What threat groups make up the NIST LTE threat catalogue, and which security property does each attack?
Eight threats in four groups: general-IT software flaws (commodity hardware), rogue-base-station radio attacks (downgrade, identity tracking, call interception), availability attacks (jamming, physical destruction, signalling floods), and key/supply-chain theft (stealing K). The availability group is where mitigations stay "unclear."
* The catalogue as a map: one enabler (the rogue base station) carries three attacks, the availability group holds both "mitigation unclear" entries. *
| Threat | Entry point | Property attacked | Mitigation posture |
|---|---|---|---|
| Commodity hardware/software flaws | Ordinary server compromise | Any — the core is now software | Security engineering + secure SDLC |
| Downgrade / renegotiation | Rogue base station | Confidentiality (via GSM's weak crypto) | LTE-only mode, rogue-BS detector |
| Device & identity tracking | Rogue base station | Privacy (IMEI/IMSI as a tracking handle) | Temporary identities, IMSI-catcher-catcher |
| Call interception | Rogue base station (after downgrade) | Confidentiality | Ciphering indicator (3GPP TS 22.101) |
| Jamming the UE radio | Radio noise | Availability | Unclear |
| Physical base station attack | Field sabotage | Availability | Physical security (cameras, gates, tamper detection) |
| Availability attack on eNodeB/core | Fake-handset signalling flood | Availability | Unclear |
| Attacks against the secret key K | Carrier HSS/AuC or SIM factory | Confidentiality at the root — no cipher needs breaking | Physical + network security at both key stores |
The grouping is the mental model worth keeping. Three of the radio threats share one enabler — get the victim onto a rogue base station, then choose the payload (track, downgrade, listen). Three threats attack availability, and two of those are the only entries in the catalogue whose mitigation is candidly "unclear" — denial of service is the property hardest to defend. And one threat, key theft, bypasses the cryptography entirely: steal K at the factory or the carrier and there is nothing left to break. What remains — commodity software — says the LTE core now shares the ordinary IT threat model.
Go deeper:
LTE Security — How Good Is It? (NIST, 2015 Cybersecurity Innovation Forum) — the original Cichonski/Bartock/Franklin presentation this whole threat catalogue comes from; the downloadable slides walk the same eight threats.