Breaking Cellular IoT with Forged Data-plane Signaling: Attacks and Countermeasure

We devise new attacks exploiting the unprotected data-plane signaling in cellular IoT networks (a.k.a. both NB-IoT and Cat-M). show that, despite deployed security mechanisms on control-plane packet forwarding, novel are still feasible. The attacker can forge uplink downlink messages that pass current checks used by receiver. With capability of forging messages, launch exhibit a variety attack forms beyond simplistic packet-blasting, denial-of-service (DoS) threats, including location privacy breach, delivery loop, prolonged data delivery, throughput limiting, radio resource draining, connection reset, multicast disabling. Our testbed evaluation operational network validation have confirmed viability. To combat threat, we further propose defense solution within 3GPP C-IoT standard framework. It leverages synchronized timer clock information to protect with low overhead.