Hijacking 5G MIMO: a Downgrade Attack via Tampered Zero-Power Channel State Information

In this paper we demonstrate a novel downgrade attack for 5G networks able to dramatically reduce the efficiency of Multi-Input-Multi-Output links, while remaining virtually invisible to standard intrusion monitors.By opportunistically injecting noise precisely aligned with silent reference signals in the radio frames (called Zero-Power Channel State Information Reference Signals), we show that an attacker can corrupt the feedback mechanism implemented at the User Equipment for channel estimation, forcing the base station to downgrade or disable spatial multiplexing. This mechanism is much simpler than pilot spoofing schemes and dramatically harder to defend: indeed, silent reference signals cannot be protected by integrity mechanisms and their sparsity keeps the average power of the injected noise difficult to detect.We design a robust mechanism for synchronizing the attacker transmissions to the silent reference signals, and quantify the latency of the attack under different SNR and cell load conditions. The approach has been implemented in a Software Defined Radio testbed and experimentally validated in a private network, by demonstrating a success probability higher than 82% on two different commercial smartphones and a throughput degradation up to 70%.