# Security Vulnerabilities in LPWANs--An Attack Vector Analysis for the IoT Ecosystem
## 3 State-of-the-Art Review
### Attacks and Defense Strategies
#### 3.4.5 Wormhole Attack  
A wormhole is an out-of-band connection between two IoT devices, cf. Figure 10, using wired or wireless links. Wormholes can be used to forward packets faster than via typical paths. A wormhole could not be breach security, for example, a wormhole can be used to forward critical messages where high throughput is fundamental, and the rest of the traffic follows the normal path. Although, a wormhole generated by an attacker and combined with other attacks, can lead to a serious security threat [56].  
A classic wormhole attack requires two malicious devices in the network, that is, a sniffer and a jammer. End-devices in LoRaWAN can be jammed by using off-the-shelf hardware [47]. Combining with replay attack, a wormhole attack [83] can be performed against the LoRaWAN network. In this kind of attack, one malicious device captures the packets from one device and sends them to another distantly located device to replay the captured packet. This can easily be initiated by malicious actors without previous knowledge of the network or cryptographic mechanism [43]. The sniffer device captures packets and signals to the jammer device, to notify that it captured the packet. The captured packet never reaches the gateway and the captured message stays valid. The captured message can be replayed at any time. As a result, critical alarm messages can be jammed, and regular messages that were previously captured and never reached the gateway can be sent to the gateway, and be forward to the application layer [80]. Since there is no time-related information in LoRaWAN messages [47], wormhole attacks can become a serious security breach and are very difficult to detect particularly when the wormhole is systematically switched on and off [56].  
**Defense Strategies**: A possible solution is to beat jammer response time. Moving to low SF to beat jammer response time. Reducing SF decreases the airtime of messages, which in turn reduces the time the jammer has to reach. This has several expenses, however: (1) Lower SFs have lower reliability and lower range, and (2) Lower SFs require less power output from the jammer to be disrupted. Drop packet size to beat jammer reaction time. Packet size has a significant impact on message air time. Reducing the size of these messages could permit messages to beat the jammer's reaction time [80].  
A general mechanism, called packet leashes could be used for detecting and defending against wormhole attacks [43]. Any data appended to the packet for limiting its maximum transmission distance is referred to as leash. These are designed to protect single wireless transmissions from wormholes. In this case, if the packets are transmitted over several hops, another new leash is required for each transmission [85]. A leash is any information that is added to a packet designed to limit the packet's maximum permitted transmission  
Figure 10: Wormhole attack example. Image adapted from [84].  
distance. There are two distinguish leashes, namely, geographical and temporal leashes. A geographical leash guarantees that the recipient of the packet is within a certain distance from the sender. A temporal leash guarantees that the packet has an upper bound on its lifetime, which restricts the maximum travel distance since the packet can travel at most at the speed of light. Each type of leash can prevent the wormhole attack since it allows the receiver of a packet to distinguish if the packet traveled further than the leash permits [83].