5G-Muffler: Covert DoS Attacks over Open Fronthaul Interface of O-RAN 5G Network

The O-RAN ALLIANCE promotes an open Radio Access Network (RAN) vendor ecosystem by defining O-RAN architecture and interfaces. The open fronthaul (O-FH) interface is a crucial interface between the O-RAN Radio Unit (O-RU) and the O-RAN Distributed Unit (O-DU), allowing mobile network operators to select best-of-breed O-RUs among multiple vendors. However, O-FH also introduces new security risk. In this work, we present 5G-Muffler, a set of covert DoS attacks over the O-FH interface. 5G-Muffler disrupts the random access process, the initial step for a user equipment (UE) to connect to the network. By preventing UEs from completing this step, 5G-Muffler makes the 5G network inaccessible. Furthermore, the attack is invisible to anomaly detection mechanisms above PHY layer. Our first variant, 5G-Muffler-1, introduces a man-in-the-middle device between O-RU and O-DU by manipulating an O-FH switch's configurations. The second variant, 5G-Muffler-2, targets the common 5G shared-cell setup, where a cell uses multiple O-RUs to enhance its coverage and signal quality. 5G-Muffler-2 only needs to control a single O-RU and it leverages weakness in the shared-cell signal aggregation process to amplify the attack to the whole cell. We demonstrate 5G-Muffler on commercial O-RAN systems and propose countermeasures to mitigate these attacks.