

A $650 transmitter can disable an entire city’s high speed mobile phone network - donohoe
http://bgr.com/2012/11/15/4g-lte-network-jammer/

======
jacquesm
Breaking will always be easier than making. A 'jammer' is about the easiest
kind of transmitter to make, you don't care about signal quality at all (you
_want_ the worst signal quality).

For an analogue: you can take a length of steel chain to the nearest
powerstation and lob it over the fence. Likely you'll spend a lot less than
$650 and do substantial damage.

That doesn't mean that the powerstation is badly designed, it just means that
we expect people to behave in a non-destructive way and we use the law against
those that can't seem to live by the rules.

Society is a fragile thing, a few hundred dedicated jerks can undo the work of
hundreds of thousands.

Breaking things is dead easy.

edit: credit for the powerline + chain idea in this thread goes to ghshephard,
score one for parallel invention.

~~~
wmf
If you read the paper, the authors discovered ways to make LTE jamming 20 dB
more efficient than brute force; arguably this is a legitimate weakness in
LTE. IIRC other protocols are just as bad, so I am skeptical that these
vulnerabilities are relevant when designing a public safety network.

~~~
jacquesm
In radio transmission there is no substitute for power, both on the jamming
side as well as on the side that wants to get their message through.

20 dB is a big deal because it would make the jammer a lot harder to locate,
especially if it times its interruption well and can get away with extremely
short bursts of activity followed by relatively long periods of silence.

Other tricks of the trade: jam from multiple locations with short bursts, slap
the jammer right under the nose of the receiver that you want to jam (that way
you need a minimal signal and are almost impossible to detect at range until
you're right up to it).

This is the way TV pirates in Amsterdam would broadcast their signals in the
80's to the receiving dishes on Hotel Okura. They were so low power and right
up close to the dishes that they could push legitimate broadcasts (mostly
German TV) right out of their slot. KTA (the then monopolist on Cable TV in
Amsterdam) had the un-enviable task to come up with a solution and finally
settled on a system where if one antenna was flooded with a rogue signal they
would switch to antennae mounted on a chimney of the electricity plant on the
other side of the city (Amsterdam had very little high buildings).

Of course, pirate TV stations found out about this quickly enough and located
another transmitter near there and so on.

I have all this info from hearsay, _cough_.

~~~
CaptainZapp
This is a bit of topic; hopefully not too much so.

A collective of Czech artists spliced a nuclear explosion into a television
signal and made quite a splash.

It was pretty funny (if you like this sort of irony) to see the footage in an
installation in one of Prague's national galleries.

More details here: <http://www.guardian.co.uk/world/2008/jan/04/artnews.art>

> I have all this info from hearsay, cough.

Shucks! I was sure your read about this in a book :)

------
ghshephard
Such behavior is criminal in nature. And the FCC will find you, and they will
crack down on you.

"Federal law prohibits the operation, marketing, or sale of any type of
jamming equipment, including devices that interfere with cellular and Personal
Communication Services (PCS), police radar, Global Positioning Systems (GPS),
and wireless networking services (Wi-Fi)."

47 U.S.C. § 301, § 302a(b), § 333 all make it clear that this activity is
illegal.

Just selling jamming devices will attract the FCC's attention.
[https://www.fcc.gov/document/craigslistorg-users-warned-
remo...](https://www.fcc.gov/document/craigslistorg-users-warned-remove-
postings-illegal-jammers)

Once you've decided to be a criminal, you don't need a $650 device to do a lot
of damage. A $20 container of gasoline, or, heck, a $5 piece of chain link at
the right electrical substation can cause tens of millions of dollars of
damage.

~~~
jacquesm
> a $5 piece of chain link at the right electrical substation

Hah! I see I used the exact same example you did, this is funny because I
swear I had not looked at your text before writing mine. Low tech sabotage is
an interesting subject, and I think it is almost impossible to defend against.

Have an upvote.

A long time ago around a campfire in Colorado this subject came up, how much
damage could you do with $5? Gasoline came up quite a few times, the water
supply and electrical utility were the main targets of opportunity.

My $5 would be spent on a large wrench to undo the foundation nuts of power
line towers.

