Hacker News Reader

Comment by jacquesm | Hacker News Reader

Breaking will always be easier than making. A 'jammer' is about the easiest kind of transmitter to make, you don't care about signal quality at all (you want the worst signal quality).

For an analogue: you can take a length of steel chain to the nearest powerstation and lob it over the fence. Likely you'll spend a lot less than $650 and do substantial damage.

That doesn't mean that the powerstation is badly designed, it just means that we expect people to behave in a non-destructive way and we use the law against those that can't seem to live by the rules.

Society is a fragile thing, a few hundred dedicated jerks can undo the work of hundreds of thousands.

Breaking things is dead easy.

edit: credit for the powerline + chain idea in this thread goes to ghshephard, score one for parallel invention.

View on HN

If you read the paper, the authors discovered ways to make LTE jamming 20 dB more efficient than brute force; arguably this is a legitimate weakness in LTE. IIRC other protocols are just as bad, so I am skeptical that these vulnerabilities are relevant when designing a public safety network.

In radio transmission there is no substitute for power, both on the jamming side as well as on the side that wants to get their message through.

20 dB is a big deal because it would make the jammer a lot harder to locate, especially if it times its interruption well and can get away with extremely short bursts of activity followed by relatively long periods of silence.

Other tricks of the trade: jam from multiple locations with short bursts, slap the jammer right under the nose of the receiver that you want to jam (that way you need a minimal signal and are almost impossible to detect at range until you're right up to it).

This is the way TV pirates in Amsterdam would broadcast their signals in the 80's to the receiving dishes on Hotel Okura. They were so low power and right up close to the dishes that they could push legitimate broadcasts (mostly German TV) right out of their slot. KTA (the then monopolist on Cable TV in Amsterdam) had the un-enviable task to come up with a solution and finally settled on a system where if one antenna was flooded with a rogue signal they would switch to antennae mounted on a chimney of the electricity plant on the other side of the city (Amsterdam had very little high buildings).

Of course, pirate TV stations found out about this quickly enough and located another transmitter near there and so on.

I have all this info from hearsay, cough.

This is a bit of topic; hopefully not too much so.

A collective of Czech artists spliced a nuclear explosion into a television signal and made quite a splash.

It was pretty funny (if you like this sort of irony) to see the footage in an installation in one of Prague's national galleries.

More details here: http://www.guardian.co.uk/world/2008/jan/04/artnews.art

> I have all this info from hearsay, cough.

Shucks! I was sure your read about this in a book :)

This paper really looks like sensationalist attention grabbing material, and I'm kind of disappointed to read this in the MIT review without any context or critical analysis.

The synchronization signals in LTE are split in two parts, the PSS (P for Primary) and SSS (S for secondary). Both are using 62 LTE carriers, each one being 15 kHz, so cover 0.93 MHz. For comparison, a 3G channel is 5 MHz and a CDMA channel is 1.25 MHz. 2G is even narrower (memory fails me there...). So not widely different. And not using the whole channel bandwidth in LTE has very nice consequences: the phone doesn't need to know the channel size to synchronize (not the case in WiMAX for example), and the implementation can be lighter and more power efficient.

Then the paper pretends that transmitting a fake PSS would fool LTE devices. Nonsense. Any PSS detection algorithm has plenty of false detection already, and detecting a PSS is nothing until the matching SSS is also detected, with good quality. But then it's not so simple, the jammer don't transmit noise anymore: you have to transmit a true PSS/SSS pair. That won't get you very far, the UE will try this, won't find a matching BCCH and move on. And did I mention that this part is very robust? A UE can detect a cell well below the noise floor. That's required because in a real network with TD-LTE (and even for FD-LTE in the future) all the cells are synchronized and transmit PSS/SSS at (roughly) the same time. So it is expected that PSS/SSS will be interfered, and the device can deal with this. So you really have to transmit at a strong level to mess things.

But in the end, the point is that any public cellular technology is sensitive to jamming, and jamming is dead easy. To protect against this there are well known techniques used in military applications. But guess what? The whole system because way less efficient in capacity and much more complex. And capacity is key.

