5 ms·

Jamming Attacks and Anti-Jamming Strategies in Wireless Networks

67 points by adulau 6y ago

tristanperry 6y ago
An interesting research paper, thanks for posting it. I've recently been fairly interested in smart homes, which (alongside WiFi) often use ZigBee and/or Z-Wave protocols. Whilst Z-Wave isn't covered in this paper, ZigBee (which runs at 2.4 Ghz - but on higher channels than WiFi to prevent overlap) is covered. If I'm reading correctly, the paper seems to say that many anti-jamming techniques are successful with ZigBee, unlike previous research that concludes that it's usually harder to block ZigBee jamming attacks (ref 21)?
capableweb 6y ago
A little bit off-topic but still relevant to jamming. I noticed the other day I went to a big electronics store (Mediamarkt) and noticed that my cellular connection died just as I entered the store. When asking about it, they told me the reception is just so poor there so I should use their WiFi instead. As I wanted to compare products with other stores, I used the WiFi. But afterwards I started thinking, is it possible to store is doing this on purpose, in order to ex-filtrate data via the WiFi connection? They wouldn't get more than the hostname if it's over https, but who knows what more kind of data they could get from it. They could also block websites of competitors and blame the internet, and prevent consumers from comparing themselves. Or I'm just a conspiracy-nut lite, but it wouldn't surprise me a lot if it was like that.
- hchz 6y ago
  Can a business model of capturing hostnames pay for the initial and ongoing costs of such a system? Isn't this kind of wireless hardware expensive at the scale of a business like this? https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor I might expect that kind of activity in the US but not the EU.
  - buran77 6y ago
    One of the big problems many of these stores have is that the mobile coverage actually is bad inside due to the building's structure. Many of them are reinforced concrete buildings wrapped in metal cladding (take an IKEA store as an example). So many larger supermarkets in some countries barely have coverage at the cash register so you can pay with a phone but you'll lose coverage as soon as you enter further. They mostly don't offer any solution for this, like WiFi APs or mobile base stations. There's also the much higher density of people at that spot which crowd the same base station. I'd wager MediaMarkt faced the same issue, wanted to give some internet coverage, and found WiFi to be cheaper or easier to implement and maintain. They may have realized in the meantime that they can extract some useful data too.
    - PaulHoule 6y ago
      in the US Target cooperates with cell phone carriers to disable service in their stores.
      - metiscus 6y ago
        I am really interested in this.. Do you have a source?
- deleted 6y ago
  [deleted]
- devwastaken 6y ago
  After the target hacks stores started to install cellular suppressors. Some removed them because it turns out that's a bad idea. Some did not. Source: used to work with a friend for hardware deployment at stores.
- vuln 6y ago
  You're not crazy... Amazon patented it. https://www.theverge.com/2017/6/15/15812986/amazon-patent-online-price-checking https://www.theverge.com/2017/6/15/15812986/amazon-patent-on...
- myself248 6y ago
  It wouldn't surprise me a bit. Find some hams and head back there with a spectrum analyzer. (Or get yourself a $25 rtlsdr dongle...) There've also been cases of hotels sending deauth packets to other people's wifi hotspots, to force them to buy the hotel's wifi. Multiply that times a hundred vendors trying to run verifone terminals and stuff in a merch room, and it's a huge money grab.
- frakt0x90 6y ago
  Would it also be possible to estimate your location in the store using multiple access points and the latency between them? They might use that to track where people spend their time.
- swirepe 6y ago
  It's more likely that the big metal walls of store were blocking the signal, instead of intentional jamming. They could, of course, take advantage of that to get people to connect to your wifi. That tells them at least how many people were in the store, and when.
red0point 6y ago
Funny, I just finished my master thesis in this area. I implemented a highly effective DoS attack for LTE which relies on reactive signal overshadowing, a very efficient type of jamming. Sadly, overshadowing attacks in LTE are not covered in the paper, but have been present for some years now. Here's the link if anyone is interested: https://doi.org/10.3929/ethz-b-000455834 https://doi.org/10.3929/ethz-b-000455834
- contingencies 6y ago
  all of the UEs tested exhibited total loss of LTE communication for more than 12 hours after being subjected to the attack. Ouch. Thankfully we're not yet a wireless data monoculture.

