Preamble Collision Attack

[cueltschey]

Random Access User Equipment Preamble Collision

Implementation (UE):

• Capture the preamble message of another UE
• Send the capture preamble repeatedly to confuse the network
• repeat the process for every new UE connecting the the RAN

Mitigation (gNB):

• Once a UE sends the preamble attach, then invalidate that preamble so long as the UE is connected

Attack Metrics:

• Disconnected UEs
• Lowering of channel quality
• gNB crash / malfunction

[cueltschey]

A Preamble Collision Attack targets the Random Access Procedure in LTE and 5G networks by deliberately causing preamble collisions during the Random Access Channel (RACH) process. In a standard network operation, UEs (User Equipment) select a random preamble from a set of available options to initiate a connection with the base station. However, in a Preamble Collision Attack, an adversary repeatedly sends the same preamble as legitimate UEs, causing multiple devices to simultaneously use the same preamble. This leads to collisions, which result in failed or delayed connection attempts, as the base station cannot differentiate between the colliding UEs. Such an attack can degrade the network's performance, particularly in high-load scenarios, and can be used to disrupt the normal operation of UEs within the coverage area.

To perform a Preamble Collision Attack test in srsRAN, we can simulate multiple UEs that intentionally send the same preamble. First, configure the srsUE by modifying the ue.conf file to set a specific preamble index instead of selecting one randomly. Deploy multiple instances of srsUE with this configuration, ensuring they all transmit the same preamble at the same time. Run srsGNB to act as the base station and monitor the RACH procedure. By observing the RACH request logs and analyzing the collision rate, we can evaluate the impact of the Preamble Collision Attack on the network's ability to handle connection requests. This test allows us to understand the network's vulnerability to preamble collisions and assess potential countermeasures, such as dynamic preamble allocation or collision resolution strategies.