Advanced Wi-Fi Attacks Using Commodity Hardware Mathy Vanhoef - - PowerPoint PPT Presentation

▶
advanced wi fi attacks using
SMART_READER_LITE
LIVE PREVIEW

Advanced Wi-Fi Attacks Using Commodity Hardware Mathy Vanhoef - - PowerPoint PPT Presentation

Mar 06, 2024 121 likes •887 views

Advanced Wi-Fi Attacks Using Commodity Hardware Mathy Vanhoef @vanhoefm BruCON, Belgium, 3 October 2018 Background Wi-Fi assumes each stations behaves fairly With special hardware we dont have to Continuous jamming: channel

slide-1
SLIDE 1

Advanced Wi-Fi Attacks Using Commodity Hardware

Mathy Vanhoef — @vanhoefm BruCON, Belgium, 3 October 2018

slide-2
SLIDE 2

Background

› Wi-Fi assumes each stations behaves fairly › With special hardware we don’t have to  Continuous jamming: channel unusable Selective jamming: block specific packets

2

slide-3
SLIDE 3

Background

› Wi-Fi assumes each stations behaves fairly › With special hardware we don’t have to  Continuous jamming: channel unusable Selective jamming: block specific packets

3

>$4000

slide-4
SLIDE 4

Research: use cheap hardware?

Small 15$ USB sufficient to: › Testing selfish behavior in practice › Continuous & selective jamming › Enables reliable manipulation of encrypted traffic

4

slide-5
SLIDE 5

Research: use cheap hardware?

Attacks are cheaper than expected! › We should be able to detect them.

5

>$4000 ~$20

slide-6
SLIDE 6

Selfish Behavior

Impact of selfish behavior? Implement & Test!

6

slide-7
SLIDE 7

Selfish Behavior

Steps taken to transmit a frame:

7

In use

slide-8
SLIDE 8

Selfish Behavior

Steps taken to transmit a frame:

  • 1. SIFS: let hardware process the frame

8

In use SIFS

slide-9
SLIDE 9

Selfish Behavior

Steps taken to transmit a frame:

  • 1. SIFS: let hardware process the frame
  • 2. AIFSN: depends on priority of the frame

9

In use SIFS AIFSN

slide-10
SLIDE 10

Selfish Behavior

Steps taken to transmit a frame:

  • 1. SIFS: let hardware process the frame
  • 2. AIFSN: depends on priority of the frame
  • 3. Random backoff: avoid collisions

10

In use SIFS AIFSN Backoff

slide-11
SLIDE 11

Selfish Behavior

Steps taken to transmit a frame:

  • 1. SIFS: let hardware process the frame
  • 2. AIFSN: depends on priority of the frame
  • 3. Random backoff: avoid collisions
  • 4. Send the packet

11

In use SIFS AIFSN Backoff Packet 2

slide-12
SLIDE 12

Selfish Behavior

Steps taken to transmit a frame: Manipulate by modifying Atheros firmware: › Disable backoff › Reducing AIFSN › Reducing SIFS

12

In use SIFS AIFSN Backoff Packet 2

slide-13
SLIDE 13

Selfish Behavior

Steps taken to transmit a frame: Manipulate by modifying Atheros firmware: › Disable backoff › Reducing AIFSN › Reducing SIFS

13

In use SIFS AIFSN Backoff Packet 2 Optimal strategy

From 14 to 37 Mbps

Reduces throughput

slide-14
SLIDE 14

How to control radio chip?

Using memory mapped registers › Disable backoff: int *GBL_IFS_MISC = (int*)0x10F0; *GBL_IFS_MISC |= IGNORE_BACKOFF; › Reset AIFSN and SIFS: int *AR_DLCL_IFS = (int*)0x1040; *AR_DLCL_IFS = 0;

14

slide-15
SLIDE 15

We can’t we just modify the driver?

15

WiFi Dongle

CPU radio chip

Main machine

Userspace Operating System Driver

Code runs on CPU of dongle  Firmware control needed

USB

slide-16
SLIDE 16

Countermeasures

DOMINO defense system reliably detects this selfish behavior [1].

16

slide-17
SLIDE 17

Selfish Behavior

What if there are multiple selfish stations? › In a collision, both frames are lost

17

slide-18
SLIDE 18

Selfish Behavior

What if there are multiple selfish stations? › In a collision, both frames are lost › Capture effect: in a collision, frame with the best signal and lowest bitrate is decoded

Similar to FM radio

Demo: The Queen station generally “wins” the collision with other stations.

18

slide-19
SLIDE 19

FM Radio Demo

19

slide-20
SLIDE 20

Selfish Behavior

Attack can abuse capture effect › Selfish clients will lower their bitrate to beat other selfish stations! › Until this gives no more advantage To increase throughput, bitrate is lowered!  Other station = background noise

20

slide-21
SLIDE 21

Continuous jammer

Want to build a continuous jammer › Instant transmit: disable carrier sense › No interruptions: queue infinite #packets Frames to be transmitted are in a linked list:

21

Frame 1

radio chip

…

Frame 2

slide-22
SLIDE 22

Continuous jammer

Want to build a continuous jammer › Instant transmit: disable carrier sense › No interruptions: queue infinite #packets Frames to be transmitted are in a linked list:

22

Frame 1

radio chip

…

Frame 2 Infinite list!

slide-23
SLIDE 23

Continuous Jammer

Experiments › Only first packet visible in monitor mode! › Other devices are silenced.