67 points by adulau 6y ago

An interesting research paper, thanks for posting it. I've recently been fairly interested in smart homes, which (alongside WiFi) often use ZigBee and/or Z-Wave protocols. Whilst Z-Wave isn't covered in this paper, ZigBee (which runs at 2.4 Ghz - but on higher channels than WiFi to prevent overlap) is covered. If I'm reading correctly, the paper seems to say that many anti-jamming techniques are successful with ZigBee, unlike previous research that concludes that it's usually harder to block ZigBee jamming attacks (ref 21)?

capableweb 6y ago

A little bit off-topic but still relevant to jamming. I noticed the other day I went to a big electronics store (Mediamarkt) and noticed that my cellular connection died just as I entered the store. When asking about it, they told me the reception is just so poor there so I should use their WiFi instead. As I wanted to compare products with other stores, I used the WiFi. But afterwards I started thinking, is it possible to store is doing this on purpose, in order to ex-filtrate data via the WiFi connection? They wouldn't get more than the hostname if it's over https, but who knows what more kind of data they could get from it. They could also block websites of competitors and blame the internet, and prevent consumers from comparing themselves. Or I'm just a conspiracy-nut lite, but it wouldn't surprise me a lot if it was like that.

hchz 6y ago
Can a business model of capturing hostnames pay for the initial and ongoing costs of such a system? Isn't this kind of wireless hardware expensive at the scale of a business like this? https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor I might expect that kind of activity in the US but not the EU.
- buran77 6y ago
  One of the big problems many of these stores have is that the mobile coverage actually is bad inside due to the building's structure. Many of them are reinforced concrete buildings wrapped in metal cladding (take an IKEA store as an example). So many larger supermarkets in some countries barely have coverage at the cash register so you can pay with a phone but you'll lose coverage as soon as you enter further. They mostly don't offer any solution for this, like WiFi APs or mobile base stations. There's also the much higher density of people at that spot which crowd the same base station. I'd wager MediaMarkt faced the same issue, wanted to give some internet coverage, and found WiFi to be cheaper or easier to implement and maintain. They may have realized in the meantime that they can extract some useful data too.
  - PaulHoule 6y ago
    in the US Target cooperates with cell phone carriers to disable service in their stores.
    - metiscus 6y ago
      I am really interested in this.. Do you have a source?
deleted 6y ago
[deleted]
devwastaken 6y ago
After the target hacks stores started to install cellular suppressors. Some removed them because it turns out that's a bad idea. Some did not. Source: used to work with a friend for hardware deployment at stores.
vuln 6y ago
You're not crazy... Amazon patented it. https://www.theverge.com/2017/6/15/15812986/amazon-patent-online-price-checking https://www.theverge.com/2017/6/15/15812986/amazon-patent-on...
myself248 6y ago
It wouldn't surprise me a bit. Find some hams and head back there with a spectrum analyzer. (Or get yourself a $25 rtlsdr dongle...) There've also been cases of hotels sending deauth packets to other people's wifi hotspots, to force them to buy the hotel's wifi. Multiply that times a hundred vendors trying to run verifone terminals and stuff in a merch room, and it's a huge money grab.
frakt0x90 6y ago
Would it also be possible to estimate your location in the store using multiple access points and the latency between them? They might use that to track where people spend their time.
swirepe 6y ago
It's more likely that the big metal walls of store were blocking the signal, instead of intentional jamming. They could, of course, take advantage of that to get people to connect to your wifi. That tells them at least how many people were in the store, and when.

red0point 6y ago

Funny, I just finished my master thesis in this area. I implemented a highly effective DoS attack for LTE which relies on reactive signal overshadowing, a very efficient type of jamming. Sadly, overshadowing attacks in LTE are not covered in the paper, but have been present for some years now. Here's the link if anyone is interested: https://doi.org/10.3929/ethz-b-000455834 https://doi.org/10.3929/ethz-b-000455834

contingencies 6y ago
all of the UEs tested exhibited total loss of LTE communication for more than 12 hours after being subjected to the attack. Ouch. Thankfully we're not yet a wireless data monoculture.