WRAITH · Waveform Replay Attack Imitating Transmitted Hardware
Physical-layer hardware fingerprinting is being sold and fielded as device authentication on shared control buses. It cannot do that job. On a shared medium the attacker and the defender observe the identical signal — so the defense reduces to a recording played back. We prove it on MIL-STD-1553, the hardest and most-defended case, with under $500 of commodity hardware.
01 / The Doctrine
Legacy control buses — automotive CAN, avionics MIL-STD-1553, ARINC 429 — were designed for determinism, not for a threat model. They carry no authentication. The proposed retrofit is seductive: identify each transmitter by the analog voltage signature that manufacturing variation stamps on its signals. No protocol change, no rewiring — just a classifier watching the wire.
And the reported numbers are strong enough to drive procurement. So the doctrine spread from papers into products marketed as an intrusion-detection layer for military and automotive buses. The common promise: a device cannot be impersonated, because its analog identity cannot be reproduced.
device classification accuracy on real helicopter avionics Evcil et al., 2024 — MIL-STD-1553
per-device accuracy in a fielded defense-in-depth system Levy et al. (ANoMili), 2022 — MIL-STD-1553
single-frame recognition, marketed into automotive Yang et al., 2026 — CAN-FD · Cho, Kneib, Choi — CAN
shipping as commercial silicon today e.g. Sital Technology BRM1553D-SnS
Every one of those accuracies is real. Every one was measured under the wrong threat model — foreign hardware carries a foreign fingerprint. Nobody measured the adversary who simply records the legitimate signal.
02 / The Structural Flaw
The premise treats manufacturing variation as if it were a secret. On a shared medium, it is public information — retransmitted on every message.
Proposition 1 — Measurement Symmetry
Let F be any feature a defender computes from voltage samples V captured at rate fs and resolution b. An adversary with b′ ≥ b and f′s ≥ fs records V′ with |F(V) − F(V′)| ≤ ε, where ε is bounded by the two converters' quantization. Any classifier that accepts F(V) within tolerance δ > ε must also accept F(V′).
No choice of feature escapes it. Raw samples, rise/fall times, ringing, spectral shape — all are functions of the same voltage trace, and a faithful copy carries every one of them at once. The adversary does not model the fingerprint. It re-emits the exact signal that produced it. This is why the operative attack is replay, not imitation.
Channel variability — multipath, fading — is the only partial defense against physical-layer replay. An impedance-controlled, transformer-coupled 1553 bus has essentially none of it. The doctrine is weakest exactly where it is deployed most confidently.
A 14-bit converter resolves the waveform to ~0.6 mV; an 8-bit defender scope has a ~39 mV noise floor — 65× larger. Any replay artifact sits six bits below the defender's least-significant bit.
Every increment of defender resolution costs an instrument upgrade. The attacker's answer is a few-dollar RC filter that smooths any residual step below the new floor. The attacker filters more cheaply than the defender can measure.
03 / The Attack
A single captured message is enough. No firmware exploit, no protocol expertise beyond bus access, no military-grade equipment.
Connect a differential probe and record raw bus voltage. A Manchester decoder recovers message boundaries and address mappings. Nothing is transmitted — indistinguishable from a legitimate bus monitor.
Record the target's transmission at full 14-bit converter resolution. No dataset required: one valid message from the target is sufficient to mount the attack.
Keep a single instance at full resolution — no averaging, no normalization. Averaging would smooth away the very micro-variations in overshoot, ringing, and edge timing that fingerprinting is trained to read.
Emit the waveform onto the bus through the 14-bit analog output and a transformer stub. The transmission carries the original device's analog identity — because it is the original device's waveform.
Fingerprinting reads only the synchronization region of a message. Stitch the target's captured sync fingerprint onto protocol-compliant data words carrying attacker-chosen content, and the result presents the target's voltage identity while conveying a message the target never sent. The adversary wears a captured device's fingerprint while transmitting whatever it likes.
The platform also supports a real-time trigger-and-override mode — a monitor pattern-matches live traffic, then injects a replacement message under the stolen fingerprint. Components validated independently; full automated integration is ongoing engineering work.
