  Mobile communication systems now constitute an essential part of life
throughout the world. Fourth generation "Long Term Evolution" (LTE) mobile
communication networks are being deployed. The LTE suite of specifications is
considered to be significantly better than its predecessors not only in terms
of functionality but also with respect to security and privacy for subscribers.
  We carefully analyzed LTE access network protocol specifications and
uncovered several vulnerabilities. Using commercial LTE mobile devices in real
LTE networks, we demonstrate inexpensive, and practical attacks exploiting
these vulnerabilities. Our first class of attacks consists of three different
ways of making an LTE device leak its location: A semi-passive attacker can
locate an LTE device within a 2 sq.km area within a city whereas an active
attacker can precisely locate an LTE device using GPS co-ordinates or
trilateration via cell-tower signal strength information. Our second class of
attacks can persistently deny some or all services to a target LTE device. To
the best of our knowledge, our work constitutes the first publicly reported
practical attacks against LTE access network protocols.
  We present several countermeasures to resist our specific attacks. We also
discuss possible trade-offs that may explain why these vulnerabilities exist
and recommend that safety margins introduced into future specifications to
address such trade-offs should incorporate greater agility to accommodate
subsequent changes in the trade-off equilibrium.
