# Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems

**Authors:** Altaf Shaik, Ravishankar Borgaonkar, N. Asokan, Valtteri Niemi, Jean-Pierre Seifert  
**arXiv:** [1510.07563](https://arxiv.org/abs/1510.07563)  
**Date:** 2015-10-26  
**Summary page:** https://www.summarizepaper.com/en/paper/1510.07563v3/

## Key points

- Mobile communication systems are ubiquitous and indispensable worldwide
- Fourth generation LTE networks are considered better than predecessors in terms of functionality, security, and privacy
- A recent study uncovered vulnerabilities in LTE access network protocol specifications that can be exploited using commercial LTE mobile devices in real networks
- Two classes of practical attacks were demonstrated: location tracking and denial of service attacks
- Countermeasures were presented to resist these specific attacks and future safety margins should incorporate greater agility to accommodate changes
- Continued vigilance is needed to secure mobile communication systems as they become increasingly integral to modern life.

## Summary

The ubiquity of mobile communication systems has made them an indispensable part of daily life worldwide. Fourth generation Long Term Evolution (LTE) mobile networks are being deployed, and the LTE suite of specifications is considered to be significantly better than its predecessors in terms of functionality, security, and privacy for subscribers. However, a recent study by Altaf Shaik et al. analyzed the LTE access network protocol specifications and uncovered several vulnerabilities that can be exploited using commercial LTE mobile devices in real LTE networks. The researchers demonstrated two classes of practical attacks exploiting these vulnerabilities. The first class consists of three different ways to make an LTE device leak its location: a semi-passive attacker can locate an LTE device within a 2 sq.km area within a city, while an active attacker can precisely locate an LTE device using GPS coordinates or trilateration via cell-tower signal strength information. The second class of attacks can persistently deny some or all services to a target LTE device. To the best of their knowledge, this work constitutes the first publicly reported practical attacks against LTE access network protocols. The researchers presented several countermeasures to resist their specific attacks and discussed possible trade-offs that may explain why these vulnerabilities exist. They recommended that safety margins introduced into future specifications should incorporate greater agility to accommodate subsequent changes in the trade-off equilibrium. Overall, this study highlights the need for continued vigilance in securing mobile communication systems as they become increasingly integral to modern life. It also underscores the importance of ongoing research efforts to identify and address potential vulnerabilities before they can be exploited by malicious actors so as to ensure secure use of these systems on a global scale.