Weaponizing Wireless Networks: An Attack Tool for Launching Attacks - PowerPoint PPT Presentation

Weaponizing Wireless Networks: An Attack Tool for Launching Attacks against Sensor Networks Thanassis Giannetsos and Tassos Dimitriou Athens Information Technology Algorithms & Security (agia@ait.edu.gr) Black Hat Spain, 2010 Barcelona 1

Outline Wireless Sensor Networks Security Challenges Network Confidentiality Threats and Wireless Attacks Setup of deployed toy network An Attack Tool Passive monitoring of transactional data Discharge of various attacks Application to different sensor network operating systems 2

Brief Overview: Wireless Sensors Mote Cricket Using Smart Tmote Sky (Berkeley) (MIT) Antennas (AIT) Radio + MCU = NES Ultra low power Mesh Networking Tmote Sky Only chosen for a concrete example 3

Brief Overview: Sensor Networks Set of sensor nodes deployed in large areas of interest Self-Configuration, adaptability and node cooperation Multi-hop and many-to-one communication Applications Smart Grid Military Wildlife Monitoring 4

Brief Overview: Why Sensor Nets Unique characteristics Coverage: Distance/area covered, number of events, number of active queries Survivability: Robust against node/link failures Ubiquity: Quick/flexible deployment, ubiquitous access, info timeliness Particularly suited for detecting, classifying, tracking Non-local spatio-temporal events/objects Low-observable events Distributed information aggregation & validation 5

Part 1: - Security Challenges - Network Confidentiality Threats exploited by our Tool - Supported Wireless Attacks 6

Security Challenges Wireless medium: Eavesdropping, Interception, Alteration, Replay or Injection of malicious packets Unattended Operation: Exposed to physical attacks. Easily compromised Random Topology: No prior knowledge of topology Hard to protect against insider attacks: Physical Attacks Exploiting memory related vulnerabilities 7

Disclaimers Attacks – DOS, JAM, Replay, Sybil, …. Secure Aggregation Secure Localization Several defense mechanisms have been proposed against Other security issues: Privacy, Authentication specific attacks Secure Routing Intrusion Detection , … Security holes always exist Intrusion Detection protocols Key-Management implementation Access Control Crypto-algorithms Cryptanalysis Identifying risks posed by availability of transactional data is EXTREMELY VITAL 8

Network Confidentiality Threats Have implement a Sniffer: Overhear network traffic Process transmitted packets (traffic analysis) Extract info about a network’s nodes and usage Sniffer can be used to compromise network confidentiality Carrier frequency Identify network’s sensor hardware platform Message rate and size Kind of application, frequency of monitored events and distance estimation to the sensed event Routing Information Routing Protocol, Topology graph and Message Stream Trace 9

Supported Wireless Attacks Confidentiality attacks: Intercept private info sent over the wireless medium Eavesdropping, Data Replay, Selective Forwarding Integrity attacks: Send forged data frames Program Image Dissemination, Data Injection, Malicious Code Injection Availability attacks: Impede delivery of wireless messages Sinkhole, HELLO Flood attack 10

Part 2: Setup of SENSYS Attack TOOL Demo 11

Sensor Platform used TI MSP 430 (16 bit RISC) 8 MHz, 10 KB RAM, 48 KB code, 1 MB flash Von Neumann architecture No memory protection Heap space unused!!! Chipcon CC2420 radio, on-board antenna IEEE 802.15.4 compliant 50 m. range indoor, 250 m. range outdoor, bandwidth 250 kbits/s 12

Stored Program Images Delta application Multihop data collection application. Devices sample their internal temperature sensor and report readings using MultihopLQI routing prtotocol Oscilloscope application Senses all of the sensors on MoteIV Tmote Sky module and sends back its values Channel assignment [Humidity(0), Temp(1), TSR(2), PAR(3), InternalTemp(4), InternalVoltage(5), Moisture(6)] Packs 10 channel readings into a message Simple Radio demonstration application Exploits for demonstrating Malware Injection 13

Part 3: SENSYS Attack TOOL Description 14

Why bother ? By compromising overall sensor network security: Reveal wireless networking vulnerabilities Describe the “best” ways to perform existing attacks and study their effects Come up with novel attacks Shed light on the weaknesses of underlying protocols Highlight and motivate the need to come up with more efficient security protocols MOST IMPORTANT…Because it’s fun 15

