Battery-Powered Transmitter Could Crash A City's 4G Network 121
DavidGilbert99 writes "With a £400 transmitter, a laptop and a little knowledge you could bring down an entire city's high-speed 4G network. This information comes from research carried out in the U.S. into the possibility of using LTE networks as the basis for a next-generation emergency response communications system. Jeff Reed, director of the wireless research group at Virginia Tech, along with research assistant Marc Lichtman, described the vulnerabilities to the National Telecommunications and Information Administration, which advises the White House on telecom and information policy. 'If LTE technology is to be used for the air interface of the public safety network, then we should consider the types of jamming attacks that could occur five or ten years from now (PDF). It is very possible for radio jamming to accompany a terrorist attack, for the purpose of preventing communications and increasing destruction,' Reed said."
Re:Yes, but think of the Lulz! (Score:4, Informative)
Interestingly, I found and reported a similar vulnerability in the P25 radio system about six years ago.
Nothing's happened. You can jam all the first responder radios in a city with a very small amount of hardware and a copy of the protocol.
This already exists in the wild (Score:5, Funny)
AT+T has apparently been using this for months, in almost every major city
Re:This already exists in the wild (Score:5, Funny)
Thank you for your concern. At at&t(R), our commitment(tm) to rebuilding the nation's largest 4G network this year with your input [slashdot.org] has not wavered. However, our cozy government relationship requires us to install multiple backdoors [wikipedia.org], electronic and otherwise, and our Security budget was beginning to cut into our Invite Government Representatives Into Boardroom For Lobbying And Slash Or Trophywife Swapping budget.
As such, we have decided to retain the mandatory backdoors but leave them open to these minor vulnerabilities. The occasional permanent loss of an antenna, your Facebook account's integrity, or that one guy in Customer Service who decides to blow a whistle on us does not preclude your required payment of the 2012 Nation's Largest 4G Network Improvements Fee, or the upcoming 2013 Nation's Largest 4G Network Improvements Fee (which we hereby announce in this sentence, as double the 2012 version in all cases), even though both would be entirely too small to buy such high-value targets and high-class lays in such high volume.
Thank you again for choosing at&t(R), now with the nation's tallest paperweights. Like us on Facebook [facebook.com], follow us on Twitter [twitter.com], or let us track you to your house through any other method imaginable [att.com].
Invasion! (Score:2, Funny)
Re:Invasion! (Score:4, Funny)
Re:For how long though? (Score:5, Interesting)
Hope in a taxi or bus, drive around, turn off transmitter, walk some way, hope on another bus, turn it on again, turn it off again. Basically keep moving, make the movement sufficiently random, any you won't get caught. OK, a car battery is a bit heavy, but it's not that heavy that you can't carry it around on your lap.
Regarding the "oh noz terrorists", not everything has to be linked to terrorists, isn't it more likely that in the event of a "terrorist" attack, the system would be brought down by people just trying to call the emergency number or friends and family? And anyway, haven't I read about various authorities around the world wanting a switch to turn off the phone networks in the event of a terrorist attack?
So when the "terrorists" do it, it's bad, but when the authorities do it, it's just fine...
Re: (Score:1)
--
posting ac due to mod points
Re: (Score:2)
You could probably also get away with playing little tricks with duty-cycle or directional antennas, especially if "you" consists of more than one transmitter with some overlap in range.
Pure data links, with error correction, retries, and so on, might only be slowed by intermittent jamming; but somebody attempting to run a time-sensitive application(like, oh, a simulation of a classic two-way radio) could have a much harder time of it even if only intermittently jammed...
Tracking down a jamm
Re: (Score:1)
Regarding the "oh noz terrorists", not everything has to be linked to terrorists
It does if you want government funding and fast-track approval through the red tape of laws and other annoying bureaucratic obstacles.
Re: (Score:2)
There are special issue government sim cards and phone numbers that get top priority and skip the cell queue. So even if the tower is "jammed" by people calling, those phones get priority and still get through. So important communication still happens.
But by jamming the tower, none of that works.
Re: (Score:3)
Likewise, for emergency calls from consumer phones: Dialing 911 (or the local equivalent) skips all queues, and will forcibly drop other (non-emergency) calls if it must.