23

Default antenna gives range of ~80 meters Amplifier gives range

  • f ~120 meters
slide-24
SLIDE 24

Demo: continuous jammer

Demo: continuous jammer

24

slide-25
SLIDE 25

Rapsberry Pi Supported!

25

slide-26
SLIDE 26

Practical Implications

Devices in 2.4 and 5 GHz band?

26

› Home automation › Industrial control › Internet of Things › …

Can all easily be jammed!

slide-27
SLIDE 27

Practical Implications

Devices in 2.4 and 5 GHz band?

27

slide-28
SLIDE 28

Practical Implications

Devices in 2.4 and 5 GHz band?

28

slide-29
SLIDE 29

Not just wild speculation …

29

$45 Chinese jammer to prevent cars from being locked [4] GPS jammer to disable anti-theft tracking devices in stolen cars [5] Disable mobile phone service after cutting phone and alarm cables [6]

slide-30
SLIDE 30

Selective Jammer

Decides, based on the header, whether to jam the frame

30

slide-31
SLIDE 31

How does it work?

  • 1. Detect and decode header

31

Physical packet

Detect

slide-32
SLIDE 32

How does it work?

  • 1. Detect and decode header
  • 2. Abort receiving current frame

32

Physical packet

Detect Init

slide-33
SLIDE 33

How does it work?

  • 1. Detect and decode header
  • 2. Abort receiving current frame
  • 3. Inject dummy packet

33

Physical packet

Detect Init Jam

slide-34
SLIDE 34

How does it work?

  • 1. Detect and decode header
  • 2. Abort receiving current frame
  • 3. Inject dummy packet

34

Physical packet

Detect Init Jam

Easy

slide-35
SLIDE 35

How does it work?

  • 1. Detect and decode header
  • 2. Abort receiving current frame
  • 3. Inject dummy packet

35

Physical packet

Detect Init Jam

Easy Hard

slide-36
SLIDE 36

Detecting frame headers?

 Can read header of frames still in the air!

36

RAM

DMA

Internal CPU

while(recvbuff[0] == 0): pass

radio chip

Decode physical WiFi signal

slide-37
SLIDE 37

In practice

  • 1. Detect and decode header
  • 2. Abort receiving current frame
  • 3. Inject dummy packet

37

Poll memory until data is being written: Timeout Detect incoming packet

slide-38
SLIDE 38

In practice

  • 1. Detect and decode header
  • 2. Abort receiving current frame
  • 3. Inject dummy packet

38

Probe request or beacon? buff + 10: sender of packet source : target MAC address

slide-39
SLIDE 39

In practice

  • 1. Detect and decode header
  • 2. Abort receiving current frame
  • 3. Inject dummy packet

39

Set specific bit in register

slide-40
SLIDE 40

In practice

  • 1. Detect and decode header
  • 2. Abort receiving current frame
  • 3. Inject dummy packet

40

TXE: Transmit (TX) enable (E) Pointer to dummy packet

slide-41
SLIDE 41

Selective Jammer: Reliability

Jammed beacons with many devices/positions How fast can it react? › Position of first mangled byte? › 1 Mbps beacon in 2.4 GHz: position 52 › 6 Mbps beacon in 5 GHz: position 88 Context: MAC header is 34 bytes

41

slide-42
SLIDE 42

Selective Jammer: Reliability

Jammed beacons with many devices/positions Conclusion › 100% reliable jammer not possible › Medium to large packets can be jammed › Surprising this is possible with a limited API!

42

slide-43
SLIDE 43

Demo: selective jammer

Demo: jammin’ beacons

43

slide-44
SLIDE 44

Code is online (and got updates)

Virtual Machine: github.com/vanhoefm/modwifi

44

slide-45
SLIDE 45

Using your mobile phone

Schulz & co: jamming using mobile phones [9]

45

Nexus 5

+ =

github.com/seemoo-lab/wisec2017_nexmon_jammer

slide-46
SLIDE 46

Impact on higher-layers

46

What if we could reliably manipulate encrypted traffic? We could attack WPA-TKIP

slide-47
SLIDE 47

Impact on higher-layers

47

What if we could reliably manipulate encrypted traffic? We could attack WPA-TKIP We can break WPA2

slide-48
SLIDE 48

Breaking WPA2

48

Key Reinstallation Attacks (KRACKs) › Block & delay handshake frames › Jammers can block packets! › Or help with getting a MitM

