A $650 transmitter can disable an entire city’s high speed mobile phone network
bgr.com
bgr.com
For an analogue: you can take a length of steel chain to the nearest powerstation and lob it over the fence. Likely you'll spend a lot less than $650 and do substantial damage.
That doesn't mean that the powerstation is badly designed, it just means that we expect people to behave in a non-destructive way and we use the law against those that can't seem to live by the rules.
Society is a fragile thing, a few hundred dedicated jerks can undo the work of hundreds of thousands.
Breaking things is dead easy.
edit: credit for the powerline + chain idea in this thread goes to ghshephard, score one for parallel invention.
In many cases, the underlying encryption system for communications is particularly vulnerable to disruption. In those cases, individual bit flips caused by intelligent jammers can cause the loss of entire frames.
BTW, the public safety standard for digital radios (P25) is also vulnerable to this sort of attack. IIRC, jamming the digital system often had the side effect of getting users to switch to less-secure (unencrypted) analog modes that were vulnerable to interception.
20 dB is a big deal because it would make the jammer a lot harder to locate, especially if it times its interruption well and can get away with extremely short bursts of activity followed by relatively long periods of silence.
Other tricks of the trade: jam from multiple locations with short bursts, slap the jammer right under the nose of the receiver that you want to jam (that way you need a minimal signal and are almost impossible to detect at range until you're right up to it).
This is the way TV pirates in Amsterdam would broadcast their signals in the 80's to the receiving dishes on Hotel Okura. They were so low power and right up close to the dishes that they could push legitimate broadcasts (mostly German TV) right out of their slot. KTA (the then monopolist on Cable TV in Amsterdam) had the un-enviable task to come up with a solution and finally settled on a system where if one antenna was flooded with a rogue signal they would switch to antennae mounted on a chimney of the electricity plant on the other side of the city (Amsterdam had very little high buildings).
Of course, pirate TV stations found out about this quickly enough and located another transmitter near there and so on.
I have all this info from hearsay, cough.
A collective of Czech artists spliced a nuclear explosion into a television signal and made quite a splash.
It was pretty funny (if you like this sort of irony) to see the footage in an installation in one of Prague's national galleries.
More details here: http://www.guardian.co.uk/world/2008/jan/04/artnews.art
> I have all this info from hearsay, cough.
Shucks! I was sure your read about this in a book :)
The synchronization signals in LTE are split in two parts, the PSS (P for Primary) and SSS (S for secondary). Both are using 62 LTE carriers, each one being 15 kHz, so cover 0.93 MHz. For comparison, a 3G channel is 5 MHz and a CDMA channel is 1.25 MHz. 2G is even narrower (memory fails me there...). So not widely different. And not using the whole channel bandwidth in LTE has very nice consequences: the phone doesn't need to know the channel size to synchronize (not the case in WiMAX for example), and the implementation can be lighter and more power efficient.
Then the paper pretends that transmitting a fake PSS would fool LTE devices. Nonsense. Any PSS detection algorithm has plenty of false detection already, and detecting a PSS is nothing until the matching SSS is also detected, with good quality. But then it's not so simple, the jammer don't transmit noise anymore: you have to transmit a true PSS/SSS pair. That won't get you very far, the UE will try this, won't find a matching BCCH and move on. And did I mention that this part is very robust? A UE can detect a cell well below the noise floor. That's required because in a real network with TD-LTE (and even for FD-LTE in the future) all the cells are synchronized and transmit PSS/SSS at (roughly) the same time. So it is expected that PSS/SSS will be interfered, and the device can deal with this. So you really have to transmit at a strong level to mess things.
But in the end, the point is that any public cellular technology is sensitive to jamming, and jamming is dead easy. To protect against this there are well known techniques used in military applications. But guess what? The whole system because way less efficient in capacity and much more complex. And capacity is key.
Optimizing a public system, where capacity is key, for typically non existing threats is just not practical. Everybody should realize this. If you want robustness to jamming use a military grade system, and pay the price.
Move along, nothing really interesting to see.
The US military got this: http://www.fas.org/man/dod-101/sys/dumb/blu-114.htm. Carbon fiber instead of the chain, but same principle.
As you say this would cause a power outage, but not necessarily break any equipment as the protection is quite robust and moreso the more critical the facility.
