Recently, researchers have proposed a number of ranging and positioning techniques for wireless networks. However, they all studied these techniques in non-adversarial settings. Distance estimation and positioning techniques are, nevertheless, highly vulnerable to attacks from dishonest nodes and malicious attackers. Internal attackers can report false position and distance information in order to cheat on their locations and external attackers can modify the measured positions and distances of wireless nodes. In this work, we demonstrate two attacks on ultrasonic ranging systems: the wormhole attack, by which the attackers reducethe distance measured between two honest nodes, and the pulsedelay attack, by which the attackers enlarge the measured distance. With these attacks, we show that the attackers can arbitrarily modify distances measured with ultrasonic ranging, despite the authentication and integrity protection of the messages used in the ranging protocol. Based on this difference, B estimates its distance to A.