The next storm would do the actual work and would take down half the grid. I
don't think the power companies are in the habit of checking those nuts to see
if they're still there.

And you wouldn't have to hit all of them either, just a few choice ones.

~~~
Anechoic
_My $5 would be spent on a large wrench to undo the foundation nuts of power
line towers._

You're gonna need a breaker bar for that which will cost you more than $5 (but
not much more... your point stands).

~~~
ars
A wrench large enough to budge a foundation nut costs closer to $100. A $5
wrench with a breaker bar will just snap the wrench.

~~~
jacquesm
A breaker bar is actually a non-ratcheting socket driver. Not something you
fit over a wrench (for that you could use any chunk of pipe). Since a breaker
bar (or actually the torque measuring version of it) is what is usually used
to tighten such nuts I'd imagine it could be used to loosen them as well.

~~~
eric-hu
> Since a breaker bar (or actually the torque measuring version of it)

You're thinking of a torque wrench.

The pipe extension trick won't work for torque values far exceeding the rating
of the breaker bar. I've snapped the head off a breaker bar with a pipe on it.
Generally, I've needed a breaker bar with a 30% higher torque limit than the
torque specs of a bolt/nut in order to loosen said fastener after it's settled
(generally a few days). Change that to about 50% higher once the fastener has
fused to its shaft/bolt/socket (months to years, depending on environment
too).

If you could get a torque wrench for $5 that would torque down power line
tower fasteners to spec, then yes, I'd agree that a $5 breaker bar would do
the job. It should only be stronger than a torque wrench of similar price.

The thing is that the fasteners for power line towers are huge, way bigger
than the fasteners I've encountered working on cars. Fasteners that large
aren't practical to lay down with mechanical tools that amplify human
strength. They'll require pneumatic or hydraulic power equipment.

I still agree with your basic premise that cheap equipment can easily destroy
expensive setups with some creativity. Perhaps a fuel source like thermite or
magnesium would work.

------
JonnieCache
I see the fact that you don't ever hear of people doing this, or chucking
things into substations or off roadbridges and so on, as the ultimate evidence
that international terrorist networks, to a first approximation, do not exist.

If there really were highly organised terrorists everywhere plotting against
us, wreaking substantial havoc across society would be pretty easy for them.
The actual attacks that do occasionally happen are more in line with
politically irrelevant rogue lunatics, placing grandiosity over efficacy.

~~~
akiselev
Havoc != terror.

Terrorists try to create fear and have a major impact on the populace, most
often through bombings and death. Jamming a small (for now) part of our
communications infrastructure could be a major detriment to people functioning
but no one will fear for their lives.

That does not preclude, however, a Gotham city like scenario where an
organization just makes a ton of stuff go wrong all at the same time.

I agree with your first point because if you were to do a cursory glance at
what could efficiently kill us in biology you would see how little effort is
actually required. Anyone with a little knowledge could pull off a devastating
attack using just DMSO and a few toxic compounds.

~~~
NegativeK
Would it not induce terror if Al Qaeda started interfering with vast swaths of
people's daily lives?

Power keeps going out for a few hours, cell phones go down at the same time,
water is shut down because of bacterial contamination.. People wouldn't
directly die, but living in a less stable environment is going to worry
people.

------
mistercow
It's pretty inexpensive to buy a laser you can shoot at a helicopter or
airplane, temporarily blinding the pilot.

With no equipment whatsoever, you can go to your local grocery store and start
opening bottles of cooking oil and dumping them on the floor. Besides costing
the store money in lost inventory and cleanup, you can easily cause hundreds
of thousands of dollars worth of damage in medical costs from people slipping
on the oil.

You can also buy a cheap car for around $700 and use it to start running down
pedestrians.

What all of these have in common is that they are inexpensive and easy to do,
they are virtually impossible to defend against, and they leave the
perpetrator holding the bag. And the bag I'm talking about is huge and
glowing. It has big flashing neon letters on it that alternate "I'M THE HUGE
ASSHOLE YOU'RE LOOKING FOR!" and "COME ARREST ME!"

