WRAITH · Waveform Replay Attack Imitating Transmitted Hardware
Physical-layer hardware fingerprinting is being sold and fielded as device authentication on shared control buses. It cannot do that job. On a shared medium the attacker and the defender observe the identical signal, so the defense reduces to a recording played back. We prove it on MIL-STD-1553, the hardest and most-defended case, with commodity hardware.
50+ accepted replays was where we stopped, not a limit. Once the point was proven, more replays only repeat it.
01 / The Doctrine
Legacy control buses (automotive CAN, avionics MIL-STD-1553, ARINC 429) were designed for determinism, not for a threat model. They carry no authentication. The proposed retrofit is seductive: identify each transmitter by the analog voltage signature that manufacturing variation stamps on its signals. No protocol change, no rewiring: just a classifier watching the wire.
And the reported numbers are strong enough to drive procurement. So the doctrine spread from papers into products marketed as an intrusion-detection layer for military and automotive buses. The common promise: a device cannot be impersonated, because its analog identity cannot be reproduced.
device classification accuracy on real helicopter avionics Evcil et al., 2024 · MIL-STD-1553
per-device accuracy in a fielded defense-in-depth system Levy et al. (ANoMili), 2022 · MIL-STD-1553
single-frame recognition, marketed into automotive Yang et al., 2026 (CAN-FD) · Cho, Kneib, Choi (CAN)
shipping as commercial silicon today e.g. Sital Technology BRM1553D-SnS
Every one of those accuracies is real. Every one was measured under the wrong threat model: foreign hardware carries a foreign fingerprint. Nobody measured the adversary who simply records the legitimate signal.
02 / The Structural Flaw
The premise treats manufacturing variation as if it were a secret. On a shared medium, it is public information, retransmitted on every message.
Proposition 1: Measurement Symmetry
Let F be any feature a defender computes from voltage samples V captured at rate fs and resolution b. An adversary with b′ ≥ b and f′s ≥ fs records V′ with |F(V) − F(V′)| ≤ ε, where ε is bounded by the two converters' quantization. Any classifier that accepts F(V) within tolerance δ > ε must also accept F(V′).
No choice of feature escapes it. Raw samples, rise/fall times, ringing, and spectral shape are all functions of the same voltage trace, and a faithful copy carries every one of them at once. The adversary does not model the fingerprint. It re-emits the exact signal that produced it. This is why the operative attack is replay, not imitation.
Channel variability (multipath, fading) is the only partial defense against physical-layer replay. An impedance-controlled, transformer-coupled 1553 bus has essentially none of it. The doctrine is weakest exactly where it is deployed most confidently.
A 14-bit converter resolves the waveform to ~0.6 mV; an 8-bit defender scope has a ~39 mV noise floor, 65× larger. Any replay artifact sits six bits below the defender's least-significant bit.
Every increment of defender resolution costs an instrument upgrade. The attacker's answer is a few-dollar RC filter that smooths any residual step below the new floor. The attacker filters more cheaply than the defender can measure.
A fingerprinting classifier sits on top of a 1553 receiver. The receiver, by standard, must accept far messier signals than anything the attacker introduces. A detector strict enough to flag the replay would reject the real device too.
Bars on a logarithmic scale · millivolts
230× The attacker's error is ~230× below the noise every conforming receiver must already decode through. A detector strict enough to flag the replay would reject the legitimate device first.
Source: MIL-STD-1553C §4.5.2
Measurement symmetry needs only a shared medium on which the authenticator is a physical property of the signal, so Proposition 1 covers every bus of this family, not just 1553. We have demonstrated the break directly on two of them, MIL-STD-1553 and CAN-FD. CAN, MODBUS, LIN and ARINC 429 are carried by the same proof.
| Bus | Fingerprinting defense | Broken by | Years |
|---|---|---|---|
| CAN | Clock skew | Cloaking | ’16 → ’18 |
| CAN | Voltage | DUET | ’18 → ’21 |
| MIL-STD-1553 | Voltage (Evcil, ANoMili) | WRAITH · this work | ’22 → ’26 |
| CAN-FD | Voltage VHF (Yang 2026) | WRAITH · this work | ’26 → ’26 |
Every row is a demonstrated break. MODBUS, LIN and ARINC 429 are covered by the same structural argument: Proposition 1 needs only a shared medium and an authenticator that is a property of the signal.
Yang et al. (2026) authenticate CAN-FD control units by voltage fingerprint and argue an adversary with full bus access cannot reproduce a device's analog identity. Their defender samples at 125 MS/s, the same rate our attacker's converter reaches, and all four attacks they evaluate assume the adversary transmits with different hardware or only listens. A recording of the legitimate node carries the legitimate fingerprint by construction, so with the sampling matched their scheme is a direct instance of Proposition 1. We captured and replayed on CAN-FD as well, and the fingerprint did not survive it.
