Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging
Abstract
We present the first over-the-air attack on IEEE 802.15.4z High-Rate Pulse Repetition Frequency (HRP) Ultra-Wide Band (UWB) distance measurement systems. Specifically, we demonstrate a practical distance reduction attack against pairs of Apple Ul chips (embedded in iPhones and AirTags), as well as against U1 chips inter-operating with NXP and Qorvo UWB chips. These chips have been deployed in a wide range of phones and cars to secure car entry and start and are projected for secure contactless payments, home locks, and contact tracing systems. Our attack operates without any knowledge of cryptographic material, results in distance reductions from 12 m (actual distance) to 0 m (spoofed distance) with attack success probabilities of up to 4 %, and requires only an inexpensive (USD 65) off-the-shelf device. Access control can only tolerate sub-second latencies to not inconvenience the user, leaving little margin to perform time-consuming verifications. These distance reductions bring into question the use of UWB HRP in security-critical applications.
Research Area: Secure Ranging and Positioning
People
BibTex
@INPROCEEDINGS{leu2022ghost,
isbn = {978-1-939133-31-1},
year = {2022},
booktitle = {Proceedings of the 31st Usenix Security Symposium},
type = {Conference Paper},
author = {Leu, Patrick and Camurati, Giovanni and Heinrich, Alexander and Roeschlin, Marc and Anliker, Claudio and Hollick, Matthias and Capkun, Srdjan and Classen, Jiska},
abstract = {We present the first over-the-air attack on IEEE 802.15.4z High-Rate Pulse Repetition Frequency (HRP) Ultra-Wide Band (UWB) distance measurement systems. Specifically, we demonstrate a practical distance reduction attack against pairs of Apple Ul chips (embedded in iPhones and AirTags), as well as against U1 chips inter-operating with NXP and Qorvo UWB chips. These chips have been deployed in a wide range of phones and cars to secure car entry and start and are projected for secure contactless payments, home locks, and contact tracing systems. Our attack operates without any knowledge of cryptographic material, results in distance reductions from 12 m (actual distance) to 0 m (spoofed distance) with attack success probabilities of up to 4 %, and requires only an inexpensive (USD 65) off-the-shelf device. Access control can only tolerate sub-second latencies to not inconvenience the user, leaving little margin to perform time-consuming verifications. These distance reductions bring into question the use of UWB HRP in security-critical applications.},
language = {en},
address = {Berkeley, CA},
publisher = {USENIX Association},
title = {Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging},
PAGES = {1343 - 1359},
Note = {31st USENIX Security Symposium (USENIX Security 2022); Conference Location: Boston, MA, USA; Conference Date: August 10-12, 2022}
}Research Collection: 20.500.11850/579342