Previously the substations had a small fence around them. There have been work crews working on each station one at a time to completely overhaul the security. They placed a much larger electrified fence around the station, placed most of the transformers into small brick buildings and have a chain link fence covering the entire complex (a fence that is easily collapsed back for emergency access).
You can tell that they spend a lot of money on these security improvements, there are large alarms, big warning signs, they sat the fences a dozen yards or so further back so you can't get closer.
It didn't need a security incident for this power company to figure out that they had a simple vulnerability and to fix it.
That said, there is no equivalent easy improvement that could be made to LTE networks to secure them. The flaw is in the protocols, and fixing it would require a new network stack and new phones, not just a bigger fence.
> This information comes from research carried out in the U.S. into the possibility of using LTE networks as the basis for a next-generation emergency response communications system.
I can agree that "civilian" systems can except people to behave in a non-destructive way. But a law-enforcement/emergency system should be reasonably resilient (of course not immune, but resilient) against interference. Thus the value of this study is that it exposes that LTE is not suitable for such use.
"Federal law prohibits the operation, marketing, or sale of any type of jamming equipment, including devices that interfere with cellular and Personal Communication Services (PCS), police radar, Global Positioning Systems (GPS), and wireless networking services (Wi-Fi)."
47 U.S.C. § 301, § 302a(b), § 333 all make it clear that this activity is illegal.
Just selling jamming devices will attract the FCC's attention. https://www.fcc.gov/document/craigslistorg-users-warned-remo...
Once you've decided to be a criminal, you don't need a $650 device to do a lot of damage. A $20 container of gasoline, or, heck, a $5 piece of chain link at the right electrical substation can cause tens of millions of dollars of damage.
If you want to hurt people, it's pretty much impossible to stop you from doing so (or even slowing you down) - all we can do is catch you, and put you in prison after you do so so that you can't hurt more people.
I'm not suggesting we ignore security (I like SSL, and passwords on my accounts) - but we can't create a world where everyone has to treat the populace as though they are intent on creating destruction. This is the mindset of the TSA and "Search everyone, because any one of them might be carrying a bomb." At a certain point, we have to trust that the vast, vast majority of people are good.
And, in the whole scope of things, jamming an LTE radio transmission system has pretty big penalties, and very little financial payoff, and a pretty good chance of being caught. It's one of those asymmetric criminal activities that is balanced in favor of society, and against the criminal.
Where you want to put your attention in enhancing defenses, is places where there is a strong incentive to commit the crime, and less chance of being caught. Guarding against petty thieves, lots of safeguards/fraud alerts around things like credit cards, or your paypal account. That's where attention needs to be spent.
You know where it's important to spend a lot of money on counter-jamming? Life Safety systems like Nuclear Power Plants, or Plane/Car navigation systems. Where lives are on the line, I totally agree that we need to harden, harden, harden those systems. Also, SCADA systems - that control large amounts of underlying infrastructure. And the Stock Exchange. Spend a fortune on ensuring that the bad guys can't cause havoc, kill people, or create large economic damage.
Perhaps your LTE/Cellular coverage is better than mine, but I'm pretty used to having to track down a WiFi connection to get any serious work done, or make a reliable Skype call. I don't put LTE coverage in the "Mission Critical" category of infrastructure.
Also, if you are in a situation (Prison, battlefield) where the vast majority of your opponents are intent on doing you harm, you also harden the crap out of everything. And pay the price - because you need to.
But, all else equal, I'd rather have the money/resources that might have gone into putting MILSPEC anti-jamming capabilities into my LTE NIC, instead be spent on making it cost less, draw less battery, and give me more bandwidth.
Let the FCC catch the 3-5 jammers at year intent on doing harm, and put them in prison to consider the wisdom of their behavior.
For example, when I was managing the IT organization for our company, despite the fact that everyone in the office has a cell phone, and despite the fact that they also have a VOIP phone (Polycom Soundpoint IP 501 SIP), that is driven of of POE connections, and we have a generator with 36 hours of diesel supplying the routers/switches that supply those phone - Every conference room had a POTS (Plain Old Telephone Systems) analog phone line that was cross-connected with a piece of copper at our punch-down block, directly to the 300 pair coming into our MPOE - no active electronics (on site) required. Those land lines are the critical infrastructure, that need to be defended (along with COs backing them up).
If someone comes up with a good (cheap) attack against them, that will get my attention.
