Selective Jamming of LoRaWAN using Commodity Hardware

Abstract

Long range, low power networks are rapidly gaining acceptance in the Internet of Things (IoT) due to their ability to economically support long-range sensing and control applications while providing multi-year battery life. LoRa is a key example of this new class of network and is being deployed at large scale in several countries worldwide. As these networks move out of the lab and into the real world, they expose a large cyber-physical attack surface. Securing these networks is therefore both critical and urgent. This paper highlights security issues in LoRa and LoRaWAN that arise due to the choice of a robust but slow modulation type in the protocol. We exploit these issues to develop a suite of practical attacks based around selective jamming. These attacks are conducted and evaluated using commodity hardware. The paper concludes by suggesting a range of countermeasures that can be used to mitigate the attacks.Comment: Mobiquitous 2017, November 7-10, 2017, Melbourne, VIC, Australi

Authenticated Preambles for Denial of Service Mitigation in LPWANs

“…In what concerns non-LoRa interferers, due to the redundancy associated with wideband spread-spectrum modulation, LoRa is resilient to the interference mechanism that appears as bursty short duration pulses [1]. According to [13] , LoRa can tolerate a non LoRa interferer if this is less than 5dB (19.5dB) above desired signal for SF=7 (12) for the case of an error coding scheme of 4/6. Being wide-band, a narrow band jamming signal would only add noise on a very small portion of this band and the LoRa signal would still be recoverable.…”

“…Phishing opens the door to a wide range of possibilities: traffic capture, network flood, controlling of network parameters and other further possible exploitations. In mesh networks, wormhole attacks are used to create false route information and routing loops that increase the energy consumption of these networks [12].…”

“…Jamming can be a way towards service disrupt [2]. Moreover, in LPWANs, because of the low data rate that leads to a long time on air of the messages, jamming is possible and effective [12].…”

“…In this paper, our attention is focused on the LoRa technology, one of the most used industrial LPWAN technology. Security issues have been analyzed for LoRa networks [12], [19], [11]; Still, the analysis made in the literature explores how these issues impact the traffic performance and the actual data privacy, while in this work we focused on the impact on energy consumption and network lifetime. We analyze the impact of a DoS attack on the network lifetime through real data collection using the Loadsensing sensor nodes developed by Worldsensing [8].…”

I Send, Therefore I Leak

“…The recent works on LPWANs and LoRa have focussed on addressing challenges related to network performance, coverage and scalability [3,10,14,21]. Several vulnerabilities, such as replay attacks [4,33], reactive jamming [5], key extraction [33] and fingerprinting end devices [27] were successfully demonstrated. To the best of our knowledge, the implications of information leakage in LPWANs have so far not been studied.…”