slide-49
SLIDE 49

WPA2 uses a 4-way handshake

Used to connect to any protected Wi-Fi network

49

Negotiates fresh PTK: pairwise transient key Mutual authentication

slide-50
SLIDE 50

Channel 1

50

KRACK Attack

Channel 6

Jam AP on channel 6  victim will use channel 1

slide-51
SLIDE 51

51

KRACK Attack

slide-52
SLIDE 52

52

KRACK Attack

PTK = Combine(shared secret, ANonce, SNonce)

slide-53
SLIDE 53

53

KRACK Attack

Block Msg4

slide-54
SLIDE 54

54

KRACK Attack

Block Msg4

slide-55
SLIDE 55

55

KRACK Attack

PTK is installed & nonce set to zero

Block Msg4

slide-56
SLIDE 56

Block Msg4

56

KRACK Attack

slide-57
SLIDE 57

57

KRACK Attack

slide-58
SLIDE 58

58

KRACK Attack

slide-59
SLIDE 59

59

KRACK Attack

In practice Msg4 is sent encrypted

slide-60
SLIDE 60

60

KRACK Attack

slide-61
SLIDE 61

61

KRACK Attack

Key reinstallation: nonce again reset!

slide-62
SLIDE 62

62

KRACK Attack

slide-63
SLIDE 63

63

KRACK Attack

Encrypted data can now be exchanged

slide-64
SLIDE 64

Quick background: encryption

64

Plaintext data

 Nonce reuse implies keystream reuse (in all WPA2 ciphers)

Nonce Mix PTK

(session key)

Nonce

(packet number) Packet key

slide-65
SLIDE 65

65

KRACK Attack

Next frame reuses previous nonce!

slide-66
SLIDE 66

66

KRACK Attack Keystream

slide-67
SLIDE 67

67

KRACK Attack Keystream Decrypted!

slide-68
SLIDE 68

Conclusion

› Jamming is cheap › Selective jamming also possible › Can even use mobile phone! › Facilitates KRACK attacks

68

slide-69
SLIDE 69

Questions?

github.com/vanhoefm/modwifi

Thank you!

slide-70
SLIDE 70

References

1.

  • M. Raya, J.-P. Hubaux, and I. Aad. DOMINO: a system to detect greedy behavior in EEE 802.11 hotspots. In

MobiSys, 2004. 2.

  • M. Vanhoef and F. Piessens. Practical verification of WPA-TKIP vulnerabilities. In ASIACCS, 2013.

3.

  • M. Vanhoef and F. Piessens. Advanced Wi-Fi attacks using commodity hardware. In ACSAC, 2014.

4.

  • C. Cox. Hi-tech car thieves hit the streets with £30 jamming devices bought over the internet. In Manchester

Evening News, 2014. 5.

  • C. Arthur. Car thieves using GPS 'jammers'. In The Guardian, 2010.

6.

  • J. Weiner. High-tech thieves used phone-jammer in $74k sunglass heist, cops say. In Orlando Sentinel, 2011.

7.

  • P. Dandumont. Don’t trust geolocation! Retrieved 5 October, 2015, from journaldulapin.com/2013/08/26/dont-

trust-geolocation/ 8. Gollakota et al. They can hear your heartbeats: non-invasive security for implantable medical devices. In SIGCOMM, 2011. 9. Schulz et al. Massive Reactive Smartphone-Based Jamming using Arbitrary Waveforms and Adaptive Power

  • Control. In WiSec, 2017.
  • 10. M. Vanhoef and F. Piessens. Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2. In ACM CCS, 2017.

70

slide-71
SLIDE 71

Multi-channel MitM also enables other attacks

71

Attacking broadcast TKIP › Block MIC failures › Modify encrypted frames Traffic Analysis › Capture all encrypted frames › Block certain encrypted frames

slide-72
SLIDE 72

Multi-channel MitM also enables other attacks

72

Exploit implementation bugs › Block certain handshake messages › E.g. bugs in 4-way handshake Specialized attack scenarios › E.g. modify advertised capabilities › See [X] for details

slide-73
SLIDE 73
  • 1. Attack Wi-Fi Geolocation

Location determined by nearby SSIDs Geolocation attack [7] › Inject SSIDs of another location › Problem: can only spoof locations with more APs › Solution: selectively jam nearby Aps  Never blindly trust Wi-Fi geolocation!

73

slide-74
SLIDE 74
  • 2. Use as a defense system

Use jamming to protect a network › Selectively jam rouge APs › Wearable shield to protect medical implants that constantly sends jamming signal [8] › … (it’s an active research topic)

74

slide-75
SLIDE 75
  • 2. Use as a defense system

Legal aspects are unclear Blocking personal hotspots: › Done by Marriott and Smart City Holdings › Complaint was filled to the FCC › Settled for fine of $600,000 and $750,000

75

Is blocking malicious or rogue hotspots legal?

slide-76
SLIDE 76

DOMINO defense system

Also capable of detecting selective jammers › Assumes MAC header is still valid › Attacker has low #(corrupted frames) › Thrown of the network Unfortunately it’s flawed › Jammer (corrupted) frames are not authenticated › We can pretend that a client is jamming others

76