Design, Implementation, and Evaluation of Secure Cyber-Physical and - - PowerPoint PPT Presentation

▶
design implementation and evaluation of secure cyber
SMART_READER_LITE
LIVE PREVIEW

Design, Implementation, and Evaluation of Secure Cyber-Physical and - - PowerPoint PPT Presentation

Jun 18, 2023 334 likes •1.12k views

PhD Thesis Defense 2019 @ SUTD Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems Daniele Antonioli Singapore University of Technology and Design (SUTD) Daniele Antonioli Design, Implementation, and Evaluation

slide-1
SLIDE 1

PhD Thesis Defense 2019 @ SUTD

Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems

Daniele Antonioli Singapore University of Technology and Design (SUTD)

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems 1

slide-2
SLIDE 2

Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems

  • Thesis’s structure

◮ Part I: Cyber-physical systems security (Chapter 1-5) ◮ Part II: Wireless systems security (Chapter 6-10) ◮ TL;DR: Read sections 1.3 and 6.3

  • Main collaborations

◮ SUTD (P

. Szalachowski), University of Oxford (K. Rasmussen), and CISPA (N. O. Tippenhauer)

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems Introduction 2

slide-3
SLIDE 3

Cyber-Physical Systems (CPS)

  • Interconnected devices managing a physical process

◮ Information technology (IT) ◮ Operational technology (OT)

Sensor 42.42

Sensors Actuators

Sensor 42.42

Sensors Actuators

Sensor 42.42

Sensors Actuators

L1 Network HMI Switch

HMI

SCADA

Remote IO

PLC1a PLC1b

PLC PLC

L0 Network RIO Process 1

Remote