Indeed. And it has been that case for as lo
Re: (Score:2)
And anyway, haven't I read about various authorities around the world wanting a switch to turn off the phone networks in the event of a terrorist attack?
You're right, I saw it on Die Hard. However you don't need any jamming equipment, all you need to do is put on a suit and yell at the nearest linesman.
Re: (Score:1)
Grab a dozen and duct tape them to bus / taxi
Label them 1 to 13 but dont include a 5.
Not for long.. (Score:2)
This has been a game for HAM radio operators for a long time. Look up 'fox hunt'.
Re: (Score:1)
Imagine at 9/11, the terrorists would have put 100 transmitters at different places in New York (to be had for just £40.000, a bit more than $63.000, certainly affordable for a larger terror organization), which started jamming at the time of the attack. How long do you think it takes to find the 100 jamming devices, if you don't have an idea how many there are, and you can't communicate about it? And remember, until every single of them has been found, communications doesn't work.
Re: (Score:2)
If they're broadcasting on a known frequency, then not long.
Radio frequency direction finding equipment is not new, nor is it's use in a military capacity. Ask someone ex-Army who used to have a 98 or 33 as the first two digits of their MOS...(former 33T speaking)
Re: (Score:2)
I'll imagine that LTE freqs won't the the only one being jammed if something actually does happen. Doesn't take much to do jamming effectively, and only broad frequency-hopping stuff is truly immune.
Oh, wait.....
Re: (Score:2)
Re: (Score:2)
Upthread, it was posited that if you brought down LTE, you might bring down public safety response as well. Many units use freq-hopping devices that are somewhat immune to specific (or many) channel jamming. Although there is a bit of this in LTE, the attacks purported are more infrastructure attacks than broad-spectra/channel-specific attacks. The infrastructure melts, metaphorically speaking.
With FSK radios, attacking the radio is useless, unless you attack all of the F(reqs) used by the FSK radios. You c
Re: (Score:2)
Ahh...I understand now...you were criticizing the proposed attack, rather than how to find the transmitters that would be required to carry it out.
You could take out a very complex freq-hopping transmission tower by doing some simple multiplexed transmission with a directional antenna (several per tower, as someone pointed out down thread)...don't have to time-sync if you're not trying to establish communications, just need a strong enough signal.
Re: (Score:2)
Why waste power? There are good defenses. But......
Comment removed (Score:5, Interesting)
Re: (Score:2)
If I were a terrorist intent on disrupting the network, I'd place directional antennas on rooftops and pointed them at the cell towers. They wouldn't have to jam every cell phone, just the cell towers' reception. That should take a lot longer to trace. It would come down to how leaky the jammers' antennae are and how sensitive the detection equipment is.
Even so, the jamming does not have to last long to cause big problems. Just half an hour coordinated with a major event would make it tough on the first
Re: (Score:3)
The base station antennas do not have perfect rejection outside of their main lobe so given proximity or reflections, a single transmitting antenna will be able to hit all of them simultaneously.
Given the type of attack discussed, it may not even be necessary if a resource in common too all of the base station's transceivers can be depleted by accessing only one antenna sector.
Re: (Score:2)
Try that when the jammers include rotating high-gain antennas or randomly variable transmission power. Yes, you can still do it, but if you try to tell me it's an easy task I'll tell you you're lying.
Re: (Score:1)
The 9/11 attackers didn't need to spend a dime to effectively jam communication systems. We did it for them for free.
Communication During the September 11 Attacks [wikipedia.org]
Re: (Score:2)
But also given how the landscape shapes radio transmissions, it would be a good exercise to find one, but for every unit overlapping it would become much more difficult to isolate and locate, and god forbid anyone get creative with it.
Re: (Score:2)
That's not how it works. One jammer takes out one base station, and puts a hole in your network. It doesn't take out the whole network, despite the headline.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Ham radio operators track down interference all the time. We also make a game of it, called foxhunting [kb6nu.com].
Cable companies also hunt down breaks in the cable using similar techniques [comsonics.com].
Once these guys get the attention of the network operator, they'll be found quickly.
