1. Self Organized Networks
Doctoral School
ICI
Course Project
Self Organized Networks
CLASS : a Cross-Layer Attack, Subtle and Simple
Alaeddine EL-FAWAL
LCA : Laboratory for computer Communications and Applications
February 6th, 2004

2. OUTLINE Facts and Objectives Related Work Motivation for our Proposal
Simulation
Detection
Perspectives
Conclusions
Our Attack

3. Facts & Objectives Facts : Objectives : Hotspots anywhere
24,000 world-wide soon
100 so far in Switzerland
Given the limited bandwidth:
Attacks are benificial!! (Gain in banwidth and money )
At the network layer : (well discussed in the literature)
What about MAC layer ? (Rarely discussed)
MAC layer protocol :
Objectives :
Find vulnerabilities in
Protect
We are concerned in rational behavior.

4. Facts & Objectives Misbehavior scenario Well-behaved node
Cheater

5. OUTLINE Related Work Facts and Objectives Motivation for our Proposal
Our Attack
Simulation
Detection
Perspectives
Conclusions

6. Existing Attacks : (Rational Cheater)
Related Work
Existing Attacks : (Rational Cheater)
Specially based on manipulating backoff time /DIFS:
Decreasing Backoff / DIFS  Increasing Priority
A cheater can:
Change his own Parameters :
Reduce Contention Windows.
Transmit before DIFS
...
increase cheater´s priority
Act directly against other nodes :
Selectively scramble others´ Pkts .
Others will increase their Contention Windows.
decrease other nodes´ priorities

7. Related Work Existing Solutions
1 - Proposed by Kyasanur and Vaidya :
Concept: the receiver assigns backoff values to the sender
Detection: compare expected and observed backoffs
Correction: assign penalty to the cheater
Drawbacks:
Modification of IEEE
The receiver can control the sender
Only one traffic pattern
Only one type of misbehavior

8. Related Work Existing Solutions
2 – DOMINO Solutions :
Station sends before DIFS:
Easily detectable after few packets
CTS/ACK scrambling:
Detectable using the number of retransmissions
Manipulated backoff: more subtle
Detection metrics
Throughput and delay ? NO because:
Traffic dependent
Subject to many factors
Backoff ? YES but:
Cannot be distinguished if the sender has large delays
Collisions lead to confusing situations

9. Motivation for our Proposal
OUTLINE
Facts and Objectives
Related Work
Motivation for our Proposal
Our Attack
Simulation
Detection
Perspectives
Conclusions

10. Motivation for our Proposal The Above Attacks
The Above Attacks are Uplink (Cheater  AP)
Realistic traffic
Downlink
AP belongs to ISP : Trusted Node.
The above Attacks are not relevant anymore
Furthermore
90% of traffic : TCP (http, FTP, ...)
To kill TCP connections : network layer Attacks (dsniff)
BUT
Fail in presence of Authentication (IPsec)

11. Motivation for our Proposal
Efficient Smart Attack against TCP on the downlink.
At the MAC Layer.
First Attack that combines and TCP Vulnerabilities
Transparent to TCP and MAC:
Hard to detect.
Efficient even when using IPsec

12. OUTLINE Facts and Objectives Related Work Motivation for our Proposal
Our Attack
Simulation
Detection
Perspectives
Conclusions

13. Our Attack Uses the following 802.11 vulnerability :
MAC Frame Header
Copying of transmitter address (AP)
MAC-ACK
No Authentication, No source Address

14. Our Attack Attack Description
Simple Scenario : Sc S Mc M
INTERNET
Well-behaved node‘s Pkts
AP Queue
Cheater‘s Pkts
MAC-ACK
TCP AP
TCP
TCP Pkt is lost.
AP knows nothing about this loss.
It dequeues the frame. (No retransmissions)
TCP decreases its window.
Repeated loss  killed TCP connection

15. Result: increasing the cheater’s Throughput
Our Attack
Attack Description
General Case :
Jam all TCP Pkts or TCP-ACKs that don´t belong to the cheater.
Send MAC-ACK to the transmiter.
Prob. of jamming : X (X=1, jamming all other nodes‘ Pkts)
Cheater´s Benefits :
Killing TCP Connections  reducing load at AP & Wireless Channel.
Decreasing Delay (No retransmission due to collision)
Minimizing Loss Prob. (No Drop at AP)
Result: increasing the cheater’s Throughput

16. OUTLINE Facts and Objectives Related Work Motivation for our Proposal
Our Attack
Simulation
Detection
Perspectives
Conclusions

17. Simulation Simulator : Implementation of the attacks in ns-2.27.
To be completely transparent, only TCP traffic is jammed (ctrl. Pkts. are saved)
Results are averaged over 5 simulations.

18. Simulation Simulated Scenario : DCFMc M
INTERNET AP
FTP
DCF
TCP traffic on the downlink (FTP connections).
Channel capacity : 1Mbps
TCP Pkt size : 1000 Bytes
2 cases :
Immediate jamming.
Delayed jamming (after a warmup period).

19. Simulation
Immediate Jamming :

20. Simulation
Delayed Jamming (warmup period):

21. OUTLINE Facts and Objectives Related Work Motivation for our Proposal
Our Attack
Simulation
Detection
Perspectives
Conclusions

22. This attack is completely
Detection
Problems :
How to distinguish between jamming & collision.
Even if jamming is detected, the cheater remains unknown.
Downlink jamming is not detectable near the AP.
AP signal strength is larger than the jamming signal strength near the AP.
Placing sensors near the AP is useless.
Existing DOMINO procedures cannot detect it
This attack is completely
Transparent to
MAC and TCP.

23. OUTLINE Facts and Objectives Related Work Motivation for our Proposal
Our Attack
Simulation
Detection
Perspectives
Conclusions

24. Perspectives
To make detection more difficult, the cheater may use On/Off jamming periods.
Multiple cheaters.
Network collapses.
Pareto-optimal point.
Applying game theory: the move is to change the jamming prob.
BUT: We need to detect the attack.
To avoid this attack:
Without modifying
Here is the challenge!!
Modifying
NACK.
Authentication.

25. OUTLINE Facts and Objectives Related Work Motivation for our Proposal
Our Attack
Simulation
Detection
Perspectives
Conclusions

26. Conclusions First attack that combines 802.11 & TCP vulnerabilities.
Completely transparent:
Jamming = collision.
MAC-ACK is not authenticated.
Very efficient on the downlink as well as on the uplink.
More harmful to TCP than UDP flows.

27. MERCI DE VOTRE ATTENTION