When the UE Turns Adversary: Real-Time Uplink Jamming from Within 5G Networks

2026-06-12

AI Summary

This work addresses selective reactive jamming attacks against the Physical Uplink Shared Channel (PUSCH) in 5G New Radio (NR) by proposing and implementing STORM-RJ, a software-defined radio (SDR)-based countermeasure framework. STORM-RJ leverages real-time decoding of Downlink Control Information (DCI) to obtain uplink grants and dynamically adjusts the bandwidth and center frequency of noise bursts within microsecond-level latency to precisely align with the target user equipment’s time-frequency resource blocks. The study demonstrates, for the first time on real hardware, the feasibility of SDR-based selective uplink jamming under 5G’s stringent timing constraints, systematically quantifies the impact of software and hardware latencies on attack efficacy, and reveals that synchronization can be achieved using only low-level RF tuning. Additionally, a potential mitigation strategy based on HARQ anomaly detection is proposed.

Abstract

This paper presents an investigation of a novel class of stealthy and selective reactive jamming attacks targeting the Physical Uplink Shared Channel (PUSCH) in 5G New Radio (NR) networks. We design and implement STORM-RJ (Stealthy Timing Obstruction and Radio Manipulation -- Reactive Jamming), a Software-Defined Radio (SDR)-based adversarial framework that enables highly precise, time-frequency aligned interference by dynamically adapting the bandwidth and center frequency of injected noise bursts in real time. STORM-RJ leverages decoded Downlink Control Information (DCI) to identify Uplink-Grants (UL-Grants) and synchronizes interference exactly with the resource blocks allocated to a target User Equipment (UE). We further characterize and mitigate the dominant latency sources -- both at the software processing and hardware Radio Frequency (RF) frontend levels -- to achieve a rapid jamming response upon grant detection. We conduct a comparative analysis of high-level versus low-level radio control strategies, demonstrating that only low-level tuning provides the microsecond-scale responsiveness necessary to meet 5G-NR timing constraints for effective reactive jamming. We analyze the practical feasibility of such selective jamming under realistic hardware and timing constraints, highlighting key trade-offs between SDR flexibility, processing latency, and synchronization accuracy. Finally, we discuss potential mitigation strategies, including Hybrid Automatic Repeat reQuest (HARQ) anomaly detection.

Problem

• reactive jamming
• 5G NR
• PUSCH
• uplink interference
• stealthy attack

Innovation

• reactive jamming
• 5G NR
• Software-Defined Radio
• PUSCH
• low-level radio control