7 ms·

A $650 transmitter can disable an entire city’s high speed mobile phone network

86 points by donohoe 14y ago

salimmadjd 14y ago
Governments are more likely to use something like this. For example to block an area (protestors) to communicate from outside. Share photos or videos that might damaging, etc.
guimarin 14y ago
I see your transmitter, and I raise you three equally cheap receivers and a machete.
vegardx 14y ago
But you'll have to start running pretty fast, as it is very easy to pinpoint the exact location of the sender/jammer. This is also true for any network, not just LTE. WiFi, GSM, HDSPA, etc. Many military vehicles have jammers like this to block mobile connectivity in order to prevent IEDs.
- SilasX 14y ago
  Sure, if you're expecting the attack. But most areas aren't expecting such an attack, so when you do, then as long as they turn it off in time and run away, the authorities probably won't be able to mobilize in time in take the measures to find the source. This would change if it started to become a common occurrence.
ghshephard 14y ago
Such behavior is criminal in nature. And the FCC will find you, and they will crack down on you. "Federal law prohibits the operation, marketing, or sale of any type of jamming equipment, including devices that interfere with cellular and Personal Communication Services (PCS), police radar, Global Positioning Systems (GPS), and wireless networking services (Wi-Fi)." 47 U.S.C. § 301, § 302a(b), § 333 all make it clear that this activity is illegal. Just selling jamming devices will attract the FCC's attention. https://www.fcc.gov/document/craigslistorg-users-warned-remove-postings-illegal-jammers https://www.fcc.gov/document/craigslistorg-users-warned-remo... Once you've decided to be a criminal, you don't need a $650 device to do a lot of damage. A $20 container of gasoline, or, heck, a $5 piece of chain link at the right electrical substation can cause tens of millions of dollars of damage.
- mindstab 14y ago
  I think you miss the point. Such a critical system should not be so fragile that pretty much anyone can disable it, one would hope.
  - ghshephard 14y ago
    No - I totally get the point. But, if you are going to engage in criminal activity, the bar to your destructive behavior isn't a $650 transmitter. It's a $20 containers of gasoline. If you want to hurt people, it's pretty much impossible to stop you from doing so (or even slowing you down) - all we can do is catch you, and put you in prison after you do so so that you can't hurt more people. I'm not suggesting we ignore security (I like SSL, and passwords on my accounts) - but we can't create a world where everyone has to treat the populace as though they are intent on creating destruction. This is the mindset of the TSA and "Search everyone, because any one of them might be carrying a bomb." At a certain point, we have to trust that the vast, vast majority of people are good. And, in the whole scope of things, jamming an LTE radio transmission system has pretty big penalties, and very little financial payoff, and a pretty good chance of being caught. It's one of those asymmetric criminal activities that is balanced in favor of society, and against the criminal. Where you want to put your attention in enhancing defenses, is places where there is a strong incentive to commit the crime, and less chance of being caught. Guarding against petty thieves, lots of safeguards/fraud alerts around things like credit cards, or your paypal account. That's where attention needs to be spent. You know where it's important to spend a lot of money on counter-jamming? Life Safety systems like Nuclear Power Plants, or Plane/Car navigation systems. Where lives are on the line, I totally agree that we need to harden, harden, harden those systems. Also, SCADA systems - that control large amounts of underlying infrastructure. And the Stock Exchange. Spend a fortune on ensuring that the bad guys can't cause havoc, kill people, or create large economic damage. Perhaps your LTE/Cellular coverage is better than mine, but I'm pretty used to having to track down a WiFi connection to get any serious work done, or make a reliable Skype call. I don't put LTE coverage in the "Mission Critical" category of infrastructure. Also, if you are in a situation (Prison, battlefield) where the vast majority of your opponents are intent on doing you harm, you also harden the crap out of everything. And pay the price - because you need to. But, all else equal, I'd rather have the money/resources that might have gone into putting MILSPEC anti-jamming capabilities into my LTE NIC, instead be spent on making it cost less, draw less battery, and give me more bandwidth. Let the FCC catch the 3-5 jammers at year intent on doing harm, and put them in prison to consider the wisdom of their behavior.
jacquesm 14y ago
Breaking will always be easier than making. A 'jammer' is about the easiest kind of transmitter to make, you don't care about signal quality at all (you want the worst signal quality). For an analogue: you can take a length of steel chain to the nearest powerstation and lob it over the fence. Likely you'll spend a lot less than $650 and do substantial damage. That doesn't mean that the powerstation is badly designed, it just means that we expect people to behave in a non-destructive way and we use the law against those that can't seem to live by the rules. Society is a fragile thing, a few hundred dedicated jerks can undo the work of hundreds of thousands. Breaking things is dead easy. edit: credit for the powerline + chain idea in this thread goes to ghshephard, score one for parallel invention.
- Nrsolis 14y ago
  I think the main thrust of the article is that many systems are vulnerable to control channel interruptions. In those scenarios, a jammer can be far less powerful and much harder to detect. In many cases, the underlying encryption system for communications is particularly vulnerable to disruption. In those cases, individual bit flips caused by intelligent jammers can cause the loss of entire frames. BTW, the public safety standard for digital radios (P25) is also vulnerable to this sort of attack. IIRC, jamming the digital system often had the side effect of getting users to switch to less-secure (unencrypted) analog modes that were vulnerable to interception.
  - xyzzy123 14y ago
