4G LTE networks across the world (e.g., United States, Europe, and South Korea) use the same mechanism to broadcast emergency alerts. These alerts include AMBER, severe weather alerts, and the (unblockable) Presidential Alert in the US. We demonstrate the ability to spoof these alerts by forcing any 4G phone in the area of our malicious cell tower to receive and display a fabricated message. This demonstration uses a commercially-available software-defined radio, an LTE base station, and our modifications to the open-source NextEPC and srsLTE libraries to send the Presidential Alert to phones volunteered from the audience.

Modern cell phones are required to receive and display alerts via the Wireless Emergency Alert (WEA) program, under the mandate of the Warning, Alert, and Response Act of 2006. These alerts include AMBER alerts, severe weather alerts, and (unblockable) Presidential Alerts, intended to inform the public of imminent threats. Recently, a test Presidential Alert was sent to all capable phones in the United States, prompting concerns about how the underlying WEA protocol could be misused or attacked. In this paper, we investigate the details of this system, and develop and demonstrate the first practical spoofing attack on Presidential Alerts, using both commercially available hardware as well as modified open source software. Our attack can be performed using a commercially-available software defined radio, and our modifications to the open source NextEPC and srsLTE software libraries. We find that with only four malicious portable base stations of a single Watt of transmit power each, almost all of a 50,000-seat stadium can be attacked with a 90% success rate. The true impact of such an attack would of course depend on the density of cell phones in range; fake alerts in crowded cities or stadiums could potentially result in cascades of panic. Fixing this problem will require a large collaborative effort between carriers, government stakeholders, and cell phone manufacturers. To seed this effort, we also discuss several defenses to address this threat in both the short and long term.