LTE can be disabled with a $650 jammer, but not really
Share This article
Yesterday, the MIT Technology Review boldly stated that LTE networks can be easily shut down with a “simple jamming trick” utilizing a cheap software-defined radio. However, they are incorrect in believing that the trick shuts down the network, or can shut it down city-wide.
To understand the problem, a review of the LTE air interface is needed. In our explainer, we stated that the downlink air interface and the uplink air interface are different. Downlink uses OFDMA and uplink uses SC-FDMA sourced from a discrete Fourier transform on an OFDMA signal. Going a little deeper, we see that the air interface is sectioned into what are known as subcarriers. Essentially, the LTE pipeline is divided up into smaller chunks bonded together to form the large pipeline that everyone uses. This is what allows for LTE to be flexibly deployed on small sections of spectrum as well as large chunks.
Within that large pipeline, a portion of the subcarriers are used to transfer synchronization information. This information is used for phones, tablets, and other LTE-enabled devices (officially called “user equipment,” or UE) to link up with a tower, establish a working data connection, and maintain it (even when handing over to other towers). If someone crafted a signal that jammed just those subcarriers, then the UE desynchronizes from the tower and loses the signal. It is unable to maintain a connection and it drops.
Seems like an effective attack, right? Currently, the authors of the paper filed with the NTIA that the Technology Review article sourced say it is a workable attack, except things aren’t that simple. The authors of the paper note that the UE has to detect towers even with high levels of interference, and a jammer being able to overpower a tower’s signal would have to require a lot of power (probably more than it’s worth). Alternatively, sending bogus data could work, except that the user’s device will realize that the signal is worthless and drop it. Once it drops it, it will locate the nearest signal that will work properly. The UE will continue to do this until it gets a working signal. The amount of effort required to pull this off successfully is prohibitively large. However, it would be still doable unless the UE maintains a list of bogus signals and begins ignoring them and filtering them out (which is feasible to implement). Consequently, it would be very hard to do an effective denial of service attack using this vulnerability.
Another attack would involve jamming uplink control channels. Uplink control channels contain the information on channel quality and scheduling/sending network commands. Unlike the synchronization subcarriers, uplink control channels are split on the edges of the frequency range. They transmit in alternate sequence, and there is nothing else being transmitted when they are. This means that even with the discrete Fourier transform on the signal, it’s still possible to jam this. However, this technique requires extensive knowledge of the network being attacked in order to make it work. But when it does work, it can cause a gradual degradation in service quality until it reaches the level of total denial of service.
The authors of the paper do not describe a way to mitigate this vulnerability, but potentially using redundant channels and additional channels with dummy data would make it harder to exploit the vulnerability. A true solution to this vulnerability would require additional analysis, and the authors of the paper freely admit this is a preliminary analysis of LTE vulnerabilities.
In any case, it is highly unlikely that someone will be able to easily jam and “shut down” an LTE network. These techniques do not even affect the network on the tower side or the core network side, as these vulnerabilities are at the air interface level and could really only be used to prevent user equipment from connecting to the tower. However, these vulnerabilities need to be seriously considered and it would be a good idea for fixes to be implemented in commercial networks, especially the upcoming LTE-based national public safety network for the United States.