Steve Gibson (147:34)
Yeah. In particular, we propose a novel approach that allows for for environment adaptive spatial control of wireless jamming signals, granting a new degree of freedom to perform jamming attacks. We explore this novel method with extensive experimentation and demonstrate that our approach can disable the wireless communication of one or multiple victim devices while leaving neighboring devices unaffected. Notably, our method extends to challenging scenarios where wireless devices are very close to each other. We demonstrate complete denial of service of a WI FI device, while a second device located at a distance as close as 5 millimeters. Okay, that's 1/5 of an inch. Remains unaffected, sustaining wireless communication at a data rate of 25 Mbps. Lastly, we conclude by proposing potential countermeasures to thwart RIS based spatial domain wireless jamming attacks. Okay, now I have a picture in the show notes from their paper. It shows a grid of antennas. Now, this immediately suggests that They've created a 2D steerable beam jamming transmitter using a phased grid array. Now, that would be an entirely reasonable conclusion. And it would be wrong if that's what these guys had done. It would be a nice piece of work, but by now it could hardly be novel. What is novel here is that this panel leo does not itself transmit anything. It is entirely passive. It is reflective. It is selectively reflective. And what's somewhat astonishing is that something that is essentially a passive reflector of WI fi or whatever radio signals can arrange to selectively target and deny an active WI fi device located some significant distance away. And I'm like 9 meters, like 27ft away in their in their setup from functioning. This is the sort of cool, I mean uber cool next generation cyber spy tech that the NSA and CIA will want to immediately set up in a lab somewhere to fully explore. It is just so cool. So here's what the inventors of this explain. They said Wireless communication systems are ubiquitous and seamlessly provide connectivity to the smart and interconnected devices that permanently surround us. In our modern daily lives, we frequently use instant messaging, media streaming, health monitoring, and home automation, all of which rely on wireless systems and their constant availability. However, wireless systems utilize a broadcast medium, meaning the, you know, the air, the ether, a broadcast medium that is open to everyone, inherently exposing a large attack surface. One particular critical threat is wireless jamming, which allows malicious actors to perform denial of service attacks with minimal effort. In a classical jamming attack, the adversary transmits an interfering signal that overshadows the desired signal, preventing a victim receiver from correctly decoding it. Crucially, loss of connectivity impacts the functionality of wireless devices and can thus have potentially far reaching consequences, such as smart grids, smart transportation, and health care systems. Recent media reports underscore the real world threat potential of jamming attacks. For example criminals disabling smart home security systems and preventing cars from locking. This basic attack principle has previously been studied by a large body of research. For instance, the attacker can leverage various jamming waveforms such as noise or or replayed victim signals, and vary the attack timing. Jamming constantly or only at certain times. As evident from the many existing attack strategies, wireless jamming has been incrementally refined and has become increasingly sophisticated. One particular example for this is the case of selective jamming attacks. To illustrate a potential attack scenario, consider an adversary attempting to sabotage a complex automated manufacturing process. Distributed actuators might take orders from several previous processing stages that have to be executed in a timely fashion, risking manufacturing failure otherwise. Here, the adversary could use selective jamming to simulate local loss of connectivity or on a single actuator, but not the entire plant, which would likely trigger some emergency shutdown response. So far the only means to realize such a selective jamming attack is via so called reactive jamming where the attacker analyzes all wireless traffic in real time to decide on the fly whether to send a jamming signal relying on the existence of meaningful protocol level information not protected by cryptographic primitives. In our manufacturing plant example, selective disruption of the actuator would require the attacker to receive and identify every packet directed to the recipient before sending a jamming signal. This restricts the attacker positioning rather close to the victim. Other downsides of this approach are that it can be mitigated by fully disguising packet destinations and the attack realization being rather complex and cumbersome. In light of those aspects, we are interested in novel attack strategies resolving the aforementioned shortcomings. Clearly, the ideal solution would be to physically inject a proactive jamming signal directly and only into the victim device, but this is not possible due to the wireless nature of jamming and the inevitable broadcast behavior of radio signal propagation to other non target devices. Thus, we aim to answer the following research question. How can we physically target and jam one device while keeping others operational? We solve this challenge by means of a reconfigurable intelligent surface RIS to devise the first selective jamming mechanism based on taming random wireless radio wave propagation effects. Using RIS based environment adaptive wireless channel control allowing to maximize and minimize wireless signals on specific locations, the attacker gains spatial control over their wireless jamming signals. This opens the door to precise jamming signal delivery towards a target device, disrupting any legitimate signal reception while leaving other non target devices untouched. Other than reactive jamming, this is a true physical layer selection mechanism allowing realization independent of protocol level information. In other words, they don't have to decode what's coming going, they just shut it all down. Moreover, the attacker only needs to detect signals from considered devices, removing the need for any real time monitoring