    Indeed. More amusingly though (but still on the control channel), the open p25 group found that you could remotely brick responder radios, without authentication: http://risky.biz/RB178 http://risky.biz/RB178
- wmf 14y ago
  If you read the paper, the authors discovered ways to make LTE jamming 20 dB more efficient than brute force; arguably this is a legitimate weakness in LTE. IIRC other protocols are just as bad, so I am skeptical that these vulnerabilities are relevant when designing a public safety network.
mistercow 14y ago
It's pretty inexpensive to buy a laser you can shoot at a helicopter or airplane, temporarily blinding the pilot. With no equipment whatsoever, you can go to your local grocery store and start opening bottles of cooking oil and dumping them on the floor. Besides costing the store money in lost inventory and cleanup, you can easily cause hundreds of thousands of dollars worth of damage in medical costs from people slipping on the oil. You can also buy a cheap car for around $700 and use it to start running down pedestrians. What all of these have in common is that they are inexpensive and easy to do, they are virtually impossible to defend against, and they leave the perpetrator holding the bag. And the bag I'm talking about is huge and glowing. It has big flashing neon letters on it that alternate "I'M THE HUGE ASSHOLE YOU'RE LOOKING FOR!" and "COME ARREST ME!" Look at it that way, and this hardly even seems like news. It's just another addition to the staggeringly long list of easy ways to disrupt society that have near 100% odds of landing you in jail.
- anigbrowl 14y ago
  For contrast: http://en.wikipedia.org/wiki/2007_Boston_bomb_scare http://en.wikipedia.org/wiki/2007_Boston_bomb_scare There nobody was trying to be an asshole (or failed to appreciate how their little art project would be interpreted), but by putting it near a prominent transit artery it wound up being significantly disruptive due to the resulting anxiety. A key difference from your examples is that they're all localized, and the effects don't ripple very far. Another is that they're easily explicable - some violent person vandalizing a store or mowing people down in a car is frightening but also easily comprehensible. The litebrite bomb scare described above didn't involve any actual attack, but the confusion led many people to imagine the worst.
  - mistercow 14y ago
    I think that example more than anything demonstrates a completely different danger to society comprising two related phenomena: 1. Media sensationalism encouraged by an opportunistic government, engineered to whip the public into a terrified frenzy, and 2. Poorly trained and paranoid law enforcement with no sense of perspective. I don't think it has much relevance to jamming public WiFi, except peripherally in that news stories like this may do more harm than good.
JonnieCache 14y ago
I see the fact that you don't ever hear of people doing this, or chucking things into substations or off roadbridges and so on, as the ultimate evidence that international terrorist networks, to a first approximation, do not exist. If there really were highly organised terrorists everywhere plotting against us, wreaking substantial havoc across society would be pretty easy for them. The actual attacks that do occasionally happen are more in line with politically irrelevant rogue lunatics, placing grandiosity over efficacy.
- akiselev 14y ago
  Havoc != terror. Terrorists try to create fear and have a major impact on the populace, most often through bombings and death. Jamming a small (for now) part of our communications infrastructure could be a major detriment to people functioning but no one will fear for their lives. That does not preclude, however, a Gotham city like scenario where an organization just makes a ton of stuff go wrong all at the same time. I agree with your first point because if you were to do a cursory glance at what could efficiently kill us in biology you would see how little effort is actually required. Anyone with a little knowledge could pull off a devastating attack using just DMSO and a few toxic compounds.
  - NegativeK 14y ago
    Would it not induce terror if Al Qaeda started interfering with vast swaths of people's daily lives? Power keeps going out for a few hours, cell phones go down at the same time, water is shut down because of bacterial contamination.. People wouldn't directly die, but living in a less stable environment is going to worry people.
zobzu 14y ago
So does a wire cutter :-)
neurotech1 14y ago
This is dangerously close to the point where a shiny new EA-18G Growler from NAS Patuxent River will track down whoever is using such a device. Even though EA-18 crew probably wont shoot at the rouge transmitter, they can still pinpoint the exact location. Unlike more typical FCC investigator using a radio direction finder, the EA-18 is quite fast, both getting there and searching. The EA-18 is capable of working around cell towers for locating phones in the area.
- FireBeyond 14y ago
  "Even though EA-18 crew probably wont shoot at the rouge transmitter" Better red than dead...?
coin 14y ago
Unrelated but why can't I pinch zoom on bgr.com's site? They must be severing up a mobile version. I really wish these sites would just serve up the normal non-mobile version.
dchichkov 14y ago
I can see two problems with disabling communications city-wide with such an approach. First - any cell phone, not in the line-of-sight with the jammer is not going to be disabled. And second - FCC and network ops would locate the jammer and disable it. To make this attack successful, one need to put the transmitter sufficiently high, and make it mobile. Flying it on a conventional airplane wouldn't work, because air force, FAA and police would be on such high profile case in no time. Flying it on the UAV RC helicopter could be a solution, but given the weight of the transmitter, antenna and fuel, that makes the resulting setup rather heavy and expensive to make and operate - well above 10k. A large tethered balloon also wouldn't work, because it would be spotted in no time. All and all, this attack just wouldn't work city-wide.
- dchichkov 14y ago
  And also, a defense from such an overcomplicated hack could be as simple as a fall-back from 4G to 3G, or even 2.5G.
pdknsk 14y ago
For anyone who wants to build their own device, albeit with much smaller radius, adafruit has detailed instructions. http://www.ladyada.net/make/wavebubble/ http://www.ladyada.net/make/wavebubble/

