A $650 transmitter can disable an entire city’s high speed mobile phone network

http://bgr.com/2012/11/15/4g-lte-network-jammer/

by donohoe • 14 years ago

86 63 14 years ago

salimmadjd• 14 years ago

Governments are more likely to use something like this. For example to block an area (protestors) to communicate from outside. Share photos or videos that might damaging, etc.

guimarin• 14 years ago

I see your transmitter, and I raise you three equally cheap receivers and a machete.

vegardx• 14 years ago

But you'll have to start running pretty fast, as it is very easy to pinpoint the exact location of the sender/jammer. This is also true for any network, not just LTE. WiFi, GSM, HDSPA, etc. Many military vehicles have jammers like this to block mobile connectivity in order to prevent IEDs.

SilasX• 14 years ago

Sure, if you're expecting the attack. But most areas aren't expecting such an attack, so when you do, then as long as they turn it off in time and run away, the authorities probably won't be able to mobilize in time in take the measures to find the source.

This would change if it started to become a common occurrence.

ghshephard3• 14 years ago

Such behavior is criminal in nature. And the FCC will find you, and they will crack down on you.

"Federal law prohibits the operation, marketing, or sale of any type of jamming equipment, including devices that interfere with cellular and Personal Communication Services (PCS), police radar, Global Positioning Systems (GPS), and wireless networking services (Wi-Fi)."

47 U.S.C. § 301, § 302a(b), § 333 all make it clear that this activity is illegal.

Just selling jamming devices will attract the FCC's attention. https://www.fcc.gov/document/craigslistorg-users-warned-remo...

Once you've decided to be a criminal, you don't need a $650 device to do a lot of damage. A $20 container of gasoline, or, heck, a $5 piece of chain link at the right electrical substation can cause tens of millions of dollars of damage.

mindstab• 14 years ago

I think you miss the point. Such a critical system should not be so fragile that pretty much anyone can disable it, one would hope.

ghshephard3• 14 years ago

No - I totally get the point. But, if you are going to engage in criminal activity, the bar to your destructive behavior isn't a $650 transmitter. It's a $20 containers of gasoline.

If you want to hurt people, it's pretty much impossible to stop you from doing so (or even slowing you down) - all we can do is catch you, and put you in prison after you do so so that you can't hurt more people.

I'm not suggesting we ignore security (I like SSL, and passwords on my accounts) - but we can't create a world where everyone has to treat the populace as though they are intent on creating destruction. This is the mindset of the TSA and "Search everyone, because any one of them might be carrying a bomb." At a certain point, we have to trust that the vast, vast majority of people are good.

And, in the whole scope of things, jamming an LTE radio transmission system has pretty big penalties, and very little financial payoff, and a pretty good chance of being caught. It's one of those asymmetric criminal activities that is balanced in favor of society, and against the criminal.

Where you want to put your attention in enhancing defenses, is places where there is a strong incentive to commit the crime, and less chance of being caught. Guarding against petty thieves, lots of safeguards/fraud alerts around things like credit cards, or your paypal account. That's where attention needs to be spent.

You know where it's important to spend a lot of money on counter-jamming? Life Safety systems like Nuclear Power Plants, or Plane/Car navigation systems. Where lives are on the line, I totally agree that we need to harden, harden, harden those systems. Also, SCADA systems - that control large amounts of underlying infrastructure. And the Stock Exchange. Spend a fortune on ensuring that the bad guys can't cause havoc, kill people, or create large economic damage.

Perhaps your LTE/Cellular coverage is better than mine, but I'm pretty used to having to track down a WiFi connection to get any serious work done, or make a reliable Skype call. I don't put LTE coverage in the "Mission Critical" category of infrastructure.

Also, if you are in a situation (Prison, battlefield) where the vast majority of your opponents are intent on doing you harm, you also harden the crap out of everything. And pay the price - because you need to.

But, all else equal, I'd rather have the money/resources that might have gone into putting MILSPEC anti-jamming capabilities into my LTE NIC, instead be spent on making it cost less, draw less battery, and give me more bandwidth.

Let the FCC catch the 3-5 jammers at year intent on doing harm, and put them in prison to consider the wisdom of their behavior.

jacquesm9• 14 years ago

> a $5 piece of chain link at the right electrical substation

Hah! I see I used the exact same example you did, this is funny because I swear I had not looked at your text before writing mine. Low tech sabotage is an interesting subject, and I think it is almost impossible to defend against.

Have an upvote.

A long time ago around a campfire in Colorado this subject came up, how much damage could you do with $5? Gasoline came up quite a few times, the water supply and electrical utility were the main targets of opportunity.

My $5 would be spent on a large wrench to undo the foundation nuts of power line towers.

