Search Mailing List Archives

Limit search to: Subject & Body Subject Author
Sort by: Reverse Sort
Limit to: All This Week Last Week This Month Last Month
Select Date Range     through    

[liberationtech] One Simple Trick Could Disable a City’s 4G Phone Network

Eugen Leitl eugen at
Mon Nov 19 09:39:39 PST 2012

One Simple Trick Could Disable a City’s 4G Phone Network

High-speed LTE networks could be felled by a $650 piece of gear, says a new

By David Talbot on November 14, 2012

Why It Matters

LTE networks can have 10 times the bandwidth of 3G, and are eyed as the basis
for a new wave of data-rich applications worldwide. So any loss of LTE
availability could be highly disruptive.

High-speed wireless data networks are vulnerable to a simple jamming
technique that could block service across much of a city, according to
research findings provided to a federal agency last week.

The high-bandwidth mobile network technology LTE (long-term evolution) is
rapidly spreading around the world. But researchers show that just one cheap,
battery-operated transmitter aimed at tiny portions of the LTE signal could
knock out a large LTE base station serving thousands of people. “Picture a
jammer that fits in a small briefcase that takes out miles of LTE
signals—whether commercial or public safety,” says Jeff Reed, director of the
wireless research group at Virginia Tech.

“This can be relatively easy to do,” and it would not be easy to defend
against, Reed adds. If a hacker added an inexpensive power amplifier to his
malicious rig, he could take down an LTE network in an even larger region.

If LTE networks were to be compromised, existing 3G and 2G networks would
still operate—but those older networks are gradually being phased out.

Reed and a research assistant, Marc Lichtman, described the vulnerabilities
in a filing made last Thursday with the National Telecommunications and
Information Administration, which advises the White House on telecom and
information policy. There was no immediate reaction from the NTIA, which had
sought comments from experts on the feasibility of using LTE for emergency
responder communications.

Any radio frequency can be blocked, or “jammed,” if a transmitter sends a
signal at the same frequency, with enough power. But LTE turns out to be
especially vulnerable, Reed’s group says. That is because the whole LTE
signal depends on control instructions that make up less than 1 percent of
the overall signal.

Some of these instructions govern the crucial time synchronization and
frequency synchronization that underpin LTE transmissions. “Your phone is
constantly syncing with the base station” in order to effectively carry and
assemble bits of information that make up, say, a photo or a video, says
Lichtman, a graduate research assistant who cowrote the study. “If you can
disrupt that synchronization, you will not be able to send or receive data.”

There are seven other such weak points, the researchers say, any one of which
could be used to jam an LTE signal with a low-power transmitter. “There are
multiple weak spots—about eight different attacks are possible. The LTE
signal is very complex, made up of many subsystems, and in each case, if you
take out one subsystem, you take out the entire base station.”

All that would be required is a laptop and an inexpensive software-defined
radio unit (which can cost as little as $650). Battery power, including from
a car battery, would then be enough to jam an LTE base station. Doing so
would require technical knowledge of the complexity of the LTE standard, but
those standards—unlike military ones—are openly published. “Any
communications engineer would be able to figure this stuff out,” Lichtman

Lichtman offered an analogy of stopping all cars, taxis, and trucks from
operating in Manhattan by silencing the traffic signaling system. “Imagine
blocking all traffic lights so nobody can see if they are red and green, and
see what happens to the traffic. Cars hit each other and nobody gets
through,” he says.

All of the latest smartphones and major carriers are heavily promoting a
transition to LTE networks. Around the world, nearly 500 million people have
access to the signals from more than 100 LTE operators in 94 countries. The
technology can be 10 times faster at delivering data, such as video, than 3G
networks. Reed’s group did not identify whether anything could be done to fix
the newly identified problem. “You have to put the problems out on the table
first. Although we’ve identified the problem, we don’t necessarily have
solutions,” he says. “It’s virtually impossible to bring in mitigation
strategies that are also backward-compatible and cover it all.”

But LTE is also being proposed as the basis for next-generation
communications systems for emergency response—a proposal called FirstNet,
conceived after police and fire communications glitches added to the death
toll after the September 11 terrorist attacks. In his brief to the NTIA, Reed
said it was conceivable that terrorists could compromise an LTE network to
confuse the response to an attack.

No jamming of LTE networks is known to have happened as a result of the
vulnerabilities, Reed says. Qualcomm, which sells LTE chipsets and is one of
the companies that developed the LTE standard, declined yesterday to comment
on the matter. Ericsson, the Swedish telecom that supplies much of the
world’s LTE infrastructure, including to Verizon in the United States, did
not respond to requests for comment yesterday.

The impact of any LTE vulnerabilities could be enormous. By Ericsson’s
estimate, half the world’s population will have LTE coverage by 2017. And
many consumer devices—including medical monitors, cameras, and even
vehicles—may adopt LTE technology for a new wave of applications (see
“Verizon Envisions 4G Wireless in Just About Anything”).

Digital cellular communications were engineered to address another security
concern. “Back in the old days, our students used to listen in on cell-phone
conversations for entertainment. It was extremely easy to do. And that was
actually one of the key motivators behind digital cellular systems,” Reed
says. “LTE does a good job of covering those aspects. But unconventional
security aspects, such as preventing signal jamming, have been largely

More information about the liberationtech mailing list