  Multicarrier phase-based ranging is fast emerging as a cost-optimized
solution for a wide variety of proximity-based applications due to its low
power requirement, low hardware complexity and compatibility with existing
standards such as ZigBee and 6LoWPAN. Given potentially critical nature of the
applications in which phase-based ranging can be deployed (e.g., access
control, asset tracking), it is important to evaluate its security guarantees.
Therefore, in this work, we investigate the security of multicarrier
phase-based ranging systems and specifically focus on distance decreasing relay
attacks that have proven detrimental to the security of proximity-based access
control systems (e.g., vehicular passive keyless entry and start systems). We
show that phase-based ranging, as well as its implementations, are vulnerable
to a variety of distance reduction attacks. We describe different attack
realizations and verify their feasibility by simulations and experiments on a
commercial ranging system. Specifically, we successfully reduced the estimated
range to less than 3 m even though the devices were more than 50 m apart. We
discuss possible countermeasures against such attacks and illustrate their
limitations, therefore demonstrating that phase-based ranging cannot be fully
secured against distance decreasing attacks.
