Natalie Podrazik – CS 491V – “ Denial-of-Service Attacks: Real Vulnerabilities and Practical Solutions” Natalie Podrazik April 19, 2006

Natalie Podrazik – CS 491V – Overview I.What is II Vulnerabilities I.Identity II.MAC Layer III.Experiment I.Tools and Modifications II.Results IV.Conclusions V.Relevancy to E-Voting Project

Natalie Podrazik – CS 491V – What is ? IEEE wireless internet standard b, a, g flavors Popular Cheap Easy to set up, maintain Operates on 2.4 GHz band

Natalie Podrazik – CS 491V – Client, Name: ABCDEFGHIJKL Access Point, Name: AccessPoint00 How does work? Authentication Request & Response Association Request & Response Data Payload Acknowledgements Deauthentication Request & Response

Natalie Podrazik – CS 491V – Vulnerabilities 1. Identity Use of MAC frames with sender and receiver 2. MAC Layer Use of MAC frames to avoid collisions Client, Name: MNOPQRSTUVWX To: AccessPoint00 From: MNOPQRSTUVWX Duration: 100  s Frame Spoofing Stalling Hi, I’m ABCDEFGHIJKL...

Natalie Podrazik – CS 491V – Access Point, Name: AccessPoint00 Spoof Attack 1: Deauthentication Authentication Request & Response Association Request & Response Data Payload Deauthentication Request Client, Name: ABCDEFGHIJKL Attacker, Name: MNOPQRSTUVWX x Deauthentication Response

Natalie Podrazik – CS 491V – Access Point, Name: AccessPoint00 Approaches to Deauthentication Spoof client or Access Point To: AccessPoint00 From: ABCDEFGHIJKL Msg: DEAUTH MAC Frame Attacker, Name: MNOPQRSTUVWX To: ABCDEFGHIJKL From: AccessPoint00 Msg: DEAUTH MAC Frame Client, Name: ABCDEFGHIJKL

Natalie Podrazik – CS 491V – Strength of Deauthentication Attack Client must re-establish connection Prevention of sending or receiving any data Possibilities Forbid or limit access to certain clients Block entire access point More work for attacker Clean attacks – new auths No escape for client to other AP’s

Natalie Podrazik – CS 491V – Access Point, Name: AccessPoint00 Spoof Attack 2: Disassociation Authentication Request & Response Association Request & Response Data Payload Disassociation Request Client, Name: ABCDEFGHIJKL Attacker, Name: MNOPQRSTUVWX x Deauthentication Response

Natalie Podrazik – CS 491V – Evaluation of Disassociation Attack Similar to deauthentication Less efficient Deauthentication forces the client do to more work: re-establish authentication + association Disassociation only forces client to reestablish association, not authentication.

Natalie Podrazik – CS 491V – Access Point, Name: AccessPoint00 Spoof Attack #3: While you were sleeping... Power-saving techniques allow clients to go to sleep Client, Name: ABCDEFGHIJKL I’m going to sleep Ok, I’ll take your messages zzzz z I’m awake. Any messages?

Natalie Podrazik – CS 491V – Access Point, Name: AccessPoint00 Spoofing the Polling Message Client, Name: ABCDEFGHIJKL zzzz z I’m awake. Any messages? I’m ABCDEFGHIJ K, and I’m awake. Nope x Attacker, Name: MNOPQRSTUVWX

Natalie Podrazik – CS 491V – TIM Packets Traffic Indication Map Spoof broadcast of TIM Access Point, Name: AccessPoint00 Client, Name: ABCDEFGHIJKL zzzz z TIM No pending messages for ABCDEFGHIJKL

Natalie Podrazik – CS 491V – Timing Waking up timing relies on: Period of TIM packets Timestamp broadcast from access point Both are sent in the clear Attack: Get client out of sync Wake up at the wrong times

Natalie Podrazik – CS 491V – MAC Vulnerabilities Access to MAC divided into windows Short InterFrame Space (SIFS) For already connected exchanges Distributed Coordination Function InterFrame Space (DIFS) To initiate new frames Sender specifies which window No immediate ACK = collision Random exponential backoff algorithm To: AccessPoint00 From: ABCDEFGHIJKL Window: DIFS To: AccessPoint00 From: ABCDEFGHIJKL Window: DIFS MAC Frame