04 / The Evidence
Captured waveforms from legitimate infrastructure, replayed through the 14-bit converter, evaluated by independent test equipment operating off the replay path.
| Defense | Bus | Reported accuracy | vs. WRAITH |
|---|---|---|---|
| Evcil et al. — RF / KNN / SVM / CNN | MIL-STD-1553 | 100% | Bypassed |
| Evcil et al. — Local Outlier Factor | MIL-STD-1553 | 99.9% | Bypassed |
| ANoMili — CNN | MIL-STD-1553 | 99.45% | Bypassed |
Reported accuracy is against a different physical device — the scenario the original papers evaluate. “Bypassed”: converter replay of captured waveforms accepted as valid across 50+ hardware tests with zero protocol errors. By Proposition 1, a classifier reading the same voltage trace cannot separate the replay from the original.
The corpus exists to characterize the defense and validate the decoder — the attack itself needs one message.
05 / The Kit
Strictly weaker than the adversary assumed in the fingerprinting literature, which presumes dedicated bus-controller-capable protocol hardware.
06 / Every Shared Bus
Measurement symmetry needs only a shared medium on which the authenticator is a physical property of the signal. Every widely deployed control bus of this family meets that condition.
| Bus | Fingerprinting defense | Evasion | Years |
|---|---|---|---|
| CAN | Clock skew | Cloaking | ’16 → ’18 |
| CAN | Voltage | DUET | ’18 → ’21 |
| MIL-STD-1553 | Voltage (Evcil, ANoMili) | WRAITH — this work | ’22 → ’26 |
| CAN-FD | Voltage VHF (Yang 2026) | WRAITH predicted | ’26 → ’26 |
The CAN-FD row is predicted by Proposition 1 under matched 125 MS/s sampling, not a separate hardware demonstration. The others are demonstrated evasions. MODBUS, LIN, and ARINC 429 follow by the same structural analogy.
Yang et al. (2026) authenticate CAN-FD control units by voltage fingerprint and argue an adversary with full bus access cannot reproduce a device's analog identity. Their defender samples at 125 MS/s — the same rate our attacker's converter reaches. All four attacks they evaluate assume the adversary transmits with different hardware or only listens. None records the legitimate node and replays it. A recording of the legitimate node carries the legitimate fingerprint by construction — with the sampling matched, their scheme is a direct instance of Proposition 1.
07 / What Actually Works
These buses can be defended — just not by anything the adversary can observe and reproduce. Authentication must rest on a secret the adversary cannot pull off the wire.
A plaintext sequence number does not stop WRAITH: the adversary writes the next expected counter value into the forged message exactly as it writes any other data word. Freshness has force only when the adversary cannot produce a valid authenticator for the new counter — which returns the problem to a secret key.
A message authentication code computed with a per-device key gives unforgeable proof of origin that neither a recording nor a forgery can supply. Timing is not the obstacle: lightweight MACs designed for microcontrollers — Chaskey, and Ascon (the NIST lightweight standard, SP 800-232) — fit inside the 4–12 µs 1553 response window. A truncated 32-bit code fits in two data words and suffices for most operational needs.
| Defense | vs. WRAITH |
|---|---|
| Voltage fingerprinting (Evcil, ANoMili) | Bypassed |
| Commercial voltage IDS (Sital BRM1553D-SnS) | Bypassed |
| Plaintext sequence number | Bypassed |
| Timing anomaly (MAIDENS) | Partial |
| Protocol anomaly / rule filtering | Partial |
| Keyed MAC with freshness (Chaskey / Ascon) | Effective |
“Partial”: catches malformed or mistimed traffic, but accepts a voltage-faithful replay timed to an expected slot. “Effective”: cannot be forged or replayed without the key, regardless of waveform fidelity.
08 / The Platform
The capture, analysis, and replay stack behind WRAITH — a MIL-STD-1553 test bench that spans analog capture, signal analysis, replay, and protocol-level operations.
The preprint
The WRAITH Attack — a doctrine-first impossibility result, with MIL-STD-1553 as the proof vehicle.
Citation and arXiv identifier will be published here on posting. This preprint is a working version; author attribution is finalized before submission.
WRAITH is defensive research. All experiments were conducted on an isolated laboratory bench, against test equipment we own and control. No operational, fielded, or third-party system was targeted, and the design of the commodity 1553 board used for reconnaissance is withheld. We publish this work to correct a false assurance: a control marketed as authentication does not meet an authentication objective on a shared bus, and treating it as one displaces the crypto that actually would.
Where the finding implicates a specific product or deployed system, we support coordinated disclosure and will work with affected vendors ahead of full publication. The corrective is unambiguous and constructive — migrate device authentication to a keyed MAC with freshness bound under the key. Disclosure inquiries are handled via the project repository.