Rogue routers can launch DoS attacks on your phone's battery

Feb 16, 2016 15:12 GMT  ·  By

Two engineers from Cisco and Google have raised the problem of IPv6 networks that drain smartphone battery life and issued a series of tips for other network admins on why and how to properly configure their networks.

Andrew Yourtchenko (Cisco) and Lorenzo Colitti (Google) have observed that in new IPv6 networks, network admins are often not using proper configurations based on their network's client profile.

If the network's client majority is made up of users employing battery-powered devices like smartwatches, smartphones, tablets, laptops, and IoT devices, then most of these devices are experiencing a shorter battery life, and network admins might be to blame.

Annoying multicast router advertisements are sapping your battery life

The problem is because of Router Advertisements (RAs). These are periodic messages sent by the router to all network clients telling them its IPv6 address, at which it can be reached.

Most of these networks have very small intervals between RAs, something that's an ancient practice from the older days of the Internet, where connectivity uptime was a must, and where most devices were plain ol'd plugged-in fixed desktops.

As more types of Internet-capable devices appeared in the last few years, most of which operate on (small) batteries, engineers have started focusing more and more on how to optimize the battery life of these devices.

The two Cisco and Google researchers discovered that RA messages sent to battery-powered devices usually end up waking the CPU from its sleep, and forcing it to process the request.

While for laptops this is not considered a problem, for smaller devices this can lead to a significant loss of battery life since some networks have been observed sending RAs at intervals as small as 3 to 10 seconds.

The situation is even worse for larger, crowded networks, where RAs are sent every time new users join or leave. In some scenarios you may think your device is standing idle in your pocket, but if you're at the mall, connected to its WiFi network, then the device may actually be busy processing non-stop RAs.

Please network admins, no more than 7 RAs per hour

"At the time of writing, current-generation devices might consume on the order of 5 mA when the main processor is asleep," the researchers explained. "Upon receiving a packet, they might consume on the order of 200 mA for 250 ms, as the packet causes the main processor to wake up, process the RA, attend to other pending tasks, and then go back to sleep. Thus, on such devices, the cost of receiving one RA will be approximately 0.014 [mA/h]."

Their recommendation, currently an RFC for IETF (Internet Engineering Task Force), is for sysadmins to configure their networks in such a way to never send more than 7 RAs per hour. Of course this applies for IPv6 networks where most of the devices are battery-powered.

For data centers and corporate environments this may not be the case, but for admins that assure interconnectivity for sensors, IoT or handheld devices this may help in preventing the useless drainage of battery life.

Additionally, the researchers are also hoping that device manufacturers also chip in, and implement device-side limitations that drop RAs that are sent at too smaller intervals, which could also protect against rogue network that may launch DoS (Denial of Service) attacks aimed at the device's battery.