Securing Cellular Availability: The Wireless Blackhole Threat and Defense

Cellular networks, including 5G and 4G, use the radio resource control (RRC) communication to establish and set up the communication channel between a user equipment and a base station. We study the Wireless Blackhole threat, in which a fake base station directs multiple users to connect to itself, thereby depriving them of connectivity availability. The attacker manipulates the standardized cellular protocol by using the broadcasting control communication transmission-in contrast to the previous research targeting a single victim using unicast transmission-hence the name Blackhole. The Wireless Blackhole threat directs the victims' connections to the attacker itself, unlike jamming triggering the victims to avoid the attacker/channel. The threat is effective against user equipment both during connection initiation and when idle with an existing connection, and the threat impact range depends on the attacker's transmission power. Informed by the threat and vulnerability analyses, we design and build a distributed edge defense which detects and recovers from the threat. To enable such defense, our defense leverages a whitelist of the registered base stations (e.g., our implementation is based on that published by FCC) and utilizes a distributed, out-of-band, and offline delivery of the list via blockchain. We implement the Wireless Blackhole threat and defense on software-defined radios and validate and evaluate it against both a srsRAN-based user equipment and mobile phones connected to real-world cellular operators. We facilitate further R&D to secure the cellular networking against fake base station and discuss future directions, including those which can add to our defense but require changes in the cellular infrastructure.