Hacking LTE Public Warning Systems
summary
Finds that LTE public warning messages are sent in cleartext and lack signature or authentication, so a malicious LTE cell can forge alerts. Uses a low‑cost SDR (USRP B210) and modified open‑source LTE stack (srsLTE) plus an LTE discovery app to copy TAC/MCC/MNC and force cell reselection, then injects PWS payloads in SIB10/SIB11 and paging PWAS indicators. Demos trigger real phone alarms on both Apple and Android tests, letting fake alerts or spam be broadcast to all nearby phones.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:22Public warning systems overview
- 6:39Vulnerability in LTE protocol
- 7:43Setting up fake base station
- 10:34Forging fake warning messages
- 14:25Demo of attack
- 18:53Potential risks and impact
- 19:56Prevention methods
- 21:39Q&A
related talks
08mHacking 4G and how to get arrested in 10 minutes
44mLTE And IMSI Catchers: Then And Now
01h 06mLTE & IMSI Catcher Myths
54mExposing device features on 4G & 5G networks
48mMobile Network Hacking, IP Edition
01h 01mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
24mEnhancing Physical Perimeter Defense Using SDR
44mExposing Critical Threats In Millions Of Connected Devices