I guess another way of approaching this is, if Police/Fire/Medical organization start relying on LTE systems, and those LTE systems become a critical part of our infrastructure for economic/infrastructure/life safety systems, then yes, we need to start focussing on hardening them.
This is my way of saying yes, when we wargame this out, we should consider "What happens if there is an extended LTE outage during a disaster, does this impact our first responders significantly? And if so, we need to take steps to protect ourselves there."
Important to note - it's highly unlikely that any group of people will be able to establish a coordinated attack on 20 major metros. That level of conspiracy would be stopped by the time planning got to the 3-5 city attack.
And that's another point - let's not spend large sums of money trying to harden the LTE system (though, reasonable investment makes sense, so the research presented is good) - but instead, let's direct those resources to tracking (and stopping) the bad guys that would do this sort of thing in the first place. That, then, protects us from all of their attacks, not just the LTE wireless system.
If I get you right this beat on the 'dumb' jammer because the power imbalance worked to the advantage of the defender: knowing when to listen for the very short pulse at high power level coming from the transmitter and ignoring its input the rest of the time other than to establish a baseline noise level, whereas the jammer would have to blanket the whole spectrum not knowing when the next pulse would be until it came?
So essentially the only way to break the system would then be to figure out ahead of time when a pulse would be transmitted and presumably the sequence of intervals between pulses was sufficiently hard to predict that this would take much longer than it took to get to the point of the next transmitted burst?
The claim was that the only "known" way to jam the system was to raise the noise floor to the point where the pulses could not be distinguished, and they showed a number of scenarios that didn't work.
It's trivial to do. Make a bunch of jammers on timers, and plant them around dozens of major cities at your leisure. One disaffected person working alone could do it.
P.S. Magnetrons are tunable by simply changing the magnets, and microwave ovens can be had for $20 apiece if you buy in large quantity. It does not cost $650 to make a very powerful jammer.
Important to note - it's highly unlikely that any group of people will be able to establish a coordinated attack on 20 major metros. That level of conspiracy would be stopped by the time planning got to the 3-5 city attack.
The beauty of such an attack (from an asymmetrical PoV - obviously I don't endorse such things) is that the you don't have to deal with proscribed or highly controlled things like explosives. This means that the stakes are low and you can afford redundancy. If you disrupt the LTE system for an hour at a time on a random weekday using a mobile transmission source, you could probably get away with doing so for a while. Again, the public perception that even consumer information (rather than critical) infrastructure can be disrupted at some malicious actor's pleasure is an implicit win for a hostile organization or state actor.
The problem here is that officials are considering using LTE for communication between emergency responders. And that would make LTE very much "mission critical".
Hah! I see I used the exact same example you did, this is funny because I swear I had not looked at your text before writing mine. Low tech sabotage is an interesting subject, and I think it is almost impossible to defend against.
Have an upvote.
A long time ago around a campfire in Colorado this subject came up, how much damage could you do with $5? Gasoline came up quite a few times, the water supply and electrical utility were the main targets of opportunity.
My $5 would be spent on a large wrench to undo the foundation nuts of power line towers.
The next storm would do the actual work and would take down half the grid. I don't think the power companies are in the habit of checking those nuts to see if they're still there.
And you wouldn't have to hit all of them either, just a few choice ones.
You're gonna need a breaker bar for that which will cost you more than $5 (but not much more... your point stands).
You're thinking of a torque wrench.
The pipe extension trick won't work for torque values far exceeding the rating of the breaker bar. I've snapped the head off a breaker bar with a pipe on it. Generally, I've needed a breaker bar with a 30% higher torque limit than the torque specs of a bolt/nut in order to loosen said fastener after it's settled (generally a few days). Change that to about 50% higher once the fastener has fused to its shaft/bolt/socket (months to years, depending on environment too).
If you could get a torque wrench for $5 that would torque down power line tower fasteners to spec, then yes, I'd agree that a $5 breaker bar would do the job. It should only be stronger than a torque wrench of similar price.
The thing is that the fasteners for power line towers are huge, way bigger than the fasteners I've encountered working on cars. Fasteners that large aren't practical to lay down with mechanical tools that amplify human strength. They'll require pneumatic or hydraulic power equipment.
I still agree with your basic premise that cheap equipment can easily destroy expensive setups with some creativity. Perhaps a fuel source like thermite or magnesium would work.
