# LoRaWAN Physical Layer-Based Attacks and Countermeasures, A Review
## 3 Vulnerabilities
### Sniffers  
The eavesdropping of wireless communication is one of the most trivial and well-known attacks aiming at wireless protocols including LoRaWAN. The major difference in eavesdropping long-range protocols versus short- to mid-range protocols, is the smaller number of receivers required to acquire communication from a certain area. As indicated by [52], LoRa signaling is robust against fading and interference, which gives an advantage to eavesdropping attempts as well. While the sniffing of LoRa and LoRaWAN payloads is, in its simplest form, possible with a single low-cost LoRa modem, physical-layer sniffers give an attacker a further advantage, as more fine-grained information on communication parameters, e.g., center frequency, becomes available. Below, we feature some of the available tools for signal capture, analysis and decoding that can be applied to LoRaWAN eavesdropping. The state-of-the-art methods to perform physical-layer eavesdropping are mostly based on software defined radio (SDR) hardware and software. As indicated, e.g., by [42], due to narrowband signal characteristics in LoRaWAN, an SDR hardware with moderately low sampling rates, e.g., 1 MSPS, can be utilized for signal capturing. For the subsequent LoRa signal demodulation and decoding stages, a few implementations on the GNU-Radio-SDR-development environment have been presented [53]. In Figure 5, a multichannel LoRaWAN receiver is depicted, which utilizes multiple software-frequency-shifting operations connected to LoRa-receiver blocks in parallel, to extract LoRaWAN payloads. Such a setting allows payload reception on up to 21 channels. As the GNU-Radio-based receivers are open-source, fine-grained information on LoRa waveforms such as carrier frequency offsets, symbol clock periods or received signal strength (RSSI) can be flexibly collected with such receivers. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Reference** & **Attack Category** & **Affects \({}^{\star}\)** & **Technology** & **Experimental Results** \\ \hline
[41] & Sniffers & C & LoRaWAN 1.0x & yes \\
[42] & Sniffers & C & LoRaWAN 1.0x & no \\
[43] & Sniffers & C & LoRaWAN 1.0x & yes \\
[44] & Sniffers & C & LoRaWAN 1.0x & yes \\
[45] & Covert Channels & C,I & LoRaWAN 1.0x & yes \\
[46] & Jamming & A & LoRaWAN 1.0x & yes \\
[47] & Jamming & A & LoRaWAN 1.0x & no \\
[12] & Jamming & A & LoRaWAN 1.0x & yes \\
[13] & Jamming & A & LoRaWAN & yes \\  & & & 1.1/1.0x & yes \\
[48] & Jamming & A & LoRaWAN 1.0x & no \\
[49] & Jamming & A & LoRaWAN 1.0x & yes \\
[50] & Key Extraction & C,I & LoRaWAN 1.0x & yes \\
[51] & Key Extraction & C,I & LoRaWAN 1.03 & yes \\
[37] & Key Extraction & C,I & LoRaWAN 1.0x & no \\
[12] & Worm-Hole & A & LoRaWAN 1.0x & yes \\  & & & LoRaWAN & \\
[13] & Worm-Hole & A & 1.1/1.0x & yes \\  & & & LoRaWAN & \\  & & & 1.1/1.0x & yes \\
[11] & Energy attack & A & 1.1/1.0x & yes \\ \hline \hline \end{tabular} \({}^{\star}\) (C—confidentiality, I—integrity, A—availability).  
\end{table} 
Table 2: Overview of reviewed physical-layer vulnerabilities. One of the earliest applications of SDR-based sniffers involved the reverse engineering of LoRa demodulation and decoding, which are proprietary and, thus, not completely available to the public. As discussed in [41], the custom-built LoRa receiver in a GNU radio enabled the reverse engineering of some critical functions of a real-world LoRa decoder, such as data whitening and interleaving, which did not comply with the original LoRa patent. Thus, one can argue that such obfuscation steps, in hopes to, e.g., protect intellectual property, might be circumvented by SDR hardware and the related signal-analysis software. In further works concerning LoRaWAN security, SDR sniffers play a significant role as a basis technology to implement more advanced attacks. For instance, a man-in-the-middle attack test bench with SDR-based sniffers was presented in [43]. Additionally, an SDR LoRaWAN receiver can be applied as a listening unit within a reactive LoRaWAN jammer [24].