  Due to its suitability for wireless ranging, Ultra-Wide Band (UWB) has gained
traction over the past years. UWB chips have been integrated into consumer
electronics and considered for security-relevant use cases, such as access
control or contactless payments. However, several publications in the recent
past have shown that it is difficult to protect the integrity of instance
measurements on the physical layer. In this paper, we identify transceiver
clock imperfections as a new, important parameter that has been widely ignored
so far. We present Mix-Down and Stretch-and-Advance, two novel attacks against
the current (IEEE 802.15.4z) and the upcoming (IEEE 802.15.4ab) UWB standard,
respectively. We demonstrate Mix-Down on commercial chips and achieve distance
reduction from 10 m to 0 m. For the Stretch-and-Advance attack, we show
analytically that the current proposal of IEEE 802.15.4ab allows reductions of
over 90 m. In order to prevent the attack, we propose and analyze an effective
countermeasure.