Optimizing a public system, where capacity is key, for typically non existing threats is just not practical. Everybody should realize this. If you want robustness to jamming use a military grade system, and pay the price.

Move along, nothing really interesting to see.

> powerline + chain idea

The US military got this: http://www.fas.org/man/dod-101/sys/dumb/blu-114.htm. Carbon fiber instead of the chain, but same principle.

If you give 50 engineers the task to come up with ideas for breaking a countries infrastructure on a budget I'm pretty sure 45 of them will go for the electricity plants and will look for the most vulnerable place to cause a dead short in a high voltage circuit. There aren't that many of them, they're our Achilles heel. I'm not at all surprised that the military has taken this idea into their arsenal.

Water and fuel supply lines as well along with transportation infrastructure.

I remember reading somewhere that in Total War scenarios you should poison the water source if you are not able to capture and control it. I think it was Art of War by Sun Tzu.

Can you explain the chain idea? I'm at the airport, and that link is blocked. Maybe this isn't the right time for me to be in this thread.

Basically the idea is to short the two sides of the electrical wires so that you end up breaking the transformers. This means that lots of things at the substation will have to be replaced before it can be put back into action. A few well placed attacks like that and you can easily take out an entire city's power or more.

transformers, generators, motors and power lines have protection relays which sense conditions such as short circuits and isolate the short circuited part of the ... circuit before equipment can be damaged. see http://www.selinc.com

As you say this would cause a power outage, but not necessarily break any equipment as the protection is quite robust and moreso the more critical the facility.

Regarding the power and substation vulnerability to a simple steel chain, the power companies in my area picked up on this around 5 or 6 years ago and have upgraded the security at every power and substation in this area and beyond.

Previously the substations had a small fence around them. There have been work crews working on each station one at a time to completely overhaul the security. They placed a much larger electrified fence around the station, placed most of the transformers into small brick buildings and have a chain link fence covering the entire complex (a fence that is easily collapsed back for emergency access).

You can tell that they spend a lot of money on these security improvements, there are large alarms, big warning signs, they sat the fences a dozen yards or so further back so you can't get closer.

It didn't need a security incident for this power company to figure out that they had a simple vulnerability and to fix it.

That said, there is no equivalent easy improvement that could be made to LTE networks to secure them. The flaw is in the protocols, and fixing it would require a new network stack and new phones, not just a bigger fence.

There is a nice story in Ross Anderson's computer security book about how kids in Soweto discovered that a bike on the substation reset all the electricity meters to zero.

I think the main thrust of the article is that many systems are vulnerable to control channel interruptions. In those scenarios, a jammer can be far less powerful and much harder to detect.

In many cases, the underlying encryption system for communications is particularly vulnerable to disruption. In those cases, individual bit flips caused by intelligent jammers can cause the loss of entire frames.

BTW, the public safety standard for digital radios (P25) is also vulnerable to this sort of attack. IIRC, jamming the digital system often had the side effect of getting users to switch to less-secure (unencrypted) analog modes that were vulnerable to interception.

Indeed. More amusingly though (but still on the control channel), the open p25 group found that you could remotely brick responder radios, without authentication: http://risky.biz/RB178

I think slashdot (of all sites) had a important snippet why this is important news:

> This information comes from research carried out in the U.S. into the possibility of using LTE networks as the basis for a next-generation emergency response communications system.

I can agree that "civilian" systems can except people to behave in a non-destructive way. But a law-enforcement/emergency system should be reasonably resilient (of course not immune, but resilient) against interference. Thus the value of this study is that it exposes that LTE is not suitable for such use.

The current law enforcement/public safety system (P25) is even worse than LTE on many metrics -- it's easy to jam AND fails open/insecure due to both protocol and radio UI/UX problems. Matt Blaze, Perry Metzger, et al. found a bunch of crazy problems with it and have done talks for the past couple years.

Reply on news.ycombinator.com