Hacker News Reader

Comment by ghshephard | Hacker News Reader

Such behavior is criminal in nature. And the FCC will find you, and they will crack down on you.

"Federal law prohibits the operation, marketing, or sale of any type of jamming equipment, including devices that interfere with cellular and Personal Communication Services (PCS), police radar, Global Positioning Systems (GPS), and wireless networking services (Wi-Fi)."

47 U.S.C. § 301, § 302a(b), § 333 all make it clear that this activity is illegal.

Just selling jamming devices will attract the FCC's attention. https://www.fcc.gov/document/craigslistorg-users-warned-remo...

Once you've decided to be a criminal, you don't need a $650 device to do a lot of damage. A $20 container of gasoline, or, heck, a $5 piece of chain link at the right electrical substation can cause tens of millions of dollars of damage.

View on HN

> a $5 piece of chain link at the right electrical substation

Hah! I see I used the exact same example you did, this is funny because I swear I had not looked at your text before writing mine. Low tech sabotage is an interesting subject, and I think it is almost impossible to defend against.

Have an upvote.

A long time ago around a campfire in Colorado this subject came up, how much damage could you do with $5? Gasoline came up quite a few times, the water supply and electrical utility were the main targets of opportunity.

My $5 would be spent on a large wrench to undo the foundation nuts of power line towers.

The next storm would do the actual work and would take down half the grid. I don't think the power companies are in the habit of checking those nuts to see if they're still there.

And you wouldn't have to hit all of them either, just a few choice ones.

My $5 would be spent on a large wrench to undo the foundation nuts of power line towers.

You're gonna need a breaker bar for that which will cost you more than $5 (but not much more... your point stands).

A wrench large enough to budge a foundation nut costs closer to $100. A $5 wrench with a breaker bar will just snap the wrench.

A breaker bar is actually a non-ratcheting socket driver. Not something you fit over a wrench (for that you could use any chunk of pipe). Since a breaker bar (or actually the torque measuring version of it) is what is usually used to tighten such nuts I'd imagine it could be used to loosen them as well.

> Since a breaker bar (or actually the torque measuring version of it)

You're thinking of a torque wrench.

The pipe extension trick won't work for torque values far exceeding the rating of the breaker bar. I've snapped the head off a breaker bar with a pipe on it. Generally, I've needed a breaker bar with a 30% higher torque limit than the torque specs of a bolt/nut in order to loosen said fastener after it's settled (generally a few days). Change that to about 50% higher once the fastener has fused to its shaft/bolt/socket (months to years, depending on environment too).

If you could get a torque wrench for $5 that would torque down power line tower fasteners to spec, then yes, I'd agree that a $5 breaker bar would do the job. It should only be stronger than a torque wrench of similar price.

The thing is that the fasteners for power line towers are huge, way bigger than the fasteners I've encountered working on cars. Fasteners that large aren't practical to lay down with mechanical tools that amplify human strength. They'll require pneumatic or hydraulic power equipment.

I still agree with your basic premise that cheap equipment can easily destroy expensive setups with some creativity. Perhaps a fuel source like thermite or magnesium would work.

$5 worth of powered aluminum and rust will do quite a fine job of taking off a foundation nut.

And easier to set a fuse so you can be somewhere else when it topples over.

> I swear I had not looked at your text before writing mine

I'm asking this out of curiosity, rather than to imply either that it is the case or that if it were the case it would somehow be a bad thing. Is it at all possible that your eye might have caught what he said without actively reading it, and planted a seed in your subconscious?

No, I've already related that particular trick on several occasions to various people. I even remember the very first time I talked about it with a guy named Nick (who worked for me at the time) while walking in Toronto, we came across a utility plant (basically nothing but a very large transformer) on the edge of downtown that was so exposed that I thought it was unsafe and remarked how easy it would be to throw some chain over the wires.

The station wasn't particularly big and I'm not sure how much damage such a move would have made but I still felt quite weird given that there ought to be at least a fair sized fence around an installation like that if only for safety.

Low $ sabotage is an interesting subject, it shows well how asymmetry works to the advantage of an attacker, not unlike how our computer security is arranged for. Attackers only need to get through once, defenders have to succeed all the time.

You by yourself could undo the work of many more people of a similar skill level. It's quite sobering to realize just how fragile all this stuff is.

