Leu, Patrick ; Camurati, Giovanni ; Heinrich, Alexander ; Roeschlin, Marc ; Anliker, Claudio ; Hollick, Matthias ; Srdjan, Capkun ; Classen, Jiska (2022)
Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging.
doi: 10.48550/arXiv.2111.05313
Report, Bibliographie
Kurzbeschreibung (Abstract)
We present the first over-the-air attack on IEEE802.15.4z High-Rate Pulse Repetition Frequency (HRP) Ultra-Wide Band (UWB)distance measurement systems. Specifically, we demonstrate a practical distance reduction attack against pairs of Apple U1 chips (embedded in iPhones and AirTags), as well as against U1 chips inter-operating with NXP and Qorvo UWBchips. These chips have been deployed in a wide range of phones and cars to secure car entry and start and are projected for secure contactless payments, home locks, and contact tracing systems. Our attack operates without any knowledge of cryptographic material, results in distance reductions from 12m (actual distance) to 0m (spoofed distance) with attack success probabilities of up to 4%, and requires only an inexpensive (USD 65) off-the-shelf device. Access control can only tolerate sub-second latencies to not inconvenience the user, leaving little margin to perform time-consuming verifications. These distance reductions bring into question the use of UWB HRPinsecurity-critical applications.
| Typ des Eintrags: | Report |
|---|---|
| Erschienen: | 2022 |
| Autor(en): | Leu, Patrick ; Camurati, Giovanni ; Heinrich, Alexander ; Roeschlin, Marc ; Anliker, Claudio ; Hollick, Matthias ; Srdjan, Capkun ; Classen, Jiska |
| Art des Eintrags: | Bibliographie |
| Titel: | Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging |
| Sprache: | Englisch |
| Publikationsjahr: | April 2022 |
| Verlag: | arXiv |
| Reihe: | Computer Science |
| Kollation: | 15 Seiten |
| DOI: | 10.48550/arXiv.2111.05313 |
| Zugehörige Links: | |
| Kurzbeschreibung (Abstract): | We present the first over-the-air attack on IEEE802.15.4z High-Rate Pulse Repetition Frequency (HRP) Ultra-Wide Band (UWB)distance measurement systems. Specifically, we demonstrate a practical distance reduction attack against pairs of Apple U1 chips (embedded in iPhones and AirTags), as well as against U1 chips inter-operating with NXP and Qorvo UWBchips. These chips have been deployed in a wide range of phones and cars to secure car entry and start and are projected for secure contactless payments, home locks, and contact tracing systems. Our attack operates without any knowledge of cryptographic material, results in distance reductions from 12m (actual distance) to 0m (spoofed distance) with attack success probabilities of up to 4%, and requires only an inexpensive (USD 65) off-the-shelf device. Access control can only tolerate sub-second latencies to not inconvenience the user, leaving little margin to perform time-consuming verifications. These distance reductions bring into question the use of UWB HRPinsecurity-critical applications. |
| Zusätzliche Informationen: | 1.Version |
| Fachbereich(e)/-gebiet(e): | 20 Fachbereich Informatik 20 Fachbereich Informatik > Sichere Mobile Netze |
| Hinterlegungsdatum: | 21 Feb 2022 10:52 |
| Letzte Änderung: | 19 Dez 2024 11:00 |
| PPN: | |
| Export: | |
| Suche nach Titel in: | TUfind oder in Google |
 |
Frage zum Eintrag |
Optionen (nur für Redakteure)
 |
Redaktionelle Details anzeigen |
Drucken
Impressum