03 / The Attack
The break, in four moves: Passive → Message → Forgery → Accepted. A single captured message is enough. No firmware exploit, no protocol expertise beyond bus access, no military grade equipment.
A passive probe records the bus. No transmission, so the attacker looks like any other monitor.
PassiveOne legitimate message is enough. The full analog sync region, the fingerprint, is stored at 14 bit resolution.
MessageKeep the target's stolen sync. Fill the data words with anything. The message wears the device's identity, carries the attacker's content.
ForgeryInject it differentially onto the bus. Independent equipment decodes it as the genuine device. Every time.
AcceptedRecord it, replay it, and the defense accepts it as a legitimate transmission.
Fingerprinting reads only the synchronization region of a message. Stitch the target's captured sync fingerprint onto protocol compliant data words carrying attacker chosen content, and the result presents the target's voltage identity while conveying a message the target never sent. The adversary wears a captured device's fingerprint while transmitting whatever it likes.
The platform also supports a real time trigger and override mode, where a monitor pattern matches live traffic, then injects a replacement message under the stolen fingerprint. Components validated independently; full automated integration is ongoing engineering work.
04 / The Evidence
Captured waveforms from legitimate infrastructure, replayed through the 14-bit converter, evaluated by independent test equipment operating off the replay path.
| Defense | Bus | Reported accuracy | vs. WRAITH |
|---|---|---|---|
| Evcil et al. · RF / KNN / SVM / CNN | MIL-STD-1553 | 100% | Bypassed |
| Evcil et al. · Local Outlier Factor | MIL-STD-1553 | 99.9% | Bypassed |
| ANoMili · CNN | MIL-STD-1553 | 99.45% | Bypassed |
Reported accuracy is against a different physical device, the scenario the original papers evaluate. “Bypassed”: the replay is the captured waveform re-emitted, so by Proposition 1 a classifier reading the same voltage trace cannot separate it from the original.
The attack itself needs only one message. The figures below are from a single example capture and analysis run on BusSpectre, the session shown above, not a general benchmark.
05 / The Platform
The whole attack platform, end to end: under $500 of commodity hardware, weaker than the adversary prior fingerprinting work assumes, and the software that captures, analyzes, and replays.
The kit · under $500, off the shelf
The software stack
06 / What Actually Works
These buses can be defended, just not by anything the adversary can observe and reproduce. Authentication must rest on a secret the adversary cannot pull off the wire.
A plaintext sequence number does not stop WRAITH: the adversary writes the next expected counter value into the forged message exactly as it writes any other data word. Freshness has force only when the adversary cannot produce a valid authenticator for the new counter, which returns the problem to a secret key.
Isolating transmitters onto separate sub-buses shrinks each shared medium, but not every shared medium can be expected to be divided into sub-buses: hardware limitations and optimization requirements often forbid it. Where the bus must stay shared, measurement symmetry still holds, and the authenticator has to be a secret the wire never carries.
A message authentication code computed with a per-device key gives unforgeable proof of origin that neither a recording nor a forgery can supply. Timing is not the obstacle: lightweight MACs designed for microcontrollers, such as Chaskey and Ascon (the NIST lightweight standard, SP 800-232), fit inside the 4–12 µs 1553 response window. A truncated 32-bit code fits in two data words and suffices for most operational needs.
| Defense | vs. WRAITH |
|---|---|
| Voltage fingerprinting (Evcil, ANoMili) | Bypassed |
| Commercial voltage IDS (Sital BRM1553D-SnS) | Bypassed |
| Plaintext sequence number | Bypassed |
| Timing anomaly (MAIDENS) | Partial |
| Protocol anomaly / rule filtering | Partial |
| Keyed MAC with freshness (Chaskey / Ascon) | Effective |
“Partial”: catches malformed or mistimed traffic, but accepts a voltage-faithful replay timed to an expected slot. “Effective”: cannot be forged or replayed without the key, regardless of waveform fidelity.
The preprint
The WRAITH Attack: a doctrine-first impossibility result, with MIL-STD-1553 as the proof vehicle.
Citation and arXiv identifier will be published here on posting. This preprint is a working version; author attribution is finalized before submission.
WRAITH is defensive research. All experiments were conducted on an isolated laboratory bench, against test equipment we own and control. No operational, fielded, or third-party system was targeted, and the design of the commodity 1553 board used for reconnaissance is withheld. We publish this work to correct a false assurance: a control marketed as authentication does not meet an authentication objective on a shared bus, and treating it as one displaces the crypto that actually would.
Where the finding implicates a specific product or deployed system, we support coordinated disclosure and will work with affected vendors ahead of full publication. The corrective is unambiguous and constructive: migrate device authentication to a keyed MAC with freshness bound under the key. Disclosure inquiries are handled via the project repository.
The Team
The people behind WRAITH and the BusSpectre platform.
