# LoRaWAN Physical Layer-Based Attacks and Countermeasures, A Review
## 3 Vulnerabilities
### Wormhole Attacks  
The malicious rerouting of wireless packets, i.e., a wormhole attack, is a well-studied topic with its roots in wireless ad hoc networks [63]. In its original form, once a malicious out-of-band route between nodes in a mesh network is established, an attacker can manipulate the routing information and, hence, convince wireless nodes to route traffic towards the malicious link. Wormhole attacks have also been introduced in LoRaWAN networks [12; 13], whereby the attack methods and the goal of the attack differ from those presented for mesh networks. With properly timed jamming and the replaying of LoRaWAN packets, an attacker can manipulate the metadata of LoRa frames (e.g., RSSI, SNR and timing) and, thus, affect the stability of a LoRaWAN network.  
To the best knowledge of authors, the first practical LoRaWAN wormhole attack was introduced in [12]. Since LoRaWAN does apply direct device-to-gateway links instead of multihop communication, a LoRaWAN wormhole necessitates, firstly, a way to block legitimate packets. To this end, a reactive jammer is placed in the network, preferably close to a gateway. The hardware needed to implement the jammer is the same as reported in Section 3.3. A sniffer node is required to trigger the jammer node and to capture LoRaWAN packets to be replayed later on. This node is essentially a LoRa modem configured for continuous reception on a single frequency. As indicated in [12], the sniffer and the jammer nodes should not be located close to each other, so that the sniffer node is able to receive the desired packets. Such settings can, e.g., emulate certain packet losses, as payloads can be selectively jammed and/or replayed. Thus, with even low-cost equipment, an attacker is able to manipulate the quality of service of LoRaWAN networks.  
The wormhole concept was extended in [13], where the authors introduced novel attack concepts based on the methods presented in [12]. One of the architectural differences from the prior work concerned the utilization of an independent reactive-jammer node placed near a gateway. As such, payloads with even the lowest spreading factor can be blocked and replayed later on. With the improved wormhole communication setup, the authors proceeded to discuss the possibility of downlink wormholes. Although applications utilizing LoRaWAN-downlink communication are rare due to channel access restrictions, the uplink wormholes could be detected by missing downlink messages. Thus, by creating a downlink wormhole, as is well-illustrated in Figure 6, an attacker can also target applications where higher data availability is needed. However, as noted by the authors, due to LoRaWAN-reception-window-timing constraints, downlink wormholes can be implemented only for higher data rates and medium-sized payloads within a single payload uplink-downlink transaction. This constraint can be mitigated, given that the downlink message is replayed in a further transaction, which complies with the frame-counter number. Since LoRaWAN wormhole attacks enable manipulation of the metadata (e.g., RSSI or SNR), this feature can be further applied to create DoS and battery-drainage attacks. As an example, given in [13], the ADR mechanism can be manipulated by metadata spoofing. As it turns out, an end device can be forced into spreading-factor and transmission-power settings that cannot be decoded by legitimate packet forwarders.