UWBAD: Towards Effective and Imperceptible Jamming Attacks Against UWB Ranging Systems with COTS Chips

TL;DR

This paper introduces UWBAD, a practical and effective jamming attack against commercial UWB ranging systems that exploits their vulnerabilities, demonstrating real-world impacts on major vendors and prompting security responses.

Contribution

The paper presents UWBAD, a novel, affordable, and imperceptible jamming method targeting commercial UWB systems, revealing critical vulnerabilities and demonstrating real attack scenarios.

Findings

Successfully attacked UWB systems from Apple, NXP, and Qorvo.

Triggered security responses from major automotive and tech companies.

Confirmed vulnerability in automotive UWB systems leading to security rewards.

Abstract

UWB ranging systems have been adopted in many critical and security sensitive applications due to its precise positioning and secure ranging capabilities. We present a practical jamming attack, namely UWBAD, against commercial UWB ranging systems, which exploits the vulnerability of the adoption of the normalized cross-correlation process in UWB ranging and can selectively and quickly block ranging sessions without prior knowledge of the configurations of the victim devices, potentially leading to severe consequences such as property loss, unauthorized access, or vehicle theft. UWBAD achieves more effective and less imperceptible jamming due to: (i) it efficiently blocks every ranging session by leveraging the field-level jamming, thereby exerting a tangible impact on commercial UWB ranging systems, and (ii) the compact, reactive, and selective system design based on COTS UWB chips, making it affordable and less imperceptible. We successfully conducted real attacks against commercial UWB ranging systems from the three largest UWB chip vendors on the market, e.g., Apple, NXP, and Qorvo. We reported our findings to Apple, related Original Equipment Manufacturers (OEM), and the Automotive Security Research Group, triggering internal security incident response procedures at Volkswagen, Audi, Bosch, and NXP. As of the writing of this paper, the related OEM has acknowledged this vulnerability in their automotive systems and has offered a $5,000 reward as a bounty.