Architecture Layout Network Sniffer for passive monitoring and logging of radio packets Network Attack Tool that provides functionalities for compromising a sensor network’s security profile Network Visualization for displaying overheard neighborhood topology, network traffic, node states and status of any performed attack 16

Network Sniffer Local Packet Monitoring module Gathers audit data to be forwarded over the serial port Listening promiscuously to neighboring nodes’ transmissions Packet Storage module Logging of messages to the attached host Offline analysis is possible Packet Description Database module Decodes overheard messages Contains annotated message structures Extendable configuration Access and manipulating operators 17

Network Sniffer (cont…) Capturing and decoding unprotected network traffic (eavesdropping) 18

Network Sniffer (cont…) 19

Network Attack Tool Core component…It provides a number of attacks to be performed Data Stream Framework (DSF) Configured by network information (hardware platform, underlying routing protocol, message rate) Upon request constructs and transmits specially crafted packets Attack Launcher Handled by the user Depending on the kind of attacks provides the DSF with suitable requests 20

Data Replay Attack Valid data transmission is maliciously repeated Tool enables transparent data access and alteration upon selection Replay original Replay modified Fetch the message from Packet Description Database Alter its content Actual fields (if message structure is known) Payload byte array (if unknown) 21

Sinkhole Attack Draw all or as much traffic as possible from a particular area by making yourself look attractive to the surrounding nodes with respect to the underlying routing metric 22

Routing Layer Model Great diversity in routing protocols (RP) for sensor nets Link quality calculations as routing cost metric (RCM) Choose as your parent the node with best LQ (smallest cost) in order to build the routing tree towards the BS MintRoute Link quality estimates Based on the packet loss of periodic Route Update transmissions Changes in Neighborhood Table triggers parent changing mech MultihopLQI Link Quality based on their own hardware (LQI) Periodic transmission of Beacons and extraction of path cost 23

Ways to Launch Sinkholes Advertise high LQ for itself + Make current parents look like they have poor LQ Impersonate other nodes and transmit fake Route Updates Only for RPs with LQ estimates Easy to detect – not implemented Advertise minimum cost (15) to the BS Find the node with smallest Path Cost Choose it as your parent node Add minimum cost and advertise it Legitimate actions - Impossible to detect IMPORTANT …Configurable transmission period 24

Selective Forwarding Refuse to forward certain messages Especially severe after Sinkhole All message traverse through the attacker Leading to Denial of Service attacks Do not OVERDO it as you will get caught Results visible at the GUI…Many retransmissions of the same message 25

Program Image Dissemination Take advantage of network programming capabilities Dissemination of code updates, reprogramming of nodes Over-the-air programming (OAP) – Deluge protocol Uses reliable broadcasting for flooding the network inject 26

Ok, so what? Subvert such protocols Modify or replace the real code image Inject new code application Reprogram the network to DO your work Use other functionalities provided by OAP Pinging – Request info from a node about its state (stored program images, currently executing image) Reboot Erase Inject 27

How it works… CRC Page 0 Packet 0 Metadata Packet 1 0s Page 1 Length … Packet N-1 … Packet 0 Image Packet 1 Page P-2 … Packet N-1 0s Page P-1 Padding 0s Program Images are big – Suppose to happen few time during network lifetime Drain network’s energy 28

Program Image Dissemination 6 places for storing images Golden Image (0) cannot be manipulated or changed 29

Malicious Code Injection Take advantage of memory related vulnerabilities Buffer and stack overflow Send crafted packets and execute malicious code on the target system In embedded systems like sensor nodes Malware is rare No one looks for it Simple malware is undetected – Can be converted to an actual self-propagating worm 30

History Travis Goodspeed was the first to author a WSN exploit Targeting devices following the Von Neumann architecture Francillon and Castelluccia demonstrated code injection on devices with Harvard architecture We took it one step further Inject and execute arbitrarily long code Used radio capabilities to create a self-replicating worm that propagates the carried malware to the whole network By infecting one node – Compromise the entire network 31