Re: (Score:3)
I am not so sure about that. I have a lot of experience in ham radio foxhunting from both the hunting and hiding aspect. For all but the most difficult hunts, the hider has specific limitations which must be followed in aspects like location and timing. Even with those restrictions, on several occasions I and others were able to hide transmitters which, while readily receivable, were all but impossible to find by the vars
Re: (Score:2)
Not far behind 'ya!
Re: (Score:2)
What's the point? (Score:5, Informative)
What's the point here? You can do the same thing with all the proprietary public safety network gear various vendors are peddling - they are mostly hilariously insecure. Or if you have a portable generator, just flood the public safety band with interference. It accomplishes the same thing.
The article claims older 3G and 2G networks would still work if LTE were jammed but that's completely false. There are a ton of ways to jam those by using fake femtocell pilot signals or otherwise interfering with synchronization signals.
In fact the MIMO technology of LTE could make it slightly harder to jam if the base stations are properly filtering stray signals. Use car-mounted MIMO for the user-side and you would get something way better than any of the existing systems at resisting interference.
Re: (Score:2)
What I want to know is whether this will take out 4G, as the first link states, or is limited to LTE, which the rest of the submission talks about.
4G LTE != 4G
Re: (Score:2)
do you see people walking around with wimax phones? of course it's just referring to LTE.
(WiMax isn't 4G either. At least now. Anyhow...)
What's on the streets now is already outdated from a theoretical point of view, and does not preclude vulnerabilities from being found in what isn't on the streets - what will be there in the future matters even more, and is, I would think, even more of interest to researchers and nerds.
And Moscow already has true 4G, several Scandinavian cities are about to get it, and it may come the US too one day. (And I predict Verizon and T-Mobile first, the rest late
Mod parent up. (Score:4, Insightful)
I don't know what the line:
came from but it is 100% false (unless you are talking about a very, very small "city".
This "attack" is just broadcasting noise and messing with communication protocols. So the range is limited to the coverage area of the transmitter. Including dead zones where there is too much concrete and steel for the transmitter to get through.
So you should see the same pattern for blocking as you do for regular access. With a similar requirement for blocking as for coverage.
Re: (Score:2)
> 100% false (unless you are talking about a very, very small "city".
And don't forget antenna location. As a general rule, higher is better. If you're trying to jam an entire city from a car in the street, you'd have to radiate so much power that your alternator would whine and your brain would become ... warm. :)
Be better from the top of tall building, but now you can easily be located and dealt with. Unless you're spiderman and can leap from one building to the next, that is. Or, you don't think anyone
Re: (Score:2)
Note that TFA didn't state what type of batteries this thing needs. 50,000 AA cells should take out most medium sized cities.
Re: (Score:2)
I can take out a base station with a pair of bolt cutters.
I can also re use said bolt cutters to take out other base stations.
Re: (Score:2)
Re: (Score:1)
RTFA, and I am a communications engineer.
The article clearly states that the issue with 4G is that it's extremely sensitive to synchronization of transmitter / receiver. It doesn't require much power to disrupt this. Older networks (2G, 3G) are less prone to this issue, so it becomes less practical to jam and entire city.
Setting up picocells / femtocells can trick phones, but again, people who understand the protocols better than you or myself (the people who did this research) determined that this is les
You can probably bring down WiFi network too (Score:1)
Transmitting some random packets with the WiFi card.
There are many things you can do on the low level link.
Certainly, when in some hotel there is the paywalled internet asking for like $20/day, it is possible to sniff the traffic, find some MAC address that paid, and pretend to be him/her. There is nothing that could be done to prevent such hacks. Not that I recommend doing this. Please don't do this, this is illegal. I am just saying this is possible.
Re: (Score:2)
The level of network knowledge in the general population is pretty low too, so its not like more than a small fraction of guests would even know where to begin. As such, the hotel has very little reason to worry about it, unless it causes a problem for the paying guest. (which I imagine this would? Never played with duplicate MACs on a wifi network)
Overall, I would imagine that, unless you do something that gets their attention (like stopping other guests access from working) they have little incentive to c
Re: (Score:2)
Re: (Score:2)
The level of illegality of MAC spoofing for would, I presume, vary by jurisdiction.
