Autumn DePoe-Hughes captured on video a rather bizarre scene at Manchester Fort Shopping Park this past summer. If car doors were locked, they could not be unlocked. The reverse was true as well. And, annoying car alarms defied any attempt to silence them. DePoe-Hughes told John Leyden of The Register, “Someone else had complete control over our cars for well over half an hour.”
Leyden asks Ken Munro, a security researcher at Pen Test Partners, what he thought had happened. “This attack is about jamming the radio signal from the key fob to the car,” explains Munro. “Jammers are readily and cheaply available online from overseas sources…. It’s also fairly easy to make a jammer from components available at electronics shops.”
Bad news for IoT devices
IoT devices more often than not require wireless connections to the internet and or other IoT hardware. And, with people becoming ever-more reliant on IoT devices, it sounds like a perfect setup for digital criminals. Many security experts including Ken Westin from Tripwire would agree.
Westin is especially concerned that people and businesses are eliminating hard-wire communications. In Westin’s article Radio Killed the Security of Things: RF Jammers & Crime, he writes, “I hear a lot about people ‘cutting the cord’ stating they are free from their wired line; even more disturbing is the fact they brag about this online via social media. This puts people at significant risk, risk that many are not aware of.”
The risk Westin refers to involves the wireless jamming of cellular frequencies. “If a thief or home invader enables one of these devices from outside your home, your phone will no longer be able to get a signal, and you will not be able to call any emergency numbers for assistance,” explains Westin. “Many of these jammers will also disrupt Wi-Fi, so all communication can easily be disabled inside of a home with the flip of a switch on these devices.”
Industrial and business systems are another risk according to Westin. “These jammers can also disrupt industrial systems, and given enough power can knock out cell reception for a few blocks, so it is conceivable these types of tactics can not only be deployed by criminals but expanded into the arsenal of extremist groups as part of an attack.”
Jammers are illegal — in most places
The general perception is that wireless jammers are illegal, and that is true in most countries. The Federal Communications Commission states, “Unless you are an authorized federal government user, you may not operate a jammer in the U.S., even on private property. This means that it is illegal to use a jammer on mass transit (e.g., train, bus) or in a residence, vehicle, school, theater, restaurant or in any other public or private place.”
As to what happens to those who get caught:
“Violations of the jamming prohibition can lead to substantial monetary penalties (up to $112,500 for any single act), seizure of the illegal jammer, and criminal sanctions including imprisonment.”
Fines are not much of a deterrent
Even with the FCC’s warning, there are numerous websites selling every conceivable type of wireless jammer. “Cell phone jammers can be purchased online, and the sites selling them have ways of shipping them to US residents and other countries, even though they are illegal,” writes Westin. “Using a cell phone jammer can get you a $20K fine or worse. However, if a criminal can buy an unlicensed firearm getting their hands on a cell phone jammer is not difficult.”
Want to build your own jammer? No problem
Bad guys want to stay as anonymous as possible. To that end, they may prefer building wireless jammers. According to Mathy Vanhoef and Frank Piessens, researchers at KU Leuven in Belgium, that is now easier than ever.
In their paper Advanced Wi-Fi Attacks Using Commodity Hardware (PDF), the researchers discuss building various types of wireless jammers using simple Wi-Fi dongles. “As new standards push the boundary of transmission speed and functionality, the capabilities of wireless chips have increased accordingly,” write the authors. “This opens new possibilities where commodity devices can be used to implement state of the art attacks previously thought only possible on expensive hardware such as Universal Software Radio Peripherals.”
Vanhoef talked about their findings at the recent BruCON Security Conference; his session can be seen on YouTube. One of the more interesting discoveries Vanhoef discusses is how he can alter a Wi-Fi dongle’s firmware, and force a targeted network to give priority to the altered Wi-Fi dongle/jammer, which then makes the channel unusable by other devices.
More angst about jammers headed our way
The term “perfect storm” is a cliche, but an apt analogy for the good guy-bad guy collision that is fast approaching. Pushing technology out to where it becomes a vital cog, without regard for any and all dark side issues such as wireless jamming is going to cause a great deal of angst. Noisy car alarms are just the beginning.
