Public warning systems (PWS) in cellular networks enable authorities to broadcast emergency alerts to all mobile phones in a geographic region in the event of threats such as earthquakes or severe weather. If an attacker can imitate these alerts and transmit a forged warning containing fake news or phishing links, the impact could range from public panic to user compromise. In this work, we present the first open-source 5G emergency alert spoofing attack, implemented by modifying the openairinterface (OAI) radio access network (RAN) code and executed using a software-defined radio, complemented by a custom network management system to automate network and warning configuration. We conduct a detailed analysis of how different smartphones behave under various conditions. Our findings show that while devices readily display spoofed alerts, the alerting mechanism enables multiple practical attack scenarios beyond simple warning display. Finally, to address this threat, we propose and implement a lightweight cross-cell verification mechanism in OAI, in which the device compares the received warning with neighboring cell broadcasts to flag single-source alerts as suspicious.

翻译：蜂窝网络中的公共预警系统（PWS）使当局能够在发生地震或恶劣天气等威胁时，向特定地理区域内的所有移动终端广播应急警报。若攻击者能够模仿这些警报并传输包含虚假新闻或钓鱼链接的伪造警告，其影响范围可能从公众恐慌延伸至用户信息泄露。本研究首次提出开源5G应急警报欺骗攻击，通过修改openairinterface（OAI）无线接入网（RAN）代码实现，并借助软件定义无线电执行，同时辅以自定义网络管理系统实现网络及警告配置的自动化。我们详细分析了不同智能手机在各种条件下的表现行为。研究结果表明，虽然设备会直接显示伪造警报，但警报机制本身可实现多种超越简单警告显示的实用攻击场景。最后为应对此威胁，我们在OAI中提出并实现了一种轻量级跨小区验证机制，该机制通过比较接收警告与相邻小区广播内容，将单源警报标记为可疑。