If it is a network where you were supposed to pay for access, then this would probably full under "unauthorized access".
http://en.wikipedia.org/wiki/Legality_of_piggybacking [wikipedia.org]
Re: (Score:2)
The problem is how to do it while keeping things easy for the users. At least the WPA enterprise setups i've seen have looked like a pain to configure on the client end (though that may have just been the unversity being too cheap to pay for certificates) and have the problem that you have no way of giving instructions before the user is connected. VPNs often require considerable setup too. Yes you could distribute a preconfigured VPN client but how many of your guests will want to install your software jus
Re: (Score:2)
Re: (Score:2)
At the uni i'm at they banned the things in dorms, probablly partly for that reason and partly also they didn't want students letting just anyone onto the network.
BTW you can now get switches with port protection features that will protect against rogue DHCP servers like this.
Ham Radio Baby!!! (Score:2)
Re:Ham Radio Baby!!! (Score:4, Informative)
More than two! Latest estimates that I've heard are that there are 600,000+ Hams in the US.
Re:Ham Radio Baby!!! (Score:4, Interesting)
More than two! Latest estimates that I've heard are that there are 600,000+ Hams in the US.
If you follow the news during any one of the big disasters in the past few years, it seems that Hams are the only ones that consistently are organized, prepared, and react immediately.
Traffic lights (Score:2)
Imagine blocking all traffic lights so nobody can see if they are red and green, and see what happens to the traffic.
Actually if I were a bad guy I would turn all lights green instead of disabling them... there'd be a crash at every intersection!
Re: (Score:2)
Traditionally (depends on where you live) turning on the green throws a relay shorting the filament on the opposite green. So if you try two greens at once, it blows the fuse/circuit breaker, because fuses don't like short circuits. This is tricky and your timer needs at least a fraction of a second of dead time where its red all around.
Another fun way to wire it up, is 240v with 120 lamps, hot, to green light, to the red and yellow opposite, and from either red or yellow to neutral. This makes the midni
Re: (Score:2)
Re: (Score:2)
Imagine blocking all traffic lights so nobody can see if they are red and green, and see what happens to the traffic.
Actually if I were a bad guy I would turn all lights green instead of disabling them... there'd be a crash at every intersection!
Where I live, just turning the lights off (or switching to flashing red) works just the same.
Happens every time a storm rolls through. I'd find it funny if I didn't have to share the road with idiots.
Police Box (Score:2)
I guess the only solution to wireless signal jamming is to go back in time and start using Police Boxes [wikipedia.org], again.
Re:Police Box (Score:4, Insightful)
Hardlined police boxes with a wireless AP would make for a vastly more robust network than using the commercial LTE towers.
Sometimes the old ways are best.
Re:Police Box (Score:4, Funny)
But would those police boxes be bigger on the inside?
Re: (Score:2)
Just one. http://tardis.wikia.com/wiki/Laws_of_Time#First_Law_of_Time [wikia.com]
Sprint is impervious to this type of attack (Score:2)
The 4G service they offer isn't really there! Brilliant!
Re: (Score:2)
Huh? Sprint had the first 4G network with WiMax and is currently in the process of rolling out LTE. By the end of 2014 everywhere that currently has Sprint 3G service will have LTE coverage and most towers will have fiber backhauls which is significantly more ambitious than the big 2.
Improperly tuned repeaters (Score:2)
I do IT on yachts and heard a story of a yacht that had cell repeaters on board. The installation company had the power cranked all the way to 11 and knocked an entire coastal town's cell service out while they were in port. Vodafone politely asked them to turn that shit off.
At a wireless training session with one of our vendors they said that the US navy aircraft carriers jam all radio transmissions when they enter port. That sounds like a bit of a frustration.
Re: (Score:3)
Vodafone politely asked them to turn that shit off.
...which wasn't hard to do because all vodafone had to do was call anyone in that town and it rang straight to the yacht...
rooted phones illegal in 5..4.. (Score:1)
Because rather then fix the problem in the system its self, they will just ban the 'small radio transmitter' that is under your control.
Re: (Score:3)
Because rather then fix the problem in the system its self, they will just ban the 'small radio transmitter' that is under your control.
A rooted phone does not translate into access to the baseband processor. :(
Re: (Score:2)
They used one of these https://www.ettus.com/product/details/UB100-KIT [ettus.com]
What about other radio networks? (Score:1)
Can I^Han adversary jam first-responder and other emergency radio networks this easily?