86 points by donohoe 14y ago

Governments are more likely to use something like this. For example to block an area (protestors) to communicate from outside. Share photos or videos that might damaging, etc.

guimarin 14y ago

I see your transmitter, and I raise you three equally cheap receivers and a machete.

vegardx 14y ago

But you'll have to start running pretty fast, as it is very easy to pinpoint the exact location of the sender/jammer. This is also true for any network, not just LTE. WiFi, GSM, HDSPA, etc. Many military vehicles have jammers like this to block mobile connectivity in order to prevent IEDs.

SilasX 14y ago
Sure, if you're expecting the attack. But most areas aren't expecting such an attack, so when you do, then as long as they turn it off in time and run away, the authorities probably won't be able to mobilize in time in take the measures to find the source. This would change if it started to become a common occurrence.

ghshephard 14y ago

Such behavior is criminal in nature. And the FCC will find you, and they will crack down on you. "Federal law prohibits the operation, marketing, or sale of any type of jamming equipment, including devices that interfere with cellular and Personal Communication Services (PCS), police radar, Global Positioning Systems (GPS), and wireless networking services (Wi-Fi)." 47 U.S.C. § 301, § 302a(b), § 333 all make it clear that this activity is illegal. Just selling jamming devices will attract the FCC's attention. https://www.fcc.gov/document/craigslistorg-users-warned-remove-postings-illegal-jammers https://www.fcc.gov/document/craigslistorg-users-warned-remo... Once you've decided to be a criminal, you don't need a $650 device to do a lot of damage. A $20 container of gasoline, or, heck, a $5 piece of chain link at the right electrical substation can cause tens of millions of dollars of damage.

