Source-linked AI summary
Selective Jamming of LoRaWAN using Commodity Hardware
Emekcan Aras, Nicolas Small, Gowri Sankar Ramachandran, Stéphane Delbruel, Wouter Joosen, Danny Hughes
TL;DR
LoRa’s long airtime and susceptibility to stronger synchronous transmissions leave it exposed to malicious interference despite defenses against accidental collisions. The paper develops and tests practical jamming attacks with commodity hardware, showing LoRa and LoRaWAN susceptibility; the attacks’ timing and power requirements constrain their success.
Problem
LoRa’s long airtime and susceptibility to stronger synchronous LoRa transmissions create an opening for malicious interference that its collision defenses do not eliminate.
Source: §1 · p. 1Method
The paper develops LoRa jamming attacks, including triggered and selective jamming and a two-device approach combining selective jamming with a wormhole attack.
Source: §3.1 · p. 4, §3.3 · p. 5, §8 · p. 10Results
LoRa and LoRaWAN proved susceptible to jamming with low-cost commodity hardware broadcasting normal LoRa messages.
Source: §8 · p. 10Takeaways & Limitations
The attacks rely on coordinating detection and reaction with stronger jamming transmissions, which may be difficult in some cases.
Source: §6.1 · p. 8The attacks require detection and reaction; added wormhole delay prevented jamming lower spreading factors, especially with small packets, even using cabled Ethernet as a best-case link.
Source: §6.1.1 · p. 8
Abstract
from arXiv · showhide
Long range, low power networks are rapidly gaining acceptance in the Internet of Things (IoT) due to their ability to economically support long-range sensing and control applications while providing multi-year battery life. LoRa is a key example of this new class of network and is being deployed at large scale in several countries worldwide. As these networks move out of the lab and into the real world, they expose a large cyber-physical attack surface. Securing these networks is therefore both critical and urgent. This paper highlights security issues in LoRa and LoRaWAN that arise due to the choice of a robust but slow modulation type in the protocol. We exploit these issues to develop a suite of practical attacks based around selective jamming. These attacks are conducted and evaluated using commodity hardware. The paper concludes by suggesting a range of countermeasures that can be used to mitigate the attacks.
1 INTRODUCTION
LoRa fits long-range, low-power IoT applications, but its slow, interference-prone transmissions create an opening for malicious jamming. The paper develops attacks that exploit this opening, including selective jamming and a wormhole attack.
1 INTRODUCTION
- LoRa targets long-range, low-power applications that can tolerate low bit rates, while its chirp modulation is designed to resist channel noise.The paper situates this technology in growing IoT deployments, including safety-critical systems.Source: §1 · p. 1
- Long airtime makes LoRa messages more collision-prone, and stronger synchronous LoRa signals can interfere with them despite the protocol’s collision defenses.The defenses include low transmission rates, channel hopping, and trading data rate for sensitivity.Source: §1 · p. 1
- The paper argues that these defenses leave LoRa networks exposed to malicious interference, which attackers can time to cause collisions.LoRa’s long airtime also permits selective jamming and, in some cases, a wormhole attack.Source: §1 · p. 1
- A wormhole attack can record, jam, and replay messages to prevent alarms while preserving an appearance of normal operation.The paper describes this as a way to temporarily disable specific devices or eliminate selected messages.Source: §1 · p. 2
2 BACKGROUND AND RELATED WORK
The background describes the trade-offs and operating structure of LoRaWAN, then explains how packet fields and signal interference make selective jamming feasible. Prior work on triggered jamming motivates the paper’s extension to message-selective attacks.
2.1 LPWAN
- LPWANs provide long-range, low-data-rate communication with low power use; LoRa also permits private deployments, unlike Sigfox’s provider-dependent model.LoRa and Sigfox are described as leading LPWAN technologies, commonly using a star topology.Source: §2.1 · p. 2
2.2 LoRa
- LoRa’s chirp spread spectrum provides noise robustness, while higher spreading factors increase sensitivity at the cost of slower transmission.The spreading factor also determines time-on-air, data rate, and maximum packet size.Source: §2.2 · pp. 2–3
2.3 LoRaWAN Packets
- LoRaWAN packets include a MAC header, frame header, port, and encrypted application payload; the unencrypted DevAddr in the frame header enables selective jamming.The network-session key signs MAC-layer messages, while the application-session key encrypts application data.Source: §2.3 · p. 3
2.4 Coexistence Issues in LoRa
- Different-SF LoRa packets can coexist at similar power, but same-SF collisions or sufficiently stronger signals can cause the weaker packet to be lost.Figure 4 gives rejection thresholds for combinations of desired and interfering spreading factors.Source: §2.4 · p. 4, Figure 4 · p. 4
2.5 LoRa Jamming
- Prior triggered jamming targets any LoRa message on the monitored frequency; this paper extends it by classifying unencrypted headers to target message types or devices.The classification can guide selective jamming without decrypting the application payload.Source: §2.5 · p. 4
3 LORA JAMMING ATTACKS
LoRa coexistence weaknesses let attackers turn collisions into deliberate interference. The section develops triggered, selective, and combined selective-jamming/wormhole attacks, with the latter using one device to jam while another records and later replays messages.
