Dissecting Operational Cellular IoT Service Security: Attacks and Defenses

Sihan Wang, Tian Xie, Min Yue Chen, Guan Hua Tu*, Chi Yu Li, Xinyu Lei, Po Yi Chou, Fucheng Hsieh, Yiwen Hu, Li Xiao, Chunyi Peng

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review


More than 150 cellular networks worldwide have rolled out LTE-M (LTE-Machine Type Communication) and/or NB-IoT (Narrow Band Internet of Things) technologies to support massive IoT services such as smart metering and environmental monitoring. Such cellular IoT services share the existing cellular network architecture with non-IoT (e.g., smartphone) ones. When they are newly integrated into the cellular network, new security vulnerabilities may happen from imprudent integration. In this work, we explore the security vulnerabilities of the cellular IoT from both system-integrated and service-integrated aspects. We discover several vulnerabilities spanning cellular standard design defects, network operation slips, and IoT device implementation flaws. Threateningly, they allow an adversary to remotely identify IP addresses and phone numbers assigned to cellular IoT devices, interrupt their power saving services, and launch various attacks, including data/text spamming, battery draining, device hibernation against them. We validate these vulnerabilities over five major cellular IoT carriers in the U.S. and Taiwan using their certified cellular IoT devices. The attack evaluation result shows that the adversary can raise an IoT data bill by up to {\}226 with less than 120 MB spam traffic, increase an IoT text bill at a rate of {\}5 per second, and prevent an IoT device from entering/leaving power saving mode; moreover, cellular IoT devices may suffer from denial of IoT services. We finally propose, prototype, and evaluate recommended solutions.

Original languageEnglish
Pages (from-to)1229-1244
Number of pages16
JournalIEEE/ACM Transactions on Networking
Issue number2
StatePublished - 1 Apr 2024


  • Cellular IoT
  • power saving mode
  • security
  • service charging


Dive into the research topics of 'Dissecting Operational Cellular IoT Service Security: Attacks and Defenses'. Together they form a unique fingerprint.

Cite this