mindstab 14y ago
I think you miss the point. Such a critical system should not be so fragile that pretty much anyone can disable it, one would hope.
- ghshephard 14y ago
  No - I totally get the point. But, if you are going to engage in criminal activity, the bar to your destructive behavior isn't a $650 transmitter. It's a $20 containers of gasoline. If you want to hurt people, it's pretty much impossible to stop you from doing so (or even slowing you down) - all we can do is catch you, and put you in prison after you do so so that you can't hurt more people. I'm not suggesting we ignore security (I like SSL, and passwords on my accounts) - but we can't create a world where everyone has to treat the populace as though they are intent on creating destruction. This is the mindset of the TSA and "Search everyone, because any one of them might be carrying a bomb." At a certain point, we have to trust that the vast, vast majority of people are good. And, in the whole scope of things, jamming an LTE radio transmission system has pretty big penalties, and very little financial payoff, and a pretty good chance of being caught. It's one of those asymmetric criminal activities that is balanced in favor of society, and against the criminal. Where you want to put your attention in enhancing defenses, is places where there is a strong incentive to commit the crime, and less chance of being caught. Guarding against petty thieves, lots of safeguards/fraud alerts around things like credit cards, or your paypal account. That's where attention needs to be spent. You know where it's important to spend a lot of money on counter-jamming? Life Safety systems like Nuclear Power Plants, or Plane/Car navigation systems. Where lives are on the line, I totally agree that we need to harden, harden, harden those systems. Also, SCADA systems - that control large amounts of underlying infrastructure. And the Stock Exchange. Spend a fortune on ensuring that the bad guys can't cause havoc, kill people, or create large economic damage. Perhaps your LTE/Cellular coverage is better than mine, but I'm pretty used to having to track down a WiFi connection to get any serious work done, or make a reliable Skype call. I don't put LTE coverage in the "Mission Critical" category of infrastructure. Also, if you are in a situation (Prison, battlefield) where the vast majority of your opponents are intent on doing you harm, you also harden the crap out of everything. And pay the price - because you need to. But, all else equal, I'd rather have the money/resources that might have gone into putting MILSPEC anti-jamming capabilities into my LTE NIC, instead be spent on making it cost less, draw less battery, and give me more bandwidth. Let the FCC catch the 3-5 jammers at year intent on doing harm, and put them in prison to consider the wisdom of their behavior.

jacquesm 14y ago

Breaking will always be easier than making. A 'jammer' is about the easiest kind of transmitter to make, you don't care about signal quality at all (you want the worst signal quality). For an analogue: you can take a length of steel chain to the nearest powerstation and lob it over the fence. Likely you'll spend a lot less than $650 and do substantial damage. That doesn't mean that the powerstation is badly designed, it just means that we expect people to behave in a non-destructive way and we use the law against those that can't seem to live by the rules. Society is a fragile thing, a few hundred dedicated jerks can undo the work of hundreds of thousands. Breaking things is dead easy. edit: credit for the powerline + chain idea in this thread goes to ghshephard, score one for parallel invention.

Nrsolis 14y ago
I think the main thrust of the article is that many systems are vulnerable to control channel interruptions. In those scenarios, a jammer can be far less powerful and much harder to detect. In many cases, the underlying encryption system for communications is particularly vulnerable to disruption. In those cases, individual bit flips caused by intelligent jammers can cause the loss of entire frames. BTW, the public safety standard for digital radios (P25) is also vulnerable to this sort of attack. IIRC, jamming the digital system often had the side effect of getting users to switch to less-secure (unencrypted) analog modes that were vulnerable to interception.
- xyzzy123 14y ago
  Indeed. More amusingly though (but still on the control channel), the open p25 group found that you could remotely brick responder radios, without authentication: http://risky.biz/RB178 http://risky.biz/RB178
wmf 14y ago
If you read the paper, the authors discovered ways to make LTE jamming 20 dB more efficient than brute force; arguably this is a legitimate weakness in LTE. IIRC other protocols are just as bad, so I am skeptical that these vulnerabilities are relevant when designing a public safety network.

mistercow 14y ago

It's pretty inexpensive to buy a laser you can shoot at a helicopter or airplane, temporarily blinding the pilot. With no equipment whatsoever, you can go to your local grocery store and start opening bottles of cooking oil and dumping them on the floor. Besides costing the store money in lost inventory and cleanup, you can easily cause hundreds of thousands of dollars worth of damage in medical costs from people slipping on the oil. You can also buy a cheap car for around $700 and use it to start running down pedestrians. What all of these have in common is that they are inexpensive and easy to do, they are virtually impossible to defend against, and they leave the perpetrator holding the bag. And the bag I'm talking about is huge and glowing. It has big flashing neon letters on it that alternate "I'M THE HUGE ASSHOLE YOU'RE LOOKING FOR!" and "COME ARREST ME!" Look at it that way, and this hardly even seems like news. It's just another addition to the staggeringly long list of easy ways to disrupt society that have near 100% odds of landing you in jail.

