1. Weaponizing Wireless Networks: An Attack Tool for Launching Attacks against Sensor Networks Thanassis Giannetsos Tassos Dimitriou Neeli R. Prasad

2. Outline Background Network Threats and Wireless Attacks Tool Architecture Overview Implemented Attacks and Actions Conclusion Reference

3. Background Network Threats and Wireless Attacks Tool Architecture Overview Implemented Attacks and Actions Conclusion Reference

4. Background Wireless sensor network – Monitor physical or environmental conditions, such as temperature, sound, vibration, pressure, motion or pollutants. Equip with a radio transceiver, a microcontroller, and a battery.

5. Background Network Threats and Wireless Attacks Tool Architecture Overview Implemented Attacks and Actions Conclusion Reference

6. Network Threats and Wireless Attacks Inadequate physical protection – Energy and Cost Through the air – Easy to be intercepted Wireless Attack – Interception – Alteration – Disruption – Injection

7. Background Network Threats and Wireless Attacks Tool Architecture Overview Implemented Attacks and Actions Conclusion Reference

8. Tool Architecture Overview Three Main Conceptual Modules: – Network Sniffer: Monitoring and logging of radio packets. – Network Attack Tool: Provides a number of actions for attack. – Network Visualization: Display topology 、 Traffic 、 Nodes State and Status of attack.

9. Tool Architecture Overview

10. Network Sniffer (1/3) The network sniffer relies on packets that are overheard in a sensor's node neighborhood. It captures them and logs them for later analysis. Components: – Local Packet Monitoring – Packet Storage – Packet Description Database

11. Network Sniffer (2/3) Local Packet Monitoring: – To gather audit data Packet Storage: – Logging and analysis – Construct graph of neighborhood topology Packet Description Database – User can specify msg content as C structs which automatically added to DB

12. Network Sniffer (3/3) Network Attack Tool Analysis & Graph

13. Network Attack Tool (1/3) Provide a number of actions for compromising the sensor network's security profile. Components: – Data Stream Framework – Attack Launcher

14. Network Attack Tool (2/3) Data Stream Framework: – Identified info as its configuration record – Basis msg for Attack Launcher Attack Launcher: – 6 types of attacks: Data Replay ‚Malicious Code Injection ƒSinkhole Attack „Selective Forwarding …Flooding †Program Image Dissemination & Ping Operation

15. Network Attack Tool (3/3) Network Sniffer

16. Background Network Threats and Wireless Attacks Tool Architecture Overview Implemented Attacks and Actions Conclusion Reference

17. Implemented Attacks and Actions (1/3) Data Replay – Msg are stored into the Packet Description Database. Malicious Code Injection – Buffer overflow – Create self-replicating worm and broadcast it. Selective Forwarding

18. Implemented Attacks and Actions (2/3) Sinkhole Attack – Use link quality (LQ) calculations as the routing cost metric to build the routing tree towards the base station. – Broadcast a beacon message. – Advertise a very good LQ in order for all neighboring nodes to choose the tools' attached node as their parent. Flooding – Send HELLO messages with high transmission power. Send Msg

19. Implemented Attacks and Actions (2/3) Program Image Dissemination & Ping Operation – The ping action sends a message to a specific sensor node to request about its state, its currently executing program image and what other images are stored in that node. – Program Image dissemination is a fundamental service in sensor networks that relies upon reliable broadcast of image updates.

20. Background Network Threats and Wireless Attacks Tool Architecture Overview Implemented Attacks and Actions Conclusion Reference

21. Conclusion To reveal the vulnerabilities of such networks To study the effects of severe attacks on the network itself To motivate a better design of security protocols.

22. Reference http://www.exploit- db.com/download_pdf/15365 http://en.wikipedia.org/wiki/Wireless_sensor _network http://ics.stpi.org.tw/Treatise/doc/73.pdf