In a world where most of our communication occurs through an “invisible” medium, an attack on this infrastructure could be detrimental to individuals, enterprises, and even nations. Knowing how to protect yourself against an “invisible” threat is a daunting challenge, but not impossible. The more we know about how our devices communicate and the continuously evolving vulnerabilities, the better we can protect ourselves and livelihoods from malicious threats.
What are RF-Based Attacks
Wireless, mobile, and Internet of Things (IoT) devices operate within the radio frequency (RF) spectrum, allowing cybercriminals to compromise devices and entire infrastructure easily. Since wireless communications are invisible, malicious devices can roam freely and often go undetected in corporate airspaces. These wireless blind spots, whether they are Bluetooth or Wi-Fi vulnerabilities, make companies and individuals vulnerable to RF-based attacks.
Different Types of Threats
There is no one type of radio-based attack. With the increasing speed of technological innovation comes new vulnerabilities. Many tech and software companies are continuously releasing updates to protect against emerging threats, but relying purely on someone else’s prevention is not necessarily the most bullet-proof plan.
Knowledge is power. The more you know, the more you can do to protect you and your business. Below are four common attacks carried out over the radio frequency spectrum that you should know.
Replay Attack
A replay attack happens when a malicious actor eavesdrops on secure network communication, intercepts it, and then delays or resends the message to misdirect the receiver into doing what the attacker wants. To add to the attack’s danger, a hacker does not need advanced skills to decrypt a message after capturing it. For example, a member of a company requests a financial transfer by sending a message. The attacker would eavesdrop to grab it and replay it later in a way that looks authentic and encrypted, enabling the attacker to trick the victim into sending a large amount of money to them.
Command Injection
Command injection is an attack where the goal is to execute arbitrary commands on the operating system through a vulnerable application. In the case of RF-based attacks, the vulnerable application can be the radio frequency protocols, exposing communications between devices.
E-Stop Abuse
An e-stop abuse attack is self-descriptive. It is the abuse of the emergency stop features most found on industrial machinery such as cranes. Attackers can use either a replay attack or a command injection to transmit the e-stop command packet and prevent the machine from operating.
Reprogramming Attacks
Just like an e-stop abuse attack, an attacker can access the radio frequency communications between controllers and devices and manipulate the device to perform the actions they desire. This reprogramming can be extremely dangerous because it gives the attacker full control of highly complicated, high-risk machines and tools.
Attacks That Actually Happened
It is easy to get caught up in theory. It is easy to think that just because it has never happened to you that it never will. But it may already have, or it may occur in the future. Just because your company does not own heavy machinery does not mean you are immune. Any device that uses radiofrequency such as Bluetooth may be at risk. Below are two examples of RF-based attacks, ranging from obvious to stealthy.
Dallas Emergency Sirens
In April 2017, the sound of 156 emergency sirens blared through the city of Dallas, Texas. They sounded approximately 15 times in the middle of the night, waking residents with a tornado’s fear, yet there was no storm in sight. The sirens were triggered by unknown hackers who manipulated unencrypted radio communication to the sirens.
The year before the siren attack, someone kept hacking into traffic signs in Dallas, changing bland electronic messages into ‘funny’ phrases such as: “Work is canceled Go Back Home” and “Donald Trump is a shapeshifting lizard!!”
The Dallas incident fits with a collection of infrastructure hacks around the country. From electric road signs to suburban dams. The question becomes, “What’s next?” and “How much damage will it cause?” When sirens sounded through Dallas’s city, over 4,000 calls flooded the city’s 911 response line, clearly illustrating the danger that attacks like this one cause.
United States Officials in Cuba
In 2018, American diplomats stationed in Havana, Cuba, came down with unexplained inner-ear damage after hearing high-pitched sounds that caused them to experience dizziness, insomnia, and difficulty concentrating. It is unknown who did it and why it was done. But a team of doctors at the University of Pennsylvania examined many of the patients suffering from the mysterious symptoms and found concussion-like brain injury, despite no blow to the head.
Devices that rely on Bluetooth and are left turned on can be turned into sonic weapons, delivering ear-piercing sounds that lead to hearing loss and other injuries. An attacker can listen or change nearby Bluetooth communication content even between devices that have previously been paired successfully. Any standard-compliant Bluetooth device can be vulnerable. If you are not using your Bluetooth devices, experts suggest to “turn it off.” Every speaker can be transformed into sonic weapons or compromise your privacy.
Protecting Yourself and Your Business from the Invisible
As cyberattacks become increasingly sophisticated, business leaders and security teams need to proactively adopt RF-based solutions into their existing infrastructure to ward off radio frequency attacks. These solutions can locate known and unknown devices to protect business data, personal data, and corporate airspaces from RF threats.
Knowing how to protect and mitigate the invisible threat of RF-based attacks is challenging at best. But finding a partner to help navigate the unseen world of Bluetooth and cloud computing makes all the difference. At Bauen Solutions, our team of experts is on standby to answers your questions, address your concerns, and develop secure solutions to help you build and maintain your competitive edge.