anigbrowl 14y ago
For contrast: http://en.wikipedia.org/wiki/2007_Boston_bomb_scare http://en.wikipedia.org/wiki/2007_Boston_bomb_scare There nobody was trying to be an asshole (or failed to appreciate how their little art project would be interpreted), but by putting it near a prominent transit artery it wound up being significantly disruptive due to the resulting anxiety. A key difference from your examples is that they're all localized, and the effects don't ripple very far. Another is that they're easily explicable - some violent person vandalizing a store or mowing people down in a car is frightening but also easily comprehensible. The litebrite bomb scare described above didn't involve any actual attack, but the confusion led many people to imagine the worst.
- mistercow 14y ago
  I think that example more than anything demonstrates a completely different danger to society comprising two related phenomena: 1. Media sensationalism encouraged by an opportunistic government, engineered to whip the public into a terrified frenzy, and 2. Poorly trained and paranoid law enforcement with no sense of perspective. I don't think it has much relevance to jamming public WiFi, except peripherally in that news stories like this may do more harm than good.

JonnieCache 14y ago

I see the fact that you don't ever hear of people doing this, or chucking things into substations or off roadbridges and so on, as the ultimate evidence that international terrorist networks, to a first approximation, do not exist. If there really were highly organised terrorists everywhere plotting against us, wreaking substantial havoc across society would be pretty easy for them. The actual attacks that do occasionally happen are more in line with politically irrelevant rogue lunatics, placing grandiosity over efficacy.

akiselev 14y ago
Havoc != terror. Terrorists try to create fear and have a major impact on the populace, most often through bombings and death. Jamming a small (for now) part of our communications infrastructure could be a major detriment to people functioning but no one will fear for their lives. That does not preclude, however, a Gotham city like scenario where an organization just makes a ton of stuff go wrong all at the same time. I agree with your first point because if you were to do a cursory glance at what could efficiently kill us in biology you would see how little effort is actually required. Anyone with a little knowledge could pull off a devastating attack using just DMSO and a few toxic compounds.
- NegativeK 14y ago
  Would it not induce terror if Al Qaeda started interfering with vast swaths of people's daily lives? Power keeps going out for a few hours, cell phones go down at the same time, water is shut down because of bacterial contamination.. People wouldn't directly die, but living in a less stable environment is going to worry people.

zobzu 14y ago

So does a wire cutter :-)

neurotech1 14y ago

This is dangerously close to the point where a shiny new EA-18G Growler from NAS Patuxent River will track down whoever is using such a device. Even though EA-18 crew probably wont shoot at the rouge transmitter, they can still pinpoint the exact location. Unlike more typical FCC investigator using a radio direction finder, the EA-18 is quite fast, both getting there and searching. The EA-18 is capable of working around cell towers for locating phones in the area.

FireBeyond 14y ago
"Even though EA-18 crew probably wont shoot at the rouge transmitter" Better red than dead...?

coin 14y ago

Unrelated but why can't I pinch zoom on bgr.com's site? They must be severing up a mobile version. I really wish these sites would just serve up the normal non-mobile version.

dchichkov 14y ago

I can see two problems with disabling communications city-wide with such an approach. First - any cell phone, not in the line-of-sight with the jammer is not going to be disabled. And second - FCC and network ops would locate the jammer and disable it. To make this attack successful, one need to put the transmitter sufficiently high, and make it mobile. Flying it on a conventional airplane wouldn't work, because air force, FAA and police would be on such high profile case in no time. Flying it on the UAV RC helicopter could be a solution, but given the weight of the transmitter, antenna and fuel, that makes the resulting setup rather heavy and expensive to make and operate - well above 10k. A large tethered balloon also wouldn't work, because it would be spotted in no time. All and all, this attack just wouldn't work city-wide.

dchichkov 14y ago
And also, a defense from such an overcomplicated hack could be as simple as a fall-back from 4G to 3G, or even 2.5G.

pdknsk 14y ago

For anyone who wants to build their own device, albeit with much smaller radius, adafruit has detailed instructions. http://www.ladyada.net/make/wavebubble/ http://www.ladyada.net/make/wavebubble/