While jamming is criminal behavior, the fcc won't be able to find you, in fact, the FCC have yet to even prosecute a single person for cell phone jamming since it's very hard to find and it's very easy hide jammers because people just think they're in a dead zone or their phone is malfunctioning

Theoretically, it is possible to triangulate the jamming signal by pinging cell phones and finding which ones aren't in the dark, mapping it to find the guy but it could take hours and the damage would have already been done.

oh, and sales of jammers have been going on for years on craigslist, I'm surprised they've just shut it down this year.

They have found and fined jammers of other services. Ham radio operators deal with this all the time.

http://www.arrl.org/news/fcc-takes-strong-stance-against-rad...

I think you miss the point. Such a critical system should not be so fragile that pretty much anyone can disable it, one would hope.

No - I totally get the point. But, if you are going to engage in criminal activity, the bar to your destructive behavior isn't a $650 transmitter. It's a $20 containers of gasoline.

If you want to hurt people, it's pretty much impossible to stop you from doing so (or even slowing you down) - all we can do is catch you, and put you in prison after you do so so that you can't hurt more people.

I'm not suggesting we ignore security (I like SSL, and passwords on my accounts) - but we can't create a world where everyone has to treat the populace as though they are intent on creating destruction. This is the mindset of the TSA and "Search everyone, because any one of them might be carrying a bomb." At a certain point, we have to trust that the vast, vast majority of people are good.

And, in the whole scope of things, jamming an LTE radio transmission system has pretty big penalties, and very little financial payoff, and a pretty good chance of being caught. It's one of those asymmetric criminal activities that is balanced in favor of society, and against the criminal.

Where you want to put your attention in enhancing defenses, is places where there is a strong incentive to commit the crime, and less chance of being caught. Guarding against petty thieves, lots of safeguards/fraud alerts around things like credit cards, or your paypal account. That's where attention needs to be spent.

You know where it's important to spend a lot of money on counter-jamming? Life Safety systems like Nuclear Power Plants, or Plane/Car navigation systems. Where lives are on the line, I totally agree that we need to harden, harden, harden those systems. Also, SCADA systems - that control large amounts of underlying infrastructure. And the Stock Exchange. Spend a fortune on ensuring that the bad guys can't cause havoc, kill people, or create large economic damage.

Perhaps your LTE/Cellular coverage is better than mine, but I'm pretty used to having to track down a WiFi connection to get any serious work done, or make a reliable Skype call. I don't put LTE coverage in the "Mission Critical" category of infrastructure.

Also, if you are in a situation (Prison, battlefield) where the vast majority of your opponents are intent on doing you harm, you also harden the crap out of everything. And pay the price - because you need to.

But, all else equal, I'd rather have the money/resources that might have gone into putting MILSPEC anti-jamming capabilities into my LTE NIC, instead be spent on making it cost less, draw less battery, and give me more bandwidth.

Let the FCC catch the 3-5 jammers at year intent on doing harm, and put them in prison to consider the wisdom of their behavior.

I think you're arguing at cross-purposes. You are quite right in relation to crime or vandalism by a member of US society carried out for mere profit or malice. But consider the more troubling case of terrorism or similar organized attack. If one can disrupt cellular communications on a large scale parallel to an attack on physical infrastructure (eg a bomb or...), the immediate and economic damage could be significantly multiplied. Likewise, consider temporary but coordinated outages in 10 or 20 major metros. It would be difficult to catch the perpetrators but would impose considerable economic costs.

I think the key is to understand what should be considered part of our "critical infrastructure" and ensure that is reliable.

For example, when I was managing the IT organization for our company, despite the fact that everyone in the office has a cell phone, and despite the fact that they also have a VOIP phone (Polycom Soundpoint IP 501 SIP), that is driven of of POE connections, and we have a generator with 36 hours of diesel supplying the routers/switches that supply those phone - Every conference room had a POTS (Plain Old Telephone Systems) analog phone line that was cross-connected with a piece of copper at our punch-down block, directly to the 300 pair coming into our MPOE - no active electronics (on site) required. Those land lines are the critical infrastructure, that need to be defended (along with COs backing them up).

If someone comes up with a good (cheap) attack against them, that will get my attention.

I guess another way of approaching this is, if Police/Fire/Medical organization start relying on LTE systems, and those LTE systems become a critical part of our infrastructure for economic/infrastructure/life safety systems, then yes, we need to start focussing on hardening them.

This is my way of saying yes, when we wargame this out, we should consider "What happens if there is an extended LTE outage during a disaster, does this impact our first responders significantly? And if so, we need to take steps to protect ourselves there."

