# LoRaWAN Physical Layer-Based Attacks and Countermeasures, A Review
## 3 Vulnerabilities
### Jamming Attacks  
Intentional interference on a wireless physical layer, i.e., jamming, is a well-known DoS attack that has its roots in military communications. Various kinds of jamming attacks have been explored for many wireless protocols [56]. The classical jamming attack involves continuous jamming, where an adversary blocks a wireless channel with a powerful RF signal, which masks legitimate signaling. Recently, more advanced attacks have also been introduced, such as reactive jamming (also known as selective jamming) [56], where an additional listener node is introduced to inform the jammer node on incoming RF payloads. Thus, jamming can be performed against selected devices or signals. As LoRaWAN networks operate on unlicensed bands, e.g., the EU868 band in Europe, other wireless devices sharing the wireless channel might cause unintentional interference. However, the LoRa chirp signaling is designed to be robust against noise and interference. However, an intentional jamming might bring the SNR at the LoRa receiver below a level under which a packet decoding becomes impossible. Hence, studies have been conducted to reveal the impact of (1) packet collisions [57], (2) unintentional RF interference [58; 59], and (3) intentional jamming, with studies considering the impact of jamming on LoRaWAN communication [24; 46; 47] as well as works devoted to proof-of-concept reactive jammer implementations [12; 13; 60]. In [24], the authors considered the effect of reactive jamming with Gaussian noise to LoRa-packet reception. According to the empirical study, signal-to-interference-and-noise (SINR) levels close to and above zero did not have a significant adversarial effect on the reception, which confirms the robustness of the CSS modulation. When the jammer noise power is increased to well above the original signal power, e.g., \(\text{SINR}<-6\) dB, packet reception rate decreases to near zero. Alternatively, utilizing LoRa chirp signals as jamming waveforms increases jamming success, since, firstly, the LoRa packet reception can be locked to the jamming waveform and, secondly, the interference effect during chirp demodulation is potentially higher. To this end, as noted in [24], the frequency and time alignment of the jamming chirp signals is important. For instance, the effect of nonsynchronized LoRa waveform jamming is comparable to the jamming with Gaussian-noise waveforms. On the other hand, if an attacker synchronizes the jammer transmitter to the victim transmitter, the jamming success improves. According to the experimental results, a transmit power of 15 dBm and upwards is adequate for synchronized waveforms to notably degrade packet-reception rate. Next to directly jamming LoRaWAN packets, the authors of [48; 49] have studied a physical layer vulnerability connected to the join procedure and, particularly, to randomness generation on the SX1276 LoRa modem. As it turns out, the entropy for DevNonce generation is collected based on the continuous RSSI sampling feature of the LoRa receiver. By injecting a suitable jamming waveform to the receiver, the output of the randomness generator can be forced into a constant value. If the procedure is continuously repeated, the network server will drop incoming join requests as nonce reuse is not allowed. According to the authors, jamming can be achieved by a high power jamming signal driving the receiver into saturation or, alternatively, by a fixed-power jamming signal, which holds the RSSI at a constant value. Thus, DevNonce-randomness-manipulation attempts lead to a serious DoS attack, which prevents devices from accessing a LoRaWAN network. In terms of the jammer hardware utilized to collect experimental results in LoRaWAN jamming, various configurations have been presented. A common option is to adopt a full-duplex SDR transceiver that, due to full reconfigurability, can be flexibly tuned for many kinds of jamming attacks. One such setup, including GNU Radio software, was utilized in [24] to perform synchronized reactive jamming.