and reaction to ongoing transmissions. In this work we experimentally evaluate risk based spatially selective jamming attacks against WI FI communication, showing that it is possible to target one or multiple devices while keeping non target devices operational. To accomplish this, we exploit that considered devices transmit signals, allowing the attacker to passively adapt to to the scene. Apart from the attack's core mechanism, we study crucial real world aspects such as the attack's robustness against environmental factors. We additionally verify the effectiveness of our attack in real world wireless networks where mechanisms that could counteract the attacker at play, for example Adaptive rate control of WI FI networks. We show that risk based Selective jamming even works despite extreme proximity of devices for example 5 millimeters and investigate the underlying physical mechanisms. Finally, we perform comparison experiments with a directional antenna showing the significance of our risk based approach. In summary, our work makes the following key contributions. We propose the first true physical layer selective targeting mechanism for wireless jamming, enabling environment adaptive attacks in the spatial domain. Second, we present an attack realization based on risks using passive eavesdropping to determine an appropriate risk configuration which is the key to deliver jamming signals towards targeted devices while avoiding non target devices. Third, we present a comprehensive experimental evaluation with commodity WI FI devices, environmental changes and an in depth analysis of the physical properties of our jamming attack. Okay, and one last note about these new risk reconfigurable intelligence surfaces. They write An R I S is an engineered surface to digitally control reflections of radio waves. Digitally control reflections. That's all they're doing is reflecting radio waves. Enabling smart radio environments, they said it is worth noting that risses are likely to become pervasive as they hold the potential to complement future wireless networks such as 6G. Here the propagation medium is considered as a degree of freedom to optimize wireless communication by redirecting radio waves in certain directions, for example to improve signal coverage and eliminate dead zones, to enhance energy efficiency and data throughput and building low complexity base stations. They said An RIS does not generate An RIS does not. And this is what's so just it's shocking to me. An RIS does not actively generate its own signals, but passively reflects existing ambient signals. For this it utilizes some number of identical unit cell reflector elements arranged on a planar surface. Importantly, the reflection coefficient of each reflector is separately tunable to shift the reflection phase. Typically an RIS is realized as a printed circuit board with printed microstrip reflectors, enabling very low cost implementation to reduce complexity. Many rises use one one bit control, for example to select between two reflection phases, 0 degrees and 180 degrees corresponding to the reflection coefficients plus 1 and minus 1. This allows the control circuitry to directly interface with digital logic signals from a microcontroller. The technology is still under development, which is why rises are currently not widely used in practice at the time of writing. First implementations are being made commercially available and field trials are being carried out and then after many pages, a very cool detail. And by the way, I've got the link to the whole PDF at the top of this in the show notes for anyone who wants to dig through it. And I know a couple of our radio Experts are going to be curious. Their paper concludes. In this paper, we investigated the merits of the RISS technology for active wireless jamming attacks. In particular, we have shown that the RIS enables precise physical layer attack targeting in the spatial domain, enabling protocol level agnostic selective jamming. For this, the attacker first determines risk configuration by eavesdropping wireless traffic from the victim devices. In other words, it listens using its antenna grid in order to locate in a two dimensional vector the location of the device it wants to block. Then it switches into passive mode and just by bouncing the radio off of itself that it is receiving ambiently in the environment, it's able to shut down that, that WI FI device. They, they said. Then the attacker uses the wrist to reflect the environment's ambient radio signals with the effect of jamming the wireless communication. This is alien technology, jamming the wireless communication of targeted devices while leaving other devices operational. We have demonstrated the effectiveness of the attack under real world conditions with extensive experimentation using commodity WI FI devices. They used pies and things and an open source risk. Notably, we found that it is possible to differentiate between devices that are located only millimeters apart from each other. Overall, our work underscores the threat of wireless jamming attacks and recognizes the adversarial potential of rises to enhance the landscape of wireless physical layer attacks. Wow. Now you know. I know that our listeners enjoy being clued in, even if with only the broad strokes that I've been able to share here. Just knowing that such capability exists is mind blowing. What this means in practice is that very low power undetectable targeted jamming of specific radios is now possible. It's low power because the device is not itself needing to emit any strong overwhelming radio signal. It's merely selectively inverting the reflected phase of what it receives across the elements of its two dimensional surface. And this reflection property is also what makes it undetectable. Again, because it's not emitting any flooding radio signal that any bug detector can detect. Nothing. It's also undetectable because the sum of these reflections can be focused onto the device, the device's exact antenna location, so that even being half an inch away, no jamming effect would be detectable. As I said earlier, I'd be very surprised if researchers at the NSA and CIA didn't already have their sleeves rolled up. Taking a close look at what this means for our on the ground defensive and offensive operations. This is just astonishing technology and it'll.