The next storm would do the actual work and would take down half the grid. I don't think the power companies are in the habit of checking those nuts to see if they're still there.

And you wouldn't have to hit all of them either, just a few choice ones.

Anechoic• 14 years ago

My $5 would be spent on a large wrench to undo the foundation nuts of power line towers.

You're gonna need a breaker bar for that which will cost you more than $5 (but not much more... your point stands).

corin_• 14 years ago

> I swear I had not looked at your text before writing mine

I'm asking this out of curiosity, rather than to imply either that it is the case or that if it were the case it would somehow be a bad thing. Is it at all possible that your eye might have caught what he said without actively reading it, and planted a seed in your subconscious?

darkarmani• 14 years ago

This is crazy. Which is easier to get away with? Arson, or a suitcase dropped off somewhere jamming an entire city?

b0o• 14 years ago

While jamming is criminal behavior, the fcc won't be able to find you, in fact, the FCC have yet to even prosecute a single person for cell phone jamming since it's very hard to find and it's very easy hide jammers because people just think they're in a dead zone or their phone is malfunctioning

Theoretically, it is possible to triangulate the jamming signal by pinging cell phones and finding which ones aren't in the dark, mapping it to find the guy but it could take hours and the damage would have already been done.

oh, and sales of jammers have been going on for years on craigslist, I'm surprised they've just shut it down this year.

ja27• 14 years ago

They have found and fined jammers of other services. Ham radio operators deal with this all the time.

http://www.arrl.org/news/fcc-takes-strong-stance-against-rad...

zokier3• 14 years ago

I think if you are doing a terrorist attack then FCC fines probably are least of your concerns.

The authors are obviously not worried about some kids doing a prank with jammers or anything like that. They are worried that criminals would use jammers to execute their crimes.

jacquesm9• 14 years ago

Breaking will always be easier than making. A 'jammer' is about the easiest kind of transmitter to make, you don't care about signal quality at all (you want the worst signal quality).

For an analogue: you can take a length of steel chain to the nearest powerstation and lob it over the fence. Likely you'll spend a lot less than $650 and do substantial damage.

That doesn't mean that the powerstation is badly designed, it just means that we expect people to behave in a non-destructive way and we use the law against those that can't seem to live by the rules.

Society is a fragile thing, a few hundred dedicated jerks can undo the work of hundreds of thousands.

Breaking things is dead easy.

edit: credit for the powerline + chain idea in this thread goes to ghshephard, score one for parallel invention.

Nrsolis• 14 years ago

I think the main thrust of the article is that many systems are vulnerable to control channel interruptions. In those scenarios, a jammer can be far less powerful and much harder to detect.

In many cases, the underlying encryption system for communications is particularly vulnerable to disruption. In those cases, individual bit flips caused by intelligent jammers can cause the loss of entire frames.

BTW, the public safety standard for digital radios (P25) is also vulnerable to this sort of attack. IIRC, jamming the digital system often had the side effect of getting users to switch to less-secure (unencrypted) analog modes that were vulnerable to interception.

xyzzy123• 14 years ago

Indeed. More amusingly though (but still on the control channel), the open p25 group found that you could remotely brick responder radios, without authentication: http://risky.biz/RB178

wmf• 14 years ago

If you read the paper, the authors discovered ways to make LTE jamming 20 dB more efficient than brute force; arguably this is a legitimate weakness in LTE. IIRC other protocols are just as bad, so I am skeptical that these vulnerabilities are relevant when designing a public safety network.

jacquesm9• 14 years ago

In radio transmission there is no substitute for power, both on the jamming side as well as on the side that wants to get their message through.

20 dB is a big deal because it would make the jammer a lot harder to locate, especially if it times its interruption well and can get away with extremely short bursts of activity followed by relatively long periods of silence.

Other tricks of the trade: jam from multiple locations with short bursts, slap the jammer right under the nose of the receiver that you want to jam (that way you need a minimal signal and are almost impossible to detect at range until you're right up to it).

This is the way TV pirates in Amsterdam would broadcast their signals in the 80's to the receiving dishes on Hotel Okura. They were so low power and right up close to the dishes that they could push legitimate broadcasts (mostly German TV) right out of their slot. KTA (the then monopolist on Cable TV in Amsterdam) had the un-enviable task to come up with a solution and finally settled on a system where if one antenna was flooded with a rogue signal they would switch to antennae mounted on a chimney of the electricity plant on the other side of the city (Amsterdam had very little high buildings).

Of course, pirate TV stations found out about this quickly enough and located another transmitter near there and so on.

I have all this info from hearsay, cough.

yaantc• 14 years ago

This paper really looks like sensationalist attention grabbing material, and I'm kind of disappointed to read this in the MIT review without any context or critical analysis.

