Jamming Attacks and Anti-Jamming Strategies in Wireless Networks | Hacker News Reader

Jamming Attacks and Anti-Jamming Strategies in Wireless Networks

arxiv.org

67 pointsadulau13 comments

Funny, I just finished my master thesis in this area. I implemented a highly effective DoS attack for LTE which relies on reactive signal overshadowing, a very efficient type of jamming. Sadly, overshadowing attacks in LTE are not covered in the paper, but have been present for some years now.

Here's the link if anyone is interested: https://doi.org/10.3929/ethz-b-000455834

all of the UEs tested exhibited total loss of LTE communication for more than 12 hours after being subjected to the attack.

Ouch. Thankfully we're not yet a wireless data monoculture.

A little bit off-topic but still relevant to jamming. I noticed the other day I went to a big electronics store (Mediamarkt) and noticed that my cellular connection died just as I entered the store. When asking about it, they told me the reception is just so poor there so I should use their WiFi instead. As I wanted to compare products with other stores, I used the WiFi.

But afterwards I started thinking, is it possible to store is doing this on purpose, in order to ex-filtrate data via the WiFi connection? They wouldn't get more than the hostname if it's over https, but who knows what more kind of data they could get from it. They could also block websites of competitors and blame the internet, and prevent consumers from comparing themselves.

Or I'm just a conspiracy-nut lite, but it wouldn't surprise me a lot if it was like that.

You're not crazy... Amazon patented it.

https://www.theverge.com/2017/6/15/15812986/amazon-patent-on...

After the target hacks stores started to install cellular suppressors. Some removed them because it turns out that's a bad idea. Some did not. Source: used to work with a friend for hardware deployment at stores.

Can a business model of capturing hostnames pay for the initial and ongoing costs of such a system? Isn't this kind of wireless hardware expensive at the scale of a business like this?

https://en.wikipedia.org/wiki/Hanlon%27s_razor

I might expect that kind of activity in the US but not the EU.

One of the big problems many of these stores have is that the mobile coverage actually is bad inside due to the building's structure. Many of them are reinforced concrete buildings wrapped in metal cladding (take an IKEA store as an example). So many larger supermarkets in some countries barely have coverage at the cash register so you can pay with a phone but you'll lose coverage as soon as you enter further. They mostly don't offer any solution for this, like WiFi APs or mobile base stations. There's also the much higher density of people at that spot which crowd the same base station.

I'd wager MediaMarkt faced the same issue, wanted to give some internet coverage, and found WiFi to be cheaper or easier to implement and maintain. They may have realized in the meantime that they can extract some useful data too.

in the US Target cooperates with cell phone carriers to disable service in their stores.

I am really interested in this.. Do you have a source?

It's more likely that the big metal walls of store were blocking the signal, instead of intentional jamming. They could, of course, take advantage of that to get people to connect to your wifi. That tells them at least how many people were in the store, and when.

Would it also be possible to estimate your location in the store using multiple access points and the latency between them? They might use that to track where people spend their time.

It wouldn't surprise me a bit. Find some hams and head back there with a spectrum analyzer. (Or get yourself a $25 rtlsdr dongle...)

There've also been cases of hotels sending deauth packets to other people's wifi hotspots, to force them to buy the hotel's wifi. Multiply that times a hundred vendors trying to run verifone terminals and stuff in a merch room, and it's a huge money grab.

An interesting research paper, thanks for posting it.

I've recently been fairly interested in smart homes, which (alongside WiFi) often use ZigBee and/or Z-Wave protocols.

Whilst Z-Wave isn't covered in this paper, ZigBee (which runs at 2.4 Ghz - but on higher channels than WiFi to prevent overlap) is covered. If I'm reading correctly, the paper seems to say that many anti-jamming techniques are successful with ZigBee, unlike previous research that concludes that it's usually harder to block ZigBee jamming attacks (ref 21)?

Reply on news.ycombinator.com