Fillory of PHY: Toward a Periodic Table of Signal Corruption Exploits and Polyglots in Digital Radio

Boundaries between layers of digital radio protocols have been breached by techniques like packet-in-packet: an attacker controlling the application layer payloads can, in fact, inject frames into lower layers such as PHY and LNK. But can a digital transmitter designed for a particular PHY inject frames into a different, noncompatible PHY network?

We present several case studies of such cross-protocol injection, and show that non-compatible radio PHYs sharing the same frequencies need not merely collide and jam each other, but can instead unexpectedly cross-talk. We propose a methodology for discovering such crosstalking PHYs systematically rather that serendipitously. No PHY is an island.