GLaDoS: Location-aware Denial-of-Service of Cellular Networks

Cellular communication is ubiquitous, but must be controlled in sensitive industrial and government areas. Existing cellular jamming systems rely on high-power, wide-band transmissions, which are non-selective and can cause interference in neighboring areas, e.g., blocking emergency calls. Also, meeting both the health limits of radio emissions and installation constraints while achieving effective coverage is highly challenging and sometimes even impossible. Recent work introduced more power-efficient uplink protocol-level DoS attacks, which can effectively neutralize a connection from anywhere in the area covered by a base station. However, these attacks still need to be made selective to block communication only within a defined area and need to be able to detect all connections for all cells in the vicinity. In practice, this detection can be difficult if the cells are far away or under adverse channel effects. In contrast, a phone might be positioned in a strong radio path, allowing it to connect to such a cell. To address the above challenges, we propose GLaDoS, a system that improves existing uplink protocol-level overshadowing approaches and combines them with low-power wideband noise jamming to resolve weak cell issues. GLaDoS further limits DoS to the controlled area by integrating overshadowing with an off-the-shelf localization system. We deployed and evaluated our system in an 62500m 2 area, close to an urban area, where the use of cellular phones is not allowed, but is fully covered by over 100 commercial operator cells. Our deployment made use of 4 protocol-level DoS units, approximately 40 outdoor and 100 indoor low-power jamming units, along with corresponding antennas and front end units. We evaluated our system within this area against different phone models and measured that our system neutralizes 99.3% of all connections, while being able to track over 100 cells simultaneously. This is the first full-scale deployment of an overshadowing-based cellular communication control system. NRU NRU UL Protocol Attack UL Protocol Attack Jammed DL Signal Downlink Jammed Area Figure 1: A high-level overview of our system. Distributed low-power downlink jammers neutralize weaker cells as shown for the base station in the bottom left corner. The two neutralization radio units (NRU) in the corners monitor and attack unwanted connections originating from within the controlled area with an uplink overshadowing protocol attack.