The synchronization signals in LTE are split in two parts, the PSS (P for Primary) and SSS (S for secondary). Both are using 62 LTE carriers, each one being 15 kHz, so cover 0.93 MHz. For comparison, a 3G channel is 5 MHz and a CDMA channel is 1.25 MHz. 2G is even narrower (memory fails me there...). So not widely different. And not using the whole channel bandwidth in LTE has very nice consequences: the phone doesn't need to know the channel size to synchronize (not the case in WiMAX for example), and the implementation can be lighter and more power efficient.

Then the paper pretends that transmitting a fake PSS would fool LTE devices. Nonsense. Any PSS detection algorithm has plenty of false detection already, and detecting a PSS is nothing until the matching SSS is also detected, with good quality. But then it's not so simple, the jammer don't transmit noise anymore: you have to transmit a true PSS/SSS pair. That won't get you very far, the UE will try this, won't find a matching BCCH and move on. And did I mention that this part is very robust? A UE can detect a cell well below the noise floor. That's required because in a real network with TD-LTE (and even for FD-LTE in the future) all the cells are synchronized and transmit PSS/SSS at (roughly) the same time. So it is expected that PSS/SSS will be interfered, and the device can deal with this. So you really have to transmit at a strong level to mess things.

But in the end, the point is that any public cellular technology is sensitive to jamming, and jamming is dead easy. To protect against this there are well known techniques used in military applications. But guess what? The whole system because way less efficient in capacity and much more complex. And capacity is key.

Optimizing a public system, where capacity is key, for typically non existing threats is just not practical. Everybody should realize this. If you want robustness to jamming use a military grade system, and pay the price.

Move along, nothing really interesting to see.

D_Alex• 14 years ago

> powerline + chain idea

The US military got this: http://www.fas.org/man/dod-101/sys/dumb/blu-114.htm. Carbon fiber instead of the chain, but same principle.

jacquesm9• 14 years ago

If you give 50 engineers the task to come up with ideas for breaking a countries infrastructure on a budget I'm pretty sure 45 of them will go for the electricity plants and will look for the most vulnerable place to cause a dead short in a high voltage circuit. There aren't that many of them, they're our Achilles heel. I'm not at all surprised that the military has taken this idea into their arsenal.

lifeformed• 14 years ago

Can you explain the chain idea? I'm at the airport, and that link is blocked. Maybe this isn't the right time for me to be in this thread.

nikcub• 14 years ago

Regarding the power and substation vulnerability to a simple steel chain, the power companies in my area picked up on this around 5 or 6 years ago and have upgraded the security at every power and substation in this area and beyond.

Previously the substations had a small fence around them. There have been work crews working on each station one at a time to completely overhaul the security. They placed a much larger electrified fence around the station, placed most of the transformers into small brick buildings and have a chain link fence covering the entire complex (a fence that is easily collapsed back for emergency access).

You can tell that they spend a lot of money on these security improvements, there are large alarms, big warning signs, they sat the fences a dozen yards or so further back so you can't get closer.

It didn't need a security incident for this power company to figure out that they had a simple vulnerability and to fix it.

That said, there is no equivalent easy improvement that could be made to LTE networks to secure them. The flaw is in the protocols, and fixing it would require a new network stack and new phones, not just a bigger fence.

justincormack• 14 years ago

There is a nice story in Ross Anderson's computer security book about how kids in Soweto discovered that a bike on the substation reset all the electricity meters to zero.

zokier3• 14 years ago

I think slashdot (of all sites) had a important snippet why this is important news:

> This information comes from research carried out in the U.S. into the possibility of using LTE networks as the basis for a next-generation emergency response communications system.

I can agree that "civilian" systems can except people to behave in a non-destructive way. But a law-enforcement/emergency system should be reasonably resilient (of course not immune, but resilient) against interference. Thus the value of this study is that it exposes that LTE is not suitable for such use.

rdl• 14 years ago

The current law enforcement/public safety system (P25) is even worse than LTE on many metrics -- it's easy to jam AND fails open/insecure due to both protocol and radio UI/UX problems. Matt Blaze, Perry Metzger, et al. found a bunch of crazy problems with it and have done talks for the past couple years.

mistercow3• 14 years ago

It's pretty inexpensive to buy a laser you can shoot at a helicopter or airplane, temporarily blinding the pilot.

With no equipment whatsoever, you can go to your local grocery store and start opening bottles of cooking oil and dumping them on the floor. Besides costing the store money in lost inventory and cleanup, you can easily cause hundreds of thousands of dollars worth of damage in medical costs from people slipping on the oil.

You can also buy a cheap car for around $700 and use it to start running down pedestrians.

