A Systematic Threat Analysis and Practical Attacks on Automated Frequency Coordination
summary
AFC systems let unauthenticated inputs (GPS, Wi‑Fi positioning, DNS, NTP) control 6 GHz grants and are practically exploitable: an off‑path attacker using a USRP B210 with modified GPS SDRSim and GR‑IT0111 (≈$2,000 kit) spoofs location and time, tested on four commercial APs and five AFC servers, causing wrong allocations, forced 36 dBm transmissions, full denial‑of‑service by spoofing to excluded regions (e.g., Japan) or invalid timestamps, and server resource exhaustion by inflating nearby device density; most APs use plaintext DNS and only one uses secure NTP.
AI-written summary · about
chapters (11)
- 0:00AFC threat analysis intro
- 1:46AFC system overview
- 4:13AFC security requirements
- 5:15AFC attack surfaces
- 6:43AFC location spoofing
- 9:36Tested attacks summary
- 12:24Wi-Fi location spoofing demo
- 13:06Force location update attack
- 14:32AFC server resource exhaustion
- 15:15AFC defense mechanisms
- 15:57Conclusion and future work
related talks
18mExploring Practical Vulnerabilities of Machine Learning-based Wireless Systems
59mWireless security testing with attack
27mWIFI-Important Remote Attack Surface: Threat is Expanding
33mIs Your Timespace Safe? - Time and Position Spoofing Opensourcely
50mAnother Place, Another Time: GPS Threats And Countermeasures
44mManna from Heaven: Improving the State of Wireless Rogue AP Attacks
44m"Attacking industrial remote controllers for fun and profit"
39mHack the Sky: Exploring Satellite Vulnerabilities and Cyber Threats