What about the "if all else fails" ham-radio networks? Imagine if the aliens in Independence Day had jammed the entire usable radio spectrum. No more more-code-gets-the-word-out moving ending.
Re: (Score:2)
This is such patent bullshit... (Score:2)
Re: (Score:1)
And why the hell would first responders/emergency workers be using LTE for anything critical, anyway?
Actually, they ARE going to be using LTE for public safety. The next generation public safety network (which may be used for decades) is going to use LTE on the public safety bands. The whole point of this article was to raise awareness and add some jamming mitigation before it gets put into the public safety network.
Re: (Score:3)
Communication is Always a Problem (Score:3)
I hate to say it but 4G for an emergency network is just a money sink. I hate to have a defeatist attitude but at least in my small new england town this would be a complete waste of time and money and effort. We have no unified dispatch system. All land line 911 calls go to police. If you want Fire or Ambulance it's transferred to the Fire department, who then transfers medical calls to the ambulance. If you call from a cell phone it goes to the state police regional office first, then to the local state police barracks, then to town police, etc. Police and fire are on separate frequencies. ICS is a joke and never implemented. EMA is run with all donated equipment and goodwill of Ham operators. Better than nothing? certainly but not by much. I put an IP camera onto their EMA vehicle, punched a hole in their firewall and the chiefs were able to view the scene and control the camera from the EOC. It took me 10 minutes but it was like the natives seeing an airplane. The average Police/fire/EMA chief is 50+ years old and typically holds a grease pencil, not an iPad.
Example, there was a mill fire in the neighboring city. Multiple towns responded. No ICS, no communication plan, everyone on one channel walking all over each other. There is no way any of these communities could implement, monitor or effectively use a 4G solution.
Re: (Score:2)
Presumably 4G emergency networks would not be installed in one-horse towns. Duh.
What 4G network? (Score:1)
it would be more fun (Score:1)
We need alternatives that can't be jammed (Score:2)
I want loud drums in Morse Code!
Not accompany a terrorist attack, be one (Score:2)
You're looking at it all wrong. Terrorists needn't go through the effort of attacking a military might at all. Just take down all communications in a city, and watch the mayhem.
Aside from huge inconvenience, and a whopping expense to resolve the problems, there's so much more. Businesses stop working. Security alarms stop working -- which doesn't matter because the traffic alone will stop any timely response. Here comes the looting, followed closely by the rioting.
It's not the end of the world, and it'
Re: (Score:2)
Re: (Score:2)
It's not the end of the world, and it'll all get resolved in a day or two; but that's a day or two of mayhem, followed by a couple weeks of clean-up. And it all cost $500 to the terrorist -- which can just as easily be a local. Or worse, a local with an imported cellphone, who doesn't know that he's the one causing the mayhem.
Dude, you can't take down an entire city's communication network with a $500 box or a screwed-up handset. You could jam one cell site, at best. Probably only one sector of one cell site, though. On one carrier. Stop spreading this FUD and bullshit.
In the scenario described in TFA, landlines would still work, 2G would still work, 3G would still work, 4G LTE data might be down on one carrier (in the geographic area covered by one sector of one cell site), but the other carriers and every other sector o
Re: (Score:2)
2G, 3G, and landlines won't exist in five years.
This article talks about police radios going to lte.
No one has walkie talkies anymore.
Multiple carriers roam on eachothers' networks, and share cell sites.
One sector of one tower of one carrier is enough to cover an entire office building.
Overlapping towers can quickly become over-saturated in the absense of a single one.
You're correct that it's all FUD. But not because it can't work exactly that way. Only because terrorists are monumentally stupid and can't
One overlord or another, you, personnally, welcome (Score:1)
But government wants to shut off communications anyway to hinder coordination or remotely-detonated bombs.
So cutting off communication increases damage, as does leaving it running?
Shut the hell up! (Score:2)
Its a radio signal (Score:2)
Of course its possible to cause havok.
this is not news (Score:2)
Re: (Score:2)
People are gonna watch their entire lives go by sitting and staring at the palm of their hand!
That sounds pretty retarded, hand's get terrible wifi reception.
Re: (Score:1)
WTF is Orgy other than some band, or a lot of people having some evening fun together?