What all of these have in common is that they are inexpensive and easy to do, they are virtually impossible to defend against, and they leave the perpetrator holding the bag. And the bag I'm talking about is huge and glowing. It has big flashing neon letters on it that alternate "I'M THE HUGE ASSHOLE YOU'RE LOOKING FOR!" and "COME ARREST ME!"

Look at it that way, and this hardly even seems like news. It's just another addition to the staggeringly long list of easy ways to disrupt society that have near 100% odds of landing you in jail.

anigbrowl4• 14 years ago

For contrast: http://en.wikipedia.org/wiki/2007_Boston_bomb_scare There nobody was trying to be an asshole (or failed to appreciate how their little art project would be interpreted), but by putting it near a prominent transit artery it wound up being significantly disruptive due to the resulting anxiety.

A key difference from your examples is that they're all localized, and the effects don't ripple very far. Another is that they're easily explicable - some violent person vandalizing a store or mowing people down in a car is frightening but also easily comprehensible. The litebrite bomb scare described above didn't involve any actual attack, but the confusion led many people to imagine the worst.

mistercow3• 14 years ago

I think that example more than anything demonstrates a completely different danger to society comprising two related phenomena:

1. Media sensationalism encouraged by an opportunistic government, engineered to whip the public into a terrified frenzy, and

2. Poorly trained and paranoid law enforcement with no sense of perspective.

I don't think it has much relevance to jamming public WiFi, except peripherally in that news stories like this may do more harm than good.

JonnieCache• 14 years ago

I see the fact that you don't ever hear of people doing this, or chucking things into substations or off roadbridges and so on, as the ultimate evidence that international terrorist networks, to a first approximation, do not exist.

If there really were highly organised terrorists everywhere plotting against us, wreaking substantial havoc across society would be pretty easy for them. The actual attacks that do occasionally happen are more in line with politically irrelevant rogue lunatics, placing grandiosity over efficacy.

akiselev• 14 years ago

Havoc != terror.

Terrorists try to create fear and have a major impact on the populace, most often through bombings and death. Jamming a small (for now) part of our communications infrastructure could be a major detriment to people functioning but no one will fear for their lives.

That does not preclude, however, a Gotham city like scenario where an organization just makes a ton of stuff go wrong all at the same time.

I agree with your first point because if you were to do a cursory glance at what could efficiently kill us in biology you would see how little effort is actually required. Anyone with a little knowledge could pull off a devastating attack using just DMSO and a few toxic compounds.

NegativeK• 14 years ago

Would it not induce terror if Al Qaeda started interfering with vast swaths of people's daily lives?

Power keeps going out for a few hours, cell phones go down at the same time, water is shut down because of bacterial contamination.. People wouldn't directly die, but living in a less stable environment is going to worry people.

zobzu• 14 years ago

So does a wire cutter :-)

neurotech1• 14 years ago

This is dangerously close to the point where a shiny new EA-18G Growler from NAS Patuxent River will track down whoever is using such a device. Even though EA-18 crew probably wont shoot at the rouge transmitter, they can still pinpoint the exact location. Unlike more typical FCC investigator using a radio direction finder, the EA-18 is quite fast, both getting there and searching.

The EA-18 is capable of working around cell towers for locating phones in the area.

FireBeyond• 14 years ago

"Even though EA-18 crew probably wont shoot at the rouge transmitter"

Better red than dead...?

coin• 14 years ago

Unrelated but why can't I pinch zoom on bgr.com's site? They must be severing up a mobile version. I really wish these sites would just serve up the normal non-mobile version.

dchichkov2• 14 years ago

I can see two problems with disabling communications city-wide with such an approach. First - any cell phone, not in the line-of-sight with the jammer is not going to be disabled. And second - FCC and network ops would locate the jammer and disable it.

To make this attack successful, one need to put the transmitter sufficiently high, and make it mobile. Flying it on a conventional airplane wouldn't work, because air force, FAA and police would be on such high profile case in no time. Flying it on the UAV RC helicopter could be a solution, but given the weight of the transmitter, antenna and fuel, that makes the resulting setup rather heavy and expensive to make and operate - well above 10k. A large tethered balloon also wouldn't work, because it would be spotted in no time.

All and all, this attack just wouldn't work city-wide.

dchichkov2• 14 years ago

And also, a defense from such an overcomplicated hack could be as simple as a fall-back from 4G to 3G, or even 2.5G.

pdknsk• 14 years ago

For anyone who wants to build their own device, albeit with much smaller radius, adafruit has detailed instructions.

http://www.ladyada.net/make/wavebubble/

A $650 transmitter can disable an entire city’s high speed mobile phone network

Related Stories