# Security Vulnerabilities in LPWANs--An Attack Vector Analysis for the IoT Ecosystem
## 3 State-of-the-Art Review
### Attacks and Defense Strategies
#### 3.4.3 Jamming Attack  
The jamming attack is one of the most serious problems for IoT security [76]. The communication bandwidth is small (100 Hz for Sigfox, 125/250/500 kHz for LoRaWAN, 180 kHz for NB-IoT) and relies on low-power for data transmission [64]. The jammer does not need complex hardware as long as it transmits the jamming signal with enough power. Malicious entities can transmit powerful radio signals near the application devices and interrupt the radio communications, cf. Figure 8, because LoRa transmissions at the same frequency and spreading factor can interfere with each other [48]. This is possible by using commercial-off-the-self LoRa hardware [47]. A low-cost microcontroller-based platform equipped with a LoRa radio module can be used to perform jamming attacks. An attacker with malicious intentions can flood LoRa messages at a certain frequency to clean out all the transmissions in that frequency. According to [47], about 99% of LoRa transmissions are damaged by this jamming technique. Typically, this approach uses low-cost devices (Arduino Leonardo [77] board and a Semtech LoRa radio module [78] breakout board) with a total cost of around 30 euro. Jamming attacks could be pointed to different layers of the OSI model: (1) Physical layer jamming, where the malicious actor assign any wideband signal with a higher Signal-to-Noise Ratio (SNR) than the user; (2) MAC layer jamming, where the malicious actor just jams explicit pieces of the message (e.g., message signatures), guaranteeing that the packet is disposed of by the recipient [64]. Figure 8: Example of jamming attack. Adapted from [79]. **Defense Strategies**: Defending against jamming attacks is hard because this type of attack is always possible. Initially, the jamming of the entire network or frequency can be easily detected since all the devices that communicate in that frequency would abruptly start to drop out from the network. By recognizing such behavior, network administrators can take appropriate actions to prevent the impact of such attack [43]. Jamming detection mechanisms can also be useful, for example, changing the used frequency channels [64]. Some low-level techniques [80] that should be used are:  
* Create dense LoRa networks with overlapping coverage regions. By deploying LoRaWAN end-devices within the range of different gateways, increases the reliability of LoRa communication. This feature is critical in beating jamming attacks, as to ensure that a message is jammed, the jammer should guarantee it is heard at no gateway in the network. Since the jammer requires high Received Signal Strength Indicator (RSSI) compared with the end-device, the jammer is more effective when it is near the gateway. Subsequently, the jamming is more complex within the presence of various gateways [64], as the attacker must map the gateways in range of each target end-device to successfully jam the transmissions. * Maximize the utilization of channel hopping. LoRa devices hop between multiple channels when sending messages as dictated by LoRaWAN specification, to reduce the opportunity of collisions. The more channels utilized, the more complex the jammer must be, as it needs to listen on all of those channels. This forces a move from basic low-cost LoRa hardware to more expensive multi-channel LoRa receivers as found in gateways. * Move to a higher Spreading Factor (i.e., SF12) to beat the jammer RSSI. The higher Spreading Factors (SFs) require higher dB differentials between the jammer and target message. However higher spreading factor transmissions afford more time for the jammer to act and requires the jammer to be closer to the gateway. Note that numerous transmissions in higher SF rapidly exhaust the duty cycle allowance. By performing traffic analysis and profiling (at the gateway or server level), it is possible to distinguish varieties in the pattern of incoming messages demonstrating the presence of a jammer and to trigger alerts or adaptations to the network.