Slashdot Mirror
MIT Researchers Defend Against Wireless Attacks
alphadogg writes "MIT researchers have devised a protocol to flummox man-in-the-middle attacks against wireless networks. The all-software solution lets wireless radios automatically pair without the use of passwords and without relying on out-of-band techniques such as infrared or video channels. Dubbed Tamper-evident pairing, or TEP, the technique is based on understanding how man-in-the-middle attacks tamper with wireless messages, and then detects and in some cases blocks the tampering. The researchers suggest that TEP could have detected the reported but still unconfirmed cellular man-in-the-middle attack that unfolded at the Defcon conference earlier this month in Las Vegas."
Nice name.
Anything a legit user can do a MITM can do better.
This "all-software" solution is either bullshit, or relies on pre-shared keys (be they specific keys or hardware-derived).
Without keys / hardware, there is absolutely nothing a legit user can send out that a MITM can't.
Maybe on a wired connection you'd be right. I'm inclined to think that wireless, doing something to detect tampering could be possible. You probably wouldn't be able to guarantee that you can create a connection at all, but it might be an improvement for some to be able to connect only if tampering can be ruled out with some probability.
Insert self-referential sig here.
They write "TEP begins by analyzing how an attacker mounts a man-in-the-middle exploit: In every case, the researchers say, the attack involves tampering with wireless messages.". But this is wrong - the man in the middle may simply be listening.
I happen to have been following the work of Dina Katabi et al. for quite some time now and I have to admit that it is a very poor summary even for Slashdot. I can assure you that you can understand much more by skipping the summary, skipping the Original Source link and just reading the paper in question. It is a truly revolutionary idea that will soon change the way we perceive the risks in wireless communication.
Karma: Positive (probably because of superiour intellect)
An attacker can tamper with a wireless message in three ways: by altering a message sent by one party to match his own Diffie-Hellman key; by hiding the fact that Party A has sent a message at all; and by blocking a message from being sent. TEP is designed to defang each of these tampering techniques. It does this by compelling Party A to follow its message transmission with another: a pattern of energy "pulses" and "silences." Party A's wireless radio computes a hash of the original message, creating a sequence of ones and zeros. For each one, the radio sends a random packet; for each zero, it sends nothing -- it's silent. This combined pattern is unique to the original message. If the attacker alters the contents of Party A's message, he, too, has to follow up with a new "silence pattern" that corresponds to the altered contents. But the two silence patterns will be different: The attacker "cannot generate silence" from Party A's "one bits." Party B can detect that difference and in effect refuse the connection offered by the attacker.
Aha, using the fact that all this comm is occurring in the same collision domain to your advantage against MITM attacks, I wonder if this would actually stand up to scrutiny?
From the article you linked to:
They need to stick to established naming conventions to make their work easier to understand.
The malicious cracker is named "Mallory". Not "Lucifer".
That's a problem. In THEORY, those characteristics exist for ALL wireless packets. If Alice transmits, Bob sees the transmission (if within range). Mallory has to resort to a means of interrupting the transmission or canceling the request or just being the MITM for clients that are at the edge of the wireless coverage area.
The client sees the "lie", and doesn't trust either of the offers because it isn't sure which is real.
Based on this, it's possible to DOS a router by sending out connection offers, but you can't do a MITM attack.
ARP cache poisoning is a standard MITM attack that seems to be resistant to TEA packets. The MITM appears to Bob as the router. Why therefore would Alice hear Bob? The kind of MITm attacks discussed in the paper all refer to drowning out bob's signal with lucifer's so alice cant hear bob. This would make sense on a nonswitched network (like a hub) or an analog network (like radio). Since Wifi is a switched network (as most are nowadays) packets from Bob are addressed to the MITM mac address (as specified in the arp).
There is however, a timing discrepancy that can be used to defeat MITM attacks.It was demonstrated at defcon 19 on cellular network
http://seclists.org/fulldisclosure/2011/Aug/92
they said:
"as for bandwidth, you can often observe a MitM via bandwidth. in this
case a normal link has good download and roughly half that or less in
upload. this is because the towers have a harder time hearing your
relatively quiet radio in your phone while you phone can hear the
towers perfectly fine.
a middle will reverse this characteristic unless proper attention to
traffic shaping / capacity is applied. notably indicative is a twice
over fast upload or more. this occurs when the middle is caching
incoming traffic prior to analysis, mangling, and forwarding."
In fact, there is a LOT more to be gained by doing MITM on cell phones- that traffic is not encrypted (unlike ssl), it's more timely, and usually, more important and urgent.
This is just the principle of latency examination
(explained here
http://en.wikipedia.org/wiki/Man-in-the-middle_attack)
and should be implementable on wifi networks.
Reading the paper, it seems the proposed protocol for key exchange forces a wait time of 17ms, and then hashes the packet to ensure it doesn't get modified (forcing the use of slots and keeping the air open during attack).
The only problem I see is that you could easily use this mechanism to effectively DoS the network by making it wait for the CTS packets constantly while the protocol rejects the bad check-summed packets.
But I guess that's a minor flaw since it's already trivial to DoS wireless networks in general.
Here's to hoping this actually gets widely implemented.
Anectdotally I flipped between over a dozen Microcells in the Rio on my iphone, was presented with a plethora of examples on individual Androids of prompts to accept or hit ok on "certificates" being presented without user input.
It's not even a question, the only question really is how much of it was really going on.
The paper is about wireless pairing, which is a special case.
MITM attacks in general are not entirely invisible. Because the MITM is decrypting and reencrypting the message with a different key, the crypt bits received are different than those which were sent. If you ask "what were the crypto bits you received from bit N to M?", the MITM has to be prepared to intercept that query and formulate a lie. This can be made difficult for the MITM. The early STU-3 encrypted phone sets had a little 2-digit display, and the parties could verify over the voice link that both parties saw the same number. Faking that would require splicing words into a verbal conversation in real time.
It's thus possible to design protocols which require that a MITM tamper with the plaintext merely to listen in. This idea doesn't seem to have been developed enough, at least not in the unclassified community.
Is it just me, or is nobody else suspicious of the wasted random data?
The article mentions that the device should send "random" data for an on and silence for an off. I may not be an expert, but isn't that just wasting useful entropy that might be useable to figure out how the device is generating it's randomness (which no doubt probably sucks at generating it to begin with).
Anyways, just seems like giving you protection from one attack, and secretly exposing you to another.
I read the article, and part of the idea is that noise (radio activity) may contain falsehoods, but that silence (radio silence) is genuine and cannot be spoofed. So you first send out a hash, and then try to establish a series of radio silence periods which, when decoded, match your hash. If anything messes with this authentication, it is obvious, and the connection is refused.
all wireless communication is subject to DOS anyway.
But is it subject to Windows as well? :-)
Yes, in fact. The second page of the article describes CTS (Clear To Send), a way of reserving windows of time for communication.
as long as someone is in between two or more signals it can become subject to intruders the safest route is to go wired, even then wire tapping is possible. Also wire transmission is more reliable and faster, turn the wifi radio off unless absolutly needed at that time.