Vincenz Mechler, M.Sc.

LoRaWAN has become a widely adopted, cost-effective solution for Low-Power Wide-Area Networks (LPWANs), bridging the gap between short-range wireless protocols and high-power cellular networks. Its affordable hardware and robust physical layer make it a key enabler for Internet of Things (IoT) applications across sectors like agriculture, smart cities, and industrial automation-domains where security is of central importance. In this paper, we present BlindSpot, a novel jamming attack that enables efficient selective jamming of LoRaWAN gateways. Unlike traditional approaches that rely on creating high-power interference, BlindSpot exploits the limited number of demodulation paths in LoRaWAN gateways to continuously occupy the gateways with fabricated frames, blinding them for any other legitimate transmissions. Compared to existing approaches, this reduces the attacker's power requirements and allows them to decode the legitimate transmissions with a high probability. Selectively retransmitting these frames, the attacker has precise control over which transmissions can be decoded by the gateway. Using a Software-Defined Radio (SDR)-based LoRa transceiver, we demonstrate the effectiveness of the attack against commercial LoRaWAN gateways and propose detection and mitigation strategies to improve the security of LoRaWAN deployments.

LoRaWAN has become a widely adopted, cost-effective solution for Low-Power Wide-Area Networks (LPWANs), bridging the gap between short-range wireless protocols and high-power cellular networks. Its affordable hardware and robust physical layer make it a key enabler for Internet of Things (IoT) applications across sectors like agriculture, smart cities, and industrial automation-domains where security is of central importance. Investigating LoRaWAN's resilience against physical-layer attacks, we developed BlindSpot, a novel jamming attack targeting state-of-the-art LoRaWAN gateways. Unlike traditional jammers, BlindSpot does not rely on overpowering transmissions but prevents their reception by exhausting resources at the gateway. This is possible since commercial gateway processors have only a limited number of demodulators for parallel frame reception. In this demo, we show the effectiveness of the attack against a commercial LoRaWAN gateway, compare it to traditional jamming, and show how our Software-Defined Radio (SDR)-based receiver can overcome the attack.

LoRa is about to become the standard for Low-Power Wide-Area Networks (LPWANs), being well suited for many Internet of Things (IoT) and sensor network applications. The success of the technology sparked interest to adopt LoRa for other, more challenging use-cases in industrial automation or control of cyber-physical systems. Regular LoRa gateways are, however, limited in their number of parallel demodulation paths and restricted to a single network. To overcome this limitation, we implement a software-defined, multichannel LoRa receiver that is able to receive all common spreading factors and uplink channel combinations of the LoRaWAN EU868 frequency plan. In addition, our receiver does not rely on hard-coded sync words, enabling a mechanism similar to monitor mode in WLAN networks. Experimental evaluation using Software-Defined Radios (SDRs) confirms superior performance compared to commercial LoRa gateways.

Reliable wireless communication is crucial for remote operation of Unmanned Aerial Vehicles (UAVs). Yet, staying in control of the vehicle at all times poses a great challenge, given the dynamics of the wireless channel. Existing technologies are optimized for a given application and, therefore, not well suited for this use case, as they cannot provide both high throughput in high Signal to Noise Ratio (SNR) regimes and high reliability in low SNR regimes. To overcome this limitation, we propose a channel-aware predictive physical layer switching algorithm, utilizing the UAV's telemetry data for implicit synchronization. We evaluate our system experimentally in a fully emulated testbed, achieving an overall outage probability as low as 0.7 % while increasing the average throughput.