3.1 Triggered Jamming
- Triggered jamming detects an ongoing LoRa transmission and starts transmitting to jam it, while selective jamming first reads message content and applies a policy.Selective jamming has a shorter remaining jamming window because the policy acts on content following the physical headers.Source: §3.1 · p. 4, §3.2 · p. 5
- 3 of 600 messages (0.5%) reached the gateway with triggered jamming active, demonstrating effective packet loss from timed interference.The authors describe this earlier test as a basis for more sophisticated jamming techniques.Source: §3.1 · p. 4
3.2 Selective Jamming
- Selective jamming targets chosen devices or messages, making it harder to distinguish jamming from another technical problem when other network traffic remains unaffected.Unlike triggered or continuous jamming, it does not affect every device on a frequency.Source: §3.2 · p. 5
3.3 Combining Selective Jamming With A Novel Wormhole Attack
- A sniffer can signal a separate jammer to block a message while continuing to record it for delayed replay, provided no higher sequence number reaches the gateway first.The devices must be separated enough to prevent the jammer from disrupting the sniffer; their link latency makes the timing stricter than selective jamming alone.Source: §3.3 · p. 5
4 IMPLEMENTATION
The implementation uses commodity radio modules and microcontrollers to detect, inspect, and jam LoRaWAN traffic. For the combined attack, a sniffer records messages and signals a separate jammer over a low-latency link.
4 IMPLEMENTATION
- The attacks were implemented and evaluated using inexpensive commodity hardware.The implementation section describes the hardware and software used for the attacks.Source: §4 · p. 5
4.1 Selective Jamming
- Selective jamming detects a packet, receives it, aborts reception when its content matches policy, and immediately jams the channel.The prototype uses an RFM95 radio module with an Arduino-based microcontroller; its FIFO buffer allows software to read incoming message bytes.Source: §4.1 · pp. 5–6
- After five bytes reveal the device address, software applies the jamming policy and switches the radio into jammer mode when the message is selected.The radio returns to receiver mode after jamming.Source: §4.1 · p. 6
4.2 Combined Selective Jamming and Wormhole Attack
- The combined attack separates the sniffer, which detects and records a packet, from the jammer, which waits for its signal before transmitting.The devices communicate over UDP on Ethernet through two Raspberry Pi boards, with GPIO interrupts connecting them to the Arduinos.Source: For the sniffer · p. 6, For the jammer · p. 6
5 EVALUATION
The evaluation tests selective jamming and a two-device wormhole setup against observed traffic sizes. Selective jamming exceeded 98% across spreading factors, while wormhole jamming success varied by spreading factor and packet size, with model predictions least reliable near the threshold.
5.1 Traffic Analysis
- Measured traffic averaged 18.6 bytes in Belgium and 20.3 bytes in Philadelphia, and the experiments used 17-byte packets as their baseline.The Belgium sample comprised 1,383 messages from 86 device addresses over six days; the Philadelphia sample comprised 87 messages recorded over about two hours.Source: §5.1 · p. 7
5.2 Selective Jamming
- Jamming exceeded 98% for every spreading factor in the selective-jamming test, which sent 1,000 messages per device with one target and one control.The devices transmitted on 868 MHz with only the 868.1 MHz channel enabled.Source: §5.2 · p. 7, Table 3 · p. 7
5.3 Combined Selective Jamming and Wormhole Attack
- SF11 and SF12 packets were all jammable, SF7 packets were not, and the model’s predictions diverged from experiments for some SF8–SF10 cases.The model predicted SF8 packet sizes of 47–57 bytes above threshold, but none were jammed; SF9 37-byte packets were not consistently jammed, and SF10 17-byte packets were jammed in 40% of cases despite being predicted below threshold.Source: Table 4 · p. 7, §5.3 · pp. 7–8
- The sniffer-to-jammer reaction time averaged 100.83 ms, with a 1.7 ms standard deviation.The timing was measured across 15 video recordings of the setup.Source: §5.3 · p. 7
- LoRa time-on-air calculations provide only rough jamming-likelihood estimates near the threshold, but are appropriate when predicted gaps exceed 40–50 ms.The authors compare the estimated jamming window after the first five bytes with the measured reaction time.Source: §5.3 · pp. 7–8
6 APPLICABILITY TO REAL-WORLD SCENARIOS
Real-world applicability depends on attack timing, jammer strength, and channel coverage, while each technique suits different targets. Combining selective jamming with a wormhole adds replay capability, but the combined attack operates reliably only on higher-SF communications.
