Exploiting LoRaWAN downlinks for covert device-to-device communication

LoRaWAN has become the de-facto standard for low-power, low-data-rate, and long-range IoT communications. Over the years, its security mechanisms have undergone rigorous analysis by both academia and industry, leading to mitigations of known vulnerabilities. While the latest LoRaWan specifications are considered secure, potential attack vectors still exist. In this paper, we consider a scenario where two devices from different networks covertly exchange data without passing through the Network Server. Such communication may be used to signal specific events to an attacker or silently exfiltrate information. We identify a new vulnerability that, if exploited, enables a side-channel covert communication scheme allowing device-to-device data exchange through partial control of the downlink. The communication scheme leverages MAC commands and Spreading Factor selection, allowing a third-party receiver to intercept and decode information despite lacking cryptographic keys. We evaluate the achievable throughput of this scheme and demonstrate that it is comparable to typical LoRaWAN devices operations.