Analog Physical-Layer Relay Attacks with Application to Bluetooth and Phase-Based Ranging
Analog Physical-Layer Relay Attacks with Application to Bluetooth and Phase-Based Ranging
复制标题
应用于蓝牙和基于相位测距的模拟物理层中继攻击
DOI：
--
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
C. Paar
中科院分区：
文献类型：
--
作者：
Paul Staat;K. Jansen;Christian T. Zenger;H. Elders;C. Paar
如今，我们将智能手机用作与其环境通信的多用途设备，以实施情景感知服务，包括资产跟踪、室内定位、联系人跟踪或访问控制。作为事实上的标准，蓝牙几乎可以在每一部智能手机中使用，以提供短距离无线通信。重要的是，许多蓝牙驱动的应用程序，如车辆和建筑物的电话即钥匙(Paak)，都需要接近合法的设备，这些设备必须受到保护，以防止未经授权的访问。在早期的访问控制系统中，攻击者能够通过中继站攻击来违反接近验证。然而，蓝牙对这类攻击的脆弱性尚不清楚，因为现有的中继攻击策略不适用，或者可以通过无线距离测量来击败。在本文中，我们设计并实现了一种基于低成本现成无线电硬件的模拟物理层中继攻击，以同时增加无线通信范围和操纵距离测量。使用我们的设置，我们成功地演示了对汽车(特斯拉Model 3)和智能锁(Nuki Smart Lock 2.0)基于蓝牙的访问控制的中继攻击。此外，我们证明了我们的攻击可以任意操纵多载波相基测距(MCPR)，同时转发超过90m的信号。
Today, we use smartphones as multi-purpose devices that communicate with their environment to implement context-aware services, including asset tracking, indoor localization, contact tracing, or access control. As a de-facto standard, Bluetooth is available in virtually every smartphone to provide short-range wireless communication. Importantly, many Bluetooth-driven applications such as Phone as a Key (PaaK) for vehicles and buildings require proximity of legitimate devices, which must be protected against unauthorized access. In earlier access control systems, attackers were able to violate proximity-verification through relay station attacks. However, the vulnerability of Bluetooth against such attacks was yet unclear as existing relay attack strategies are not applicable or can be defeated through wireless distance measurement. In this paper, we design and implement an analog physical-layer relay attack based on low-cost off-the-shelf radio hardware to simultaneously increase the wireless communication range and manipulate distance measurements. Using our setup, we successfully demonstrate relay attacks against Bluetooth-based access control of a car (Tesla Model 3) and a smart lock (Nuki Smart Lock 2.0). Further, we show that our attack can arbitrarily manipulate Multi-Carrier Phase-based Ranging (MCPR) while relaying signals over 90 m.