Look at it that way, and this hardly even seems like news. It's just another
addition to the staggeringly long list of easy ways to disrupt society that
have near 100% odds of landing you in jail.

~~~
anigbrowl
For contrast: <http://en.wikipedia.org/wiki/2007_Boston_bomb_scare> There
nobody was trying to be an asshole (or failed to appreciate how their little
art project would be interpreted), but by putting it near a prominent transit
artery it wound up being significantly disruptive due to the resulting
anxiety.

A key difference from your examples is that they're all localized, and the
effects don't ripple very far. Another is that they're easily explicable -
some violent person vandalizing a store or mowing people down in a car is
frightening but also easily comprehensible. The litebrite bomb scare described
above didn't involve any actual attack, but the confusion led many people to
imagine the worst.

~~~
mistercow
I think that example more than anything demonstrates a completely different
danger to society comprising two related phenomena:

1\. Media sensationalism encouraged by an opportunistic government, engineered
to whip the public into a terrified frenzy, and

2\. Poorly trained and paranoid law enforcement with no sense of perspective.

I don't think it has much relevance to jamming public WiFi, except
peripherally in that news stories like this may do more harm than good.

~~~
anigbrowl
'Never ascribe to malice what can be adequately explained by stupidity.'

~~~
mistercow
I'm confused. Are you saying that the media sensationalism surrounding fear of
terrorism is simply accidental, and that the government has just naively
bought into it and reacted accordingly?

Because if so, no, I don't think that's an adequate explanation. Obviously not
_malice_ , but just greed. The media is greedy and likes to air stories that
sell, even if they are irresponsible. Politicians and government agencies are
greedy for power and know that taking advantage of people's fear of terrorism
is an easy way to grab that power. It's not evil for the sake of evil; it's
evil for the sake of money and political gain.

But it's definitely not mere stupidity.

------
guimarin
I see your transmitter, and I raise you three equally cheap receivers and a
machete.

------
vegardx
But you'll have to start running pretty fast, as it is very easy to pinpoint
the exact location of the sender/jammer. This is also true for any network,
not just LTE. WiFi, GSM, HDSPA, etc. Many military vehicles have jammers like
this to block mobile connectivity in order to prevent IEDs.

~~~
SilasX
Sure, if you're expecting the attack. But most areas aren't expecting such an
attack, so when you do, then as long as they turn it off in time and run away,
the authorities probably won't be able to mobilize in time in take the
measures to find the source.

This would change if it started to become a common occurrence.

------
pdknsk
For anyone who wants to build their own device, albeit with much smaller
radius, adafruit has detailed instructions.

<http://www.ladyada.net/make/wavebubble/>

------
dchichkov
I can see two problems with disabling communications city-wide with such an
approach. First - any cell phone, _not in the line-of-sight with the jammer_
is not going to be disabled. And second - FCC and network ops would locate the
jammer and disable it.

To make this attack successful, one need to put the transmitter sufficiently
high, and make it mobile. Flying it on a conventional airplane wouldn't work,
because air force, FAA and police would be on such high profile case in no
time. Flying it on the UAV RC helicopter could be a solution, but given the
weight of the transmitter, antenna and fuel, that makes the resulting setup
rather heavy and expensive to make and operate - well above 10k. A large
tethered balloon also wouldn't work, because it would be spotted in no time.

All and all, this attack just wouldn't work city-wide.

~~~
dchichkov
And also, a defense from such an overcomplicated hack could be as simple as a
fall-back from 4G to 3G, or even 2.5G.

------
coin
Unrelated but why can't I pinch zoom on bgr.com's site? They must be severing
up a mobile version. I really wish these sites would just serve up the normal
non-mobile version.

------
salimmadjd
Governments are more likely to use something like this. For example to block
an area (protestors) to communicate from outside. Share photos or videos that
might damaging, etc.

------
neurotech1
This is dangerously close to the point where a shiny new EA-18G Growler from
NAS Patuxent River will track down whoever is using such a device. Even though
EA-18 crew probably wont shoot at the rouge transmitter, they can still
pinpoint the exact location. Unlike more typical FCC investigator using a
radio direction finder, the EA-18 is quite fast, both getting there and
searching.

The EA-18 is capable of working around cell towers for locating phones in the
area.

~~~
FireBeyond
"Even though EA-18 crew probably wont shoot at the rouge transmitter"

Better red than dead...?

------
zobzu
So does a wire cutter :-)