I'm asking this out of curiosity, rather than to imply either that it is the case or that if it were the case it would somehow be a bad thing. Is it at all possible that your eye might have caught what he said without actively reading it, and planted a seed in your subconscious?
The station wasn't particularly big and I'm not sure how much damage such a move would have made but I still felt quite weird given that there ought to be at least a fair sized fence around an installation like that if only for safety.
Low $ sabotage is an interesting subject, it shows well how asymmetry works to the advantage of an attacker, not unlike how our computer security is arranged for. Attackers only need to get through once, defenders have to succeed all the time.
You by yourself could undo the work of many more people of a similar skill level. It's quite sobering to realize just how fragile all this stuff is.
Theoretically, it is possible to triangulate the jamming signal by pinging cell phones and finding which ones aren't in the dark, mapping it to find the guy but it could take hours and the damage would have already been done.
oh, and sales of jammers have been going on for years on craigslist, I'm surprised they've just shut it down this year.
http://www.arrl.org/news/fcc-takes-strong-stance-against-rad...
The authors are obviously not worried about some kids doing a prank with jammers or anything like that. They are worried that criminals would use jammers to execute their crimes.
If there really were highly organised terrorists everywhere plotting against us, wreaking substantial havoc across society would be pretty easy for them. The actual attacks that do occasionally happen are more in line with politically irrelevant rogue lunatics, placing grandiosity over efficacy.
Terrorists try to create fear and have a major impact on the populace, most often through bombings and death. Jamming a small (for now) part of our communications infrastructure could be a major detriment to people functioning but no one will fear for their lives.
That does not preclude, however, a Gotham city like scenario where an organization just makes a ton of stuff go wrong all at the same time.
I agree with your first point because if you were to do a cursory glance at what could efficiently kill us in biology you would see how little effort is actually required. Anyone with a little knowledge could pull off a devastating attack using just DMSO and a few toxic compounds.
Power keeps going out for a few hours, cell phones go down at the same time, water is shut down because of bacterial contamination.. People wouldn't directly die, but living in a less stable environment is going to worry people.
With no equipment whatsoever, you can go to your local grocery store and start opening bottles of cooking oil and dumping them on the floor. Besides costing the store money in lost inventory and cleanup, you can easily cause hundreds of thousands of dollars worth of damage in medical costs from people slipping on the oil.
You can also buy a cheap car for around $700 and use it to start running down pedestrians.
What all of these have in common is that they are inexpensive and easy to do, they are virtually impossible to defend against, and they leave the perpetrator holding the bag. And the bag I'm talking about is huge and glowing. It has big flashing neon letters on it that alternate "I'M THE HUGE ASSHOLE YOU'RE LOOKING FOR!" and "COME ARREST ME!"
Look at it that way, and this hardly even seems like news. It's just another addition to the staggeringly long list of easy ways to disrupt society that have near 100% odds of landing you in jail.
A key difference from your examples is that they're all localized, and the effects don't ripple very far. Another is that they're easily explicable - some violent person vandalizing a store or mowing people down in a car is frightening but also easily comprehensible. The litebrite bomb scare described above didn't involve any actual attack, but the confusion led many people to imagine the worst.
1. Media sensationalism encouraged by an opportunistic government, engineered to whip the public into a terrified frenzy, and
2. Poorly trained and paranoid law enforcement with no sense of perspective.
I don't think it has much relevance to jamming public WiFi, except peripherally in that news stories like this may do more harm than good.
Because if so, no, I don't think that's an adequate explanation. Obviously not malice, but just greed. The media is greedy and likes to air stories that sell, even if they are irresponsible. Politicians and government agencies are greedy for power and know that taking advantage of people's fear of terrorism is an easy way to grab that power. It's not evil for the sake of evil; it's evil for the sake of money and political gain.
But it's definitely not mere stupidity.
This would change if it started to become a common occurrence.
To make this attack successful, one need to put the transmitter sufficiently high, and make it mobile. Flying it on a conventional airplane wouldn't work, because air force, FAA and police would be on such high profile case in no time. Flying it on the UAV RC helicopter could be a solution, but given the weight of the transmitter, antenna and fuel, that makes the resulting setup rather heavy and expensive to make and operate - well above 10k. A large tethered balloon also wouldn't work, because it would be spotted in no time.
All and all, this attack just wouldn't work city-wide.
The EA-18 is capable of working around cell towers for locating phones in the area.
Better red than dead...?