6.1 Attack Limitations
- Long airtime and stronger jammer signals enable the attacks, but added detection and reaction delays constrain selective and wormhole jamming, especially at low SFs and small packet sizes.Experiments used commodity hardware costing approximately 100 euros; dedicated hardware could improve success at lower SFs.Source: §6.1 · p. 8, §6.1.1 · p. 8
6.1.2 Jammer Signal Strength.
- At SF12, jamming was nearly complete around jammer RSSI -40, while some packets leaked through around -60 with the device near -80.The reported jammer-to-source threshold differential is 36 dB.Source: §6.1.2 · p. 8
6.1.3 Channel Hopping.
- The tested single-channel setup would need multi-channel listening in deployment, using gateway-class hardware or multiple chips at moderately higher cost.Regular LoRa devices hop channels between transmissions.Source: §6.1.3 · p. 8
6.2 Potential Targets
- Triggered jamming suits indiscriminate disruption of multiple gateways, but application-level monitoring should detect the disturbance.Source: §6.2 · p. 9
- Selective jamming can suppress messages from chosen devices or cleartext headers, including event-triggered alarms and join messages.The paper describes a medical-fridge deployment as a possible target.Source: §6.2 · p. 9
Combined Selective Jamming & Wormhole Attack.
- Adding replay requires recording normal messages in advance and can make a targeted device appear to operate normally while alerts are intercepted.Source: Combined Selective Jamming & Wormhole… · p. 9
- Pairing a jammer near a closer gateway with the selective-wormhole attack can force a device to join a more distant gateway and move to higher SFs.The higher SFs can enable the combined attack to operate where it is otherwise reliable only on high-SF communications.Source: Combined Selective Jamming & Wormhole… · p. 9
7 MITIGATION TECHNIQUES
The paper proposes low-level LoRa configuration and application-level traffic profiling as ways to recognize or reduce jamming. These approaches trade off jammer complexity, communication reliability, range, and duty-cycle use.
7 MITIGATION TECHNIQUES
- LoRa capabilities can reduce attack effectiveness, while gateway or server traffic profiling can identify message-pattern changes and trigger alarms or adaptations.Source: §7.1 · p. 9, §7.2 · p. 9
7.1 Low-Level Techniques
- Overlapping gateway coverage and channel hopping complicate jamming by requiring attackers to map gateways and monitor more channels.The multi-channel requirement can push attackers from low-cost LoRa hardware toward more expensive gateway-class receivers.Source: §7.1 · p. 9
- Lower SFs and smaller packets shorten the wormhole jammer's reaction window, but lower SFs also reduce range and reliability and require less jammer power to disrupt.Higher SFs require larger jammer-to-target power differentials, but repeated transmissions can quickly exhaust duty-cycle allowances.Source: §7.1 · p. 9
7.2 Application-Level Techniques
- Traffic analysis can detect deviations from known or profiled transmission rates, and continuous monitoring of end-devices is described as essential to prevention.When rates are unknown, the normal traffic baseline must be established over time or from past profiling.Source: §7.2 · pp. 9–10
8 CONCLUSION
The paper reports that low-cost commodity hardware can jam LoRa and LoRaWAN using normal LoRa messages, including selectively and through a wormhole-and-replay setup. It also discusses practical limitations and mitigation techniques, while leaving mitigation evaluation and newer-device tests for future work.
8 CONCLUSION
- Real-testbed evaluations showed that low-cost commodity hardware broadcasting normal LoRa messages can jam LoRa and LoRaWAN traffic.Source: §8 · p. 10
- Long message airtime enables detection and emission of a jamming message before the original transmission ends, supporting selective jamming and wormhole-and-replay attacks.Source: §8 · p. 10
- Future work will assess mitigation strategies and attacks on LoRa device classes B and C, and explore cryptographic channel hopping.Source: §8 · p. 10