Important to note - it's highly unlikely that any group of people will be able to establish a coordinated attack on 20 major metros. That level of conspiracy would be stopped by the time planning got to the 3-5 city attack.

And that's another point - let's not spend large sums of money trying to harden the LTE system (though, reasonable investment makes sense, so the research presented is good) - but instead, let's direct those resources to tracking (and stopping) the bad guys that would do this sort of thing in the first place. That, then, protects us from all of their attacks, not just the LTE wireless system.

I agree that the primary focus should be on critical infrastructure. But an important part of asymmetrical warfare is also to cause destabilization through uncertainty. If 4g is the norm 2 years from now and older technologies are being phased out, then disrupting the cellphone network in DC during the morning rush hour, for example, is likely to set off sufficient alarms and panic reactions that the response outweighs the disrupting incident itself. When I was younger I lived in London and the IRA was still conducting a terrorist campaign of bombing civilians as well as government targets in that city. They didn't set off bombs that frequently, but they issued bomb threats against the subway network on a near-weekly basis, and of course the authorities couldn't just blow off a bomb threat, so people's day-to-day travel routines would be disrupted at least once a month as one or other subway line were threatened.Nobody dies, but over time it adds up to a significant economic drain, to say nothing of the psychological burden it inflicts on the populace.

The beauty of such an attack (from an asymmetrical PoV - obviously I don't endorse such things) is that the you don't have to deal with proscribed or highly controlled things like explosives. This means that the stakes are low and you can afford redundancy. If you disrupt the LTE system for an hour at a time on a random weekday using a mobile transmission source, you could probably get away with doing so for a while. Again, the public perception that even consumer information (rather than critical) infrastructure can be disrupted at some malicious actor's pleasure is an implicit win for a hostile organization or state actor.

I'm not even sure that is possible to harden a wireless system to the point where an attacker can't bring it down for many orders of magnitude less investment than what it cost to put it up in the first place. The more sophisticated the more likely it can be brought down. If you want to get through use CW (Morse) and plenty of juice.

Actually such systems can be built, I saw a demo of one based on UWB tranceivers, it was proposed replacement for the JSTARS system. The reason it worked was that 'dumb' jammers needed to raise the entire noise floor, and 'smart' radios were using singletons (single pulses of RF energy across a wide spectrum of possible frequencies) so a small transmitter could use kilowatt nanosecond pulses which always landed above the noise floor.

That's amazingly clever.

If I get you right this beat on the 'dumb' jammer because the power imbalance worked to the advantage of the defender: knowing when to listen for the very short pulse at high power level coming from the transmitter and ignoring its input the rest of the time other than to establish a baseline noise level, whereas the jammer would have to blanket the whole spectrum not knowing when the next pulse would be until it came?

So essentially the only way to break the system would then be to figure out ahead of time when a pulse would be transmitted and presumably the sequence of intervals between pulses was sufficiently hard to predict that this would take much longer than it took to get to the point of the next transmitted burst?

That was pretty much the way I understood it to work, I didn't get to see 'behind the curtain' sadly. Two bits of the 'secret sauce' were keying sequencing / syncing and basically a frequency agile transceiver that operated at really high frequencies across a very wide chunk of spectrum.

The claim was that the only "known" way to jam the system was to raise the noise floor to the point where the pulses could not be distinguished, and they showed a number of scenarios that didn't work.

> Important to note - it's highly unlikely that any group of people will be able to establish a coordinated attack on 20 major metros. That level of conspiracy would be stopped by the time planning got to the 3-5 city attack.

It's trivial to do. Make a bunch of jammers on timers, and plant them around dozens of major cities at your leisure. One disaffected person working alone could do it.

P.S. Magnetrons are tunable by simply changing the magnets, and microwave ovens can be had for $20 apiece if you buy in large quantity. It does not cost $650 to make a very powerful jammer.

The more high-tech a society is the more vulnerable it is to this kind of attack. Infrastructure that isn't there can't be broken.

> I don't put LTE coverage in the "Mission Critical" category of infrastructure.

The problem here is that officials are considering using LTE for communication between emergency responders. And that would make LTE very much "mission critical".

This is crazy. Which is easier to get away with? Arson, or a suitcase dropped off somewhere jamming an entire city?

I think if you are doing a terrorist attack then FCC fines probably are least of your concerns.

The authors are obviously not worried about some kids doing a prank with jammers or anything like that. They are worried that criminals would use jammers to execute their crimes.

Reply on news.ycombinator.com