GoGoBark:Interference Attacks on UWB Ranging
for IEEE 802.15.4z Standard© 2023 GoGoByte - All Rights Reserved

Yuqiao YangZhongjie Wu

Security Researcher ,GoGoByte

Security Engineer, GoGoByte

WHO ARE WE？

"One Can't Defend Without Knowing How To Attack"AttackSecurity ResearchPublications

DefenceCommunitySolutions

Tesla Security Researcher Hall of Fame

Security solutions cover lifecycle of connected vehicles

Share Researches at conferences such as HITB,

Acknowledgement from vendors like Tesla, Huawei, BYD,CanSecWest, Blackhat and DEFCON etc.

GWM, General Motors, Xiaomi, Sany, TruckTech, Hopechart

Publish number of books on security of vehicles IoTetc
Founder of ASRG China，GoGoHack automotive security
research community
DEFCON GROUPs In China(DC010 , DC0571, DC86021 etc.)

products, wireless communication tech© 2023 GoGoByte - All Rights ReservedWHO ARE WE？

"One Can't Defend Without Knowing How To Attack"AttackSecurity ResearchPublications

DefenceCommunitySolutions

Tesla Security Researcher Hall of Fame

Security solutions cover lifecycle of connected vehicles

Share Researches at conferences such as HITB,

Acknowledgement from vendors like Tesla, Huawei, BYD,CanSecWest, Blackhat and DEFCON etc.

GWM, General Motors, Xiaomi, Sany, TruckTech, Hopechart

Publish number of books on security of vehicles IoT

etc
Founder of ASRG China，GoGoHack automotive security
research community
DEFCON GROUPs In China(DC010 , DC0571, DC86021 etc.)

products, wireless communication tech© 2023 GoGoByte - All Rights Reserved

WHAT WE DO？

ThreatTrace®
Cross department collaboration between system design、dev、test、operation teams. Enable
traceability of threats and orchestrate applications, personnel etc.

Secure By Design
DefenseWeaver ®
TARA and security architecture
designCybersecurity goals are exported
by DefenseWeaver to ThreatGo
who controls GoGoBark security
toolset to validate those goals

Comprehensive Test
ThreatGo ® & GoGoBark ®
Security test cases and test
HW/SW tools, test management

Update threat models base on new threats
identified during operation phase, andmitigate the new threats in the following
designs© 2023 GoGoByte - All Rights Reserved

Slow&Inefficient
Security Response

Insecure
Implementation

Design Flaws

Vulnerabilities fromoperation phase are fed
back to test assessment
system to validate & rateimpacts

Agile Operation
ThreatHound ®
Threat intelligence、Vulnerabilityintelligence

CONTENT

1 2 345
Background© 2023 GoGoByte - All Rights Reserved

Principles

DemoMitigations

Q&A

BackgroundUWB Adoption• Audi, BMW, Nio, Zeekr, ...
• NXP, Qorvo, Apple, Bosch, ...
• CCC adoption for Digital Key standard 3.0© 2023 GoGoByte - All Rights Reserved

UWB Adoption© 2023 GoGoByte - All Rights Reserved

UWB Adoption© 2023 GoGoByte - All Rights Reserved

UWB Adoption© 2023 GoGoByte - All Rights Reserved

UWB Adoption© 2023 GoGoByte - All Rights Reserved

Background

Why UWB in car keys?
• Traditional PKES estimate distance using RSSI
• Relay attacks• UWB ranging uses ToF, with sub-nanosecond pulses• Simultaneous measurement and communication• Immunity to narrow-band interference© 2023 GoGoByte - All Rights Reserved

BackgroundAn overview of the changes to the IEEE 802.15.4 standard from 2007 to 2020

© 2023 GoGoByte - All Rights Reserved

Relay attack on traditional PKES

• LF, Bluetooth and NFC are all known to be vulnerable• Cryptography does not help here
• UWB, in theory, is the perfect solution• But, is it really?
© 2023 GoGoByte - All Rights Reserved

Background
The latest IEEE 802.15.4z standard introduces two ranging modes for UWB:
Low Rate Pulse repetition (LRP) & High Rate Pulse repetition (HRP)

LRP: employs fewer but stronger pulses
HRP: uses numerous weaker pulses© 2023 GoGoByte - All Rights Reserved

SecurePotentially vulnerable

Principles

Single-sided two-way ranging(SS-TWR)© 2023 GoGoByte - All Rights Reserved

Double-sided two-way ranging(DS-TWR)

Principles

IEEE 802.15.4z standard package structure• STS sequence is pseudo-random (cryptographic) and negotiated out-of-band• Ranging is done by correlating STS signal with local template• Only the receiver has the STS local template• Cryptography prevents message forgery© 2023 GoGoByte - All Rights Reserved

