Skip to content

RACH Replay #86

@cueltschey

Description

@cueltschey

We will be building upon the PDCCH sniffer in this repo to support RACH replay attacks. Here are the steps involved in the replay attack.

  1. Listen for a PDCCH message
  2. brute force the CRC using a list of possible RNTIs
  3. Once the RNTI is know cache for later use in decoding
  4. Modify the DCI to contain incorrect sync info
  5. Package the DCI with a new CRC to the UE

This attack will hopefully result in UE disconnect, and can be targeted towards certain users.

Metadata

Metadata

Projects

Status

Nice to have

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions