Slashdot Mirror
New Denial-of-Service Attacks Threaten Wireless Data Networks
alphadogg writes "Forget spam, viruses, worms, malware, and phishing. These threats are apparently old-school when compared to a new class of denial-of-service attacks that threaten wireless data networks. The threats were outlined in a talk in NYC Thursday by Krishan Sabnani, vice president of networking research at Bell Labs, at the Cyber Infrastructure Protection Conference at City College of New York. Sabnani said they are the result of inherent weaknesses in Mobile IP, a protocol that uses tunneling and complex network triangulation to allow mobile devices to move freely from one network to another. 'We need to especially monitor the mobile networks — with limited bandwidth and terminal battery — for DOS attacks,' Sabnani said, adding that the newest DOS attacks on wireless networks involve repeatedly establishing and releasing connections. These attacks are easy to launch and hard to detect, he said."
I think they got this backward. The DoS attack is the old school one since there is limited money in it (unless you are an organization that does DoS threat blackmailing, but even those don't make the kind of money that more modern attacks can generate). DoS is the old school one, not the worms, malware, and phishing that the summary claims are old school.
than viruses, worms and malware. DOS can't harm me and my PC(as a private person), only inconvenience. The things are not even comparable. Just another article written by a a journalist who fails to understand basic IT.
And no, I am not talking about the operating system DOS.
The article doesn't say anything. New "old school" Dos attacks. I feel dumber for having been suckered into reading the article.
DoS is a natural part of the race of technology.
Can it be used against us? Yes.
Can we prevent those attacks? Most likely, and with a little time.
The real question is -how likely- is it to be a problem?
DoS attacks on the internet can be sent from anywhere.
DoS attacks on the celluar network can only be sent from within that area. (afaik)
This limitation alone limits the scope of this type of DoS attack, making it a tool of advance planning and high-profile national security aspects than a tool to be feared by the average Joe.
There are no perfect answers, only the right questions. More questions at http://foresightandhindsight.blogspot.com/
"One cable modem user with 500Kbps upload capacity can attack over 1 million mobile users simultaneously," he said.
He then goes on to discuss the types of attacks and statistical techniques you can use to detect them. Honestly I don't see how the problem wouldn't be solved with a firewall. If the mobile devices don't have static IP addresses (some do, I'm not sure what percentage), it will be hard to implement any of the attacks described.
Qxe4
DoS should be easy to detect...you know when something is DoS'ed or Slashdotted. I think he means it's hard to trace the source.
Associated with a virus for mobile this technique can become a huge problem for the providers!
That was total crap, was he selling some solution for it?
At first, I do not know any large-scale deployment of Mobile-IP. 3G networks provide mobility below IP and they do not use any "complex network triangulation" in it. Mobile-IP does have its weakness, but AFAIK the latest RFCs should provide quite solid (not worse-than-fixed) protection from DOS.
You can somewhat DOS high-speed data channels in 3G networks by sending packets with at intervals, but that is limited to single sector in base station, so that is not a big problem either. Battery drain DOS can be a real problem, but that is pretty much solved if you close your browser and your data channel is closed. If you do not have active data connections, nobody can sen you packets.
Again, was it some North-Zimbabwe 3G provider that took hit from 4.5GB data transfer? Last time I checked, it was less than 10 second traffic volume at small-country 3G providers. From "peer-to-peer Web sites".
Is Mobile IP actually widely in use? If so, where is it used and how?
As if all the kids downloading iPhone farting apps wasn't bad enough, now there are DOS attacks to bog down AT&T's network... :-(
working_connection != multicast_traffic + WIFI
Crap! I just kissed my karma good-bye.
Can't send spam to a device that's denied of service - I think I know what's more dangerous.
It's real easy to DOS wireless devices. Its called Continuous Preamble. This has been around for years.
The risk potential of DDoSing cellular networks primarily occurs during a homeland attack. while the scope of the attack is obviously small, theoretically this could be used in conjunction with precision attacks to further prevent help/rescue as needed. otherwise, the value of such an attack is relatively minimal and i'm sure this type of attack can be prevented. these attacks sound mostly like a proof-of-concept.
Wouldn't it be annoying if that is what caused my network to slow to a slug's pace the day after the FIOS guys came to my door and I told them I wasn't planning to give up my copper? When I told them my cable net doesn't slow down when my neighbors are online, because I don't have neighbors online, they didn't quite admit openly that though FIOS doesn't slow down, it starts out slower. They did seem disappointed they had come all that way (unbidden) and didn't sell me their product.
I am curious about the coincidence in timing.
Maybe it is time to close my open wireless. I never had any reason to, before.
you don't have to choose! you can have both!
Limited range, limited risk... At least mobile networks normally require identification of end-nodes. 802.11b is at limited risk to a DoS attack, because there are a limited number of people in an area, and you would have some idea of who is responsible....
By the way, certain vendors have "Rogue Access Point" Containment functions which are essentially a DDoS attack; WCS which plays man-in-the-middle attack against a target AP, and uses N APs to send disassociate and deregister commands to clients of a target AP.
Or at level 4 containment, can play a game called flood-the-"rogue"-AP-with-fake-clients, i.e. spamming it with associate/de-associates....