Background
Acquisition ofsignals

Drop packetno© 2023 GoGoByte - All Rights Reserved

Cross-correlation withlocal templates ofpreamble to computeCIR

Cross-correlation withlocal templates of STSto compute CIR

CIR
exceedsthresholdCIR
exceeds
thresholdyes

yes
Accepting packet for
subsequent operations

no

Drop packet

Background
Acquisition ofsignals

Drop packetno© 2023 GoGoByte - All Rights Reserved

Cross-correlation withlocal templates ofpreamble to computeCIR

Cross-correlation withlocal templates of STS
to compute CIR

CIR
exceeds
threshold

CIR
exceeds
thresholdyes

yes
Accepting packet for
subsequent operations

no

Drop packet

Principles

Attack ideas••••

Malicious SP3 type packet is transmitted during reception
Incorrect preamble and STS
Higher power
Receiver’s estimated CIR will not exceed threshold

Two types of scrambling can occur:
1. Power domain scrambling
2. Time domain scrambling© 2023 GoGoByte - All Rights ReservedPrinciples

HOWEVERUWB signals are mostly transmitted at frequencies above 6 GHz, the time
domain pulses are extremely short and the transmission rate is extremely
high.
Therefore, even if the attacking device sends malicious packets continuously,
there is still a large interval between time domain pulses, thus it is almost
impossible to interfere with the ranging packets.​

So how do we find the right time to attack?

© 2023 GoGoByte - All Rights ReservedPrinciples

UWBAD (UWB Accurate Deafening)

In conjunction with the Double-sided Two-way Ranging (DS-TWR) sequence .

The attack device, GoGoBark, first records the timestamp of receiving message1. Byusing this as a reference and applying appropriate delays, it can estimate the timestampwhen the receiver receives the packet. This is very close to the correct time when theattack packet is sent.

two Attack strategies are designed© 2023 GoGoByte - All Rights ReservedPrinciples·Attack strategy 1
If GoGoBark is configured toattack the Initiator, it should
be close to the initiator andtry to attack message2packets.

Spacial domain

Time domain© 2023 GoGoByte - All Rights ReservedPrinciples·Attack strategie 2
If GoGoBark is configured toattack the responder, itshould be close to theresponder and try to attack
message3 packets.

Spacial domain
Time domain© 2023 GoGoByte - All Rights ReservedPrinciples

Attack device——GoGoBark· We chose Qorvo's DW3210 as the UWB transceiverand integrated power amplifiers in order to make theinterference more stable.
· Integrated UWB signal sniffing and sniping function.
· GoGoBark employs both of the sniping strategies toattempt attacks depending on whether it is near theinitiator or the responder.

© 2023 GoGoByte - All Rights Reserved

DemoREALWORLD
DEMO© 2023 GoGoByte - All Rights Reserved

DISCLAIMER• This is in no way reflective of UWB
applications used in any modernvehicle• This vulnerability in no way reflects
the security posture of anycompany’s product(s)DemoDEMO DESCRIPTION· We used the iPhone 14 and AirTag and used the attack device, GoGoBark, toattack the UWB ranging process.

· The iPhone 14 is equipped with the Apple U1 chip, which supports
the IEEE 802.15.4z High Rate Pulse (HRP) standard, a standard also
used by many car digital keys..

· Once GoGoBark is activated, the UWB-based ranging function of theiPhone fails. The attack has a success rate of 99%.
© 2023 GoGoByte - All Rights Reserved

Demo© 2023 GoGoByte - All Rights Reserved?

Mitigations

UWB ranging is blockedCountering PKES relayattacks via UWB
BUTWhat happens when UWB
ranging is blocked?

© 2023 GoGoByte - All Rights Reserved

PKES requires UWB
to be executed

Real-time ranging
required

PKES can be executedwithout UWB

Real-time ranging
not required
Ranging results notupdated

System freeze

Relay attacks

DoS

Vehicle TheftMitigations
it's not sufficient to only adhere to the IEEE 802.15.4z and CCC (Car ConnectivityConsortium) Digital Key standards. Additional security measures are needed.
We propose the following countermeasures:
1. Identification of high power signals

2. Random delay ranging© 2023 GoGoByte - All Rights Reserved

Mitigations© 2023 GoGoByte - All Rights Reserved

Random delay ranging

Q&A

Contact information
Inquiry number010-64180566，15901535286

Website address
www.gogobyte.com

Company Address
Building 5-1, No. 5, Dongfeng 5th Yard,
Chaoyang District, Beijing

Emailinfo@gogobyte.com（ Business Cooperation ）talent@gogobyte.com（ Resume Submission ）© 2023 GoGoByte - All Rights Reserved

Thanks for listening
Secure Connected Cars From Silicon to Cloud从硅到云 守护智能网联汽车安全© 2023 GoGoByte - All Rights Reserved