BWP, causing loss of scheduled transmissions and disrupting connectivity. This can also facilitate sophisticated attacks like Man-In-The-Middle (MITM), where specific messages from the base station are missed, or DL data are injected into an empty BWP. * Physical Uplink Control Channel (PUCCH) spoofing vulnerabilities have been published in [67], where the authors provide several attacks against PUCCH, such as the following: * Spoofing Scheduling Request (SR) exploits the UL physical layer message sent from the UE to the gNB to request UL resources. When the gNB receives an SR, it allocates resources for the user. SRs can be exploited by attackers in three ways: An attacker can keep users' Radio Network Temporary Identifier (RNTI) connections active for extended periods, bypassing the RRC inactivity timer and enabling long-term tracking. They can request resources on behalf of multiple users without pending UL data, leading to network congestion. Furthermore, they can request an UL DCI for a specific user and hijack the allocated UL grant to spoof higher-layer data on behalf of the user. The second method is a stealthier alternative to the resource scheduling attacks mentioned earlier since spoofed UL transmissions are harder to detect as they may appear to come from legitimate UEs. The third method is particularly advantageous for attackers as it allows them to hijack UL grants and inject MAC layer information for a specific user on demand. * The HARQ attack exploits the lack of synchronization between the base station and a UE due to spoofed DCI with an altered Downlink Assignment Index (DAI). An attacker injects a DCI with a higher DAI value than expected, causing the UE to report an incorrect ACK bitmap size. This mismatch leads to a HARQ failure, as the base station cannot match the ACKs to the correct packets, resulting in communication disruption and potential loss of connectivity for the targeted UE. This attack is effective because it leverages the unprotected nature of the lower protocol layers, where integrity checks are not enforced. This attack is depicted in Figure 7. * Channel State Information (CSI) sniffing to track users. This attack uses the vulnerability of the L1 layer combined with the L2 layer and allows tracing  
Figure 7: Hybrid Automatic Repeat reQuest attack in PDCCH. of users by SRS or leakages in CSI-RS [67]; more information is described in Section 4. * Contrary to jamming, the spoofing of Physical Random Access Channel (PRACH) signals can be applied in flood attacks, where the transmitting of large numbers of invalid preambles can be used for DoS attacks on gNB. The authors in [67] applied an attack against initial access using the SIB overshadowing technique by modifying the _ra-ResponseWindowSize_ parameter to minimum and the _preambleTransMax_ parameter to maximum, resulting in a failure for all UEs trying to connect to the network. To amplify the collision effect during RA, the PO can be injected to multiple users. This type of attack also effects UE battery draining because the UE increases transmit power after each unsuccessful RA.