# Evaluation of Resource Exhaustion Attacks against Wireless Mobile Devices
## 5 Experimental Results  
On an Android 5.1-based LG Nexus 5 we demonstrated an attack of the forced switching a mobile device to a more energy consuming mode by using its wireless interface. We simulated an attack through a Bluetooth module by Kali Linux tools. We used _Bluteothctl_ to detect the target device and get its details, after that _l2 ping_ was used to sequentially send ping requests. Figure 2 depicts the attack trace. In the experiment, the energy consumption measurements were carried out in a normal device mode and under the attack. In both cases the measurement data were obtained immediately after a complete pre-charging the device during 4 h. Excepting the cellular communication module and Bluetooth the other core ones such as other network elements and the screen were switched off during the experiment. Neither exterior device manipulations nor operating system or any application update were performed. Battery consumption data were obtained programmatically by reading values of _BatteryManager.EXTRA_LEVEL_ variable, presenting the charge level. The energy measurement results with 20 min scale are demonstrated in Figure 3.  
Figure 2: Tracing of vector of ERE attack on the Nexus 5. The attack efficiency was calculated as a ratio of a charge changes under the attack and in a normal mode by the end of the measuring time gap. Although this technique allows explicitly programmatically obtaining attack efficiency, generally it is not precise enough. In particular the fall of the charge level by 1% does not always mean a real reduction of the accumulated energy on certain fixed amount. Alternatively one could use software profilers that allow getting more detailed data on power consumption, however these can be quite energy consuming and result in distortions as a side effect. In addition not all smartphones have built-in current sensors with access to their data through an application programming interface. Thus the hardware based energy measurement when technically possible is seen as the more promising and demonstrated in the next use case. In the experiments we demonstrated a mixed attack on XBee (target end node) operating in energy saving mode scheduled at specific intervals. The attack is simulated by passing requests from a fake XBee (Attacker Node End). On the target XBee, the following power saving parameters were set, namely SM = 4 (cyclic sleep mode), ST = 1000 msec (time before sleep), and SP = 10,000 msec (cyclic sleep period). The attacker accomplishes periodical passing data to the target node (2 per sec.). Such data resets the ST timer, not allowing the node to go back to the sleep mode (i.e., denial-of-sleep attack). The mixed nature of this attack is that, apart from hampering the XBee movement to the sleep mode, some additional energy consumption is fulfilled also as a result of data reception instead of the XBee being in the idle mode (i.e., attack of wireless traffic increasing). Figure 4 discloses the diagram of the test bench simulating such kind of the attack. The object of the attack is Target XBee of an end device role. It operates from an autonomous power source, and is measured by an Allegro ACS712 circuit (Allegro &  
Figure 4: Diagram of the test bed for simulating ERE attack on XBee. Figure 3: Evaluation of the effectiveness of ERE-attack on the Nexus 5. New York, NY, USA) based current sensor. An extra chip implementing end device business logic is connected to the XBee. The sensor readings are taken by a testing microcontroller Arduino Mega 2560 and passed to the PC via the UART interface in the form of logs for subsequent processing and evaluation. The malicious node represents an Arduino Uno R3 linked to an XBee via a Wireless Shield. The Uno firmware contains a sketch regularly sending data to a specified ZigBee destination address.