Natalie Podrazik – CS 491V – MAC Attack #1: Waiting to Transmit Every transmitting node has to wait at least 1 SIFS interval Attack: send short message before end of each SIFS interval Unlikely: SIFS period = 20  s, many packets per second to send 1 SIFS interval (20  s) Backoff

Natalie Podrazik – CS 491V – MAC Attack #2: Duration Every frame has a duration field How many  s the channel will be reserved Used to setup Network Allocation Vector (NAV) Nodes can only transmit when NAV == 0 To: AccessPoint00 From: MNOPQRSTUVWX Duration:  s MAC Frame

Natalie Podrazik – CS 491V – Duration Attacks Possible to use almost any frame to control NAV ACK RTS (Request To Send) / CTS (Clear To Send) Attacker uses little resources Transmit ~30 times / second to jam channel Little power used Use of a directional antennae

Natalie Podrazik – CS 491V – Experiment Challenge: Modifying MAC frames to spoof sender address Generating any old control frames Solution: Tweak “Buffer Access Path” firmware and Aux-Port Intervenes between NIC’s passing of packets to hardware Attacks via OTS hardware

Natalie Podrazik – CS 491V – Attacker iPAQ H3600 with Dlink DWL-650 card Linux Weighs 375 g (~12oz) Easily fits in a coat pocket Listening application Clients identified by MAC addresses DNS-resolver used

Natalie Podrazik – CS 491V – Experiments Client (Windows XP) Access Point (Linux HostAP) Attacker Client (Linux Thinkpad) Client (MacOS X) Client (Linux iPaq) Monitoring Station

Natalie Podrazik – CS 491V – Attack #1: Deauth Against One Access Point (Linux HostAP) Attacker Client (Linux Thinkpad) Client (MacOS X) Client (Linux iPaq) Monitoring Station

Natalie Podrazik – CS 491V – Single Client Attack Transfer immediately halted Attack lasted for < 10 sec Rate of transfer wasn’t up to par for more than a minute Recovery

Natalie Podrazik – CS 491V – Attack #2: Deauth Against All Access Point (Linux HostAP) Client (Linux Thinkpad) Client (MacOS X) Client (Linux iPaq) Monitoring Station Attacker

Natalie Podrazik – CS 491V – Attack Against All Clients Windows XP can still send a little bit Packets not from that session – underlying UDP packets from another XP service

Natalie Podrazik – CS 491V – Access Point Monitoring Station Attacker MAC Attack Plays by timing rules but sets large durations Sends packets out 30 times per second Ignores all duration values from any other node 18 client nodes in this experiment

Natalie Podrazik – CS 491V – Results of MAC Attack Channel is completely blocked for the duration of the attack Similar results with ACK and RTS/CTS frames

Natalie Podrazik – CS 491V – Defenses to MAC Attack Cap on duration values Sending 90 packets per second brought network down

Natalie Podrazik – CS 491V – Overall Recommendations Authentication of control packets Limiting the size of ACK frames Individual nodes’ duration threshold Situational Awareness

Natalie Podrazik – CS 491V – New and Relevant Modifying frames at data link layer through OTS hardware Strength of attacks Ease of attack Scale of attack Resources needed Capabilities of modern cell phones

Natalie Podrazik – CS 491V – Mobile Devices iPAQ H6315 Pocket PC F1000G LinkSys WIP Smartphone T-Mobile M/DA Verizon XV6700

Natalie Podrazik – CS 491V – AVS WINvote

Natalie Podrazik – CS 491V – Works Cited 1.“Access Point". Wikipedia. Last updated: 13 April Date of Access: 18 April 2006: Bellardo, John, and Stefan Savage. " Denial-of-Service Attacks: Real Vulnerabilities and Practical Solutions" in the Proceedings of the USENIX Security Symposium, August Friedl, Steve. "Network Guru's Guide to b Wireless Networing." U Unixwiz.net. Date of Access: 18 April 2006: 4."HP iPAQ Pocket PC Information Center System Specifications". Pocket PC Central. Date of Access: 18 April 2006: 5."Media Access Control". Wikipedia. Last updated: 12 April Date of Access: 18 April 2006: "Mobile Device Reviews". BrightHand. Date of Access: 18 April 2006: \ 7."UT-STARCOM F1000G System Specifications". UTstarcom. Date of Access: 18 April 2006: "Wi-Fi". Wikipedia. Last updated: 18 April Date of Access: 18 April 2006: