Slashdot Mirror
MIT Researchers Defend Against Wireless Attacks
alphadogg writes "MIT researchers have devised a protocol to flummox man-in-the-middle attacks against wireless networks. The all-software solution lets wireless radios automatically pair without the use of passwords and without relying on out-of-band techniques such as infrared or video channels. Dubbed Tamper-evident pairing, or TEP, the technique is based on understanding how man-in-the-middle attacks tamper with wireless messages, and then detects and in some cases blocks the tampering. The researchers suggest that TEP could have detected the reported but still unconfirmed cellular man-in-the-middle attack that unfolded at the Defcon conference earlier this month in Las Vegas."
Anything a legit user can do a MITM can do better.
This "all-software" solution is either bullshit, or relies on pre-shared keys (be they specific keys or hardware-derived).
Without keys / hardware, there is absolutely nothing a legit user can send out that a MITM can't.
Maybe on a wired connection you'd be right. I'm inclined to think that wireless, doing something to detect tampering could be possible. You probably wouldn't be able to guarantee that you can create a connection at all, but it might be an improvement for some to be able to connect only if tampering can be ruled out with some probability.
Insert self-referential sig here.
They write "TEP begins by analyzing how an attacker mounts a man-in-the-middle exploit: In every case, the researchers say, the attack involves tampering with wireless messages.". But this is wrong - the man in the middle may simply be listening.
I happen to have been following the work of Dina Katabi et al. for quite some time now and I have to admit that it is a very poor summary even for Slashdot. I can assure you that you can understand much more by skipping the summary, skipping the Original Source link and just reading the paper in question. It is a truly revolutionary idea that will soon change the way we perceive the risks in wireless communication.
Karma: Positive (probably because of superiour intellect)
An attacker can tamper with a wireless message in three ways: by altering a message sent by one party to match his own Diffie-Hellman key; by hiding the fact that Party A has sent a message at all; and by blocking a message from being sent. TEP is designed to defang each of these tampering techniques.
It does this by compelling Party A to follow its message transmission with another: a pattern of energy "pulses" and "silences." Party A's wireless radio computes a hash of the original message, creating a sequence of ones and zeros. For each one, the radio sends a random packet; for each zero, it sends nothing -- it's silent. This combined pattern is unique to the original message.
If the attacker alters the contents of Party A's message, he, too, has to follow up with a new "silence pattern" that corresponds to the altered contents. But the two silence patterns will be different: The attacker "cannot generate silence" from Party A's "one bits." Party B can detect that difference and in effect refuse the connection offered by the attacker.
Aha, using the fact that all this comm is occurring in the same collision domain to your advantage against MITM attacks, I wonder if this would actually stand up to scrutiny?
The client can't refuse the connection by the attacker.
The client can only refuse ALL connections when it suspect foul pay (by hearing two shits).
Just as before, it's a race/range condition. Sit at the edge of an AP's range with two radios and people connecting to yours will never even hear the router shouting shit at them as sit in the middle.
AP ---- You ---- Victim
Victim and AP can't hear eachother, and thus have no indication that what you're saying isn't coming from you.
From the article you linked to:
They need to stick to established naming conventions to make their work easier to understand.
The malicious cracker is named "Mallory". Not "Lucifer".
That's a problem. In THEORY, those characteristics exist for ALL wireless packets. If Alice transmits, Bob sees the transmission (if within range). Mallory has to resort to a means of interrupting the transmission or canceling the request or just being the MITM for clients that are at the edge of the wireless coverage area.
The client sees the "lie", and doesn't trust either of the offers because it isn't sure which is real.
Based on this, it's possible to DOS a router by sending out connection offers, but you can't do a MITM attack.
But in that case, you are simply connecting to a compromised router. The fact that that router then connects to *another* router can be ignored.
That problem should be dealt with differently.
Reading the paper, it seems the proposed protocol for key exchange forces a wait time of 17ms, and then hashes the packet to ensure it doesn't get modified (forcing the use of slots and keeping the air open during attack).
The only problem I see is that you could easily use this mechanism to effectively DoS the network by making it wait for the CTS packets constantly while the protocol rejects the bad check-summed packets.
But I guess that's a minor flaw since it's already trivial to DoS wireless networks in general.
Here's to hoping this actually gets widely implemented.
The paper is about wireless pairing, which is a special case.
MITM attacks in general are not entirely invisible. Because the MITM is decrypting and reencrypting the message with a different key, the crypt bits received are different than those which were sent. If you ask "what were the crypto bits you received from bit N to M?", the MITM has to be prepared to intercept that query and formulate a lie. This can be made difficult for the MITM. The early STU-3 encrypted phone sets had a little 2-digit display, and the parties could verify over the voice link that both parties saw the same number. Faking that would require splicing words into a verbal conversation in real time.
It's thus possible to design protocols which require that a MITM tamper with the plaintext merely to listen in. This idea doesn't seem to have been developed enough, at least not in the unclassified community.
Is it really important that this data is unpredictable, or is "random" here used in the meaning of "arbitrary", i.e. it doesn't matter what that data is?
The Tao of math: The numbers you can count are not the real numbers.
But in that case, you are simply connecting to a compromised router. The fact that that router then connects to *another* router can be ignored.
That problem should be dealt with differently.
But shouldn't any solution to that problem also solve the other problem?
The Tao of math: The numbers you can count are not the real numbers.
I read the article, and part of the idea is that noise (radio activity) may contain falsehoods, but that silence (radio silence) is genuine and cannot be spoofed. So you first send out a hash, and then try to establish a series of radio silence periods which, when decoded, match your hash. If anything messes with this authentication, it is obvious, and the connection is refused.
all wireless communication is subject to DOS anyway.
But is it subject to Windows as well? :-)
Yes, in fact. The second page of the article describes CTS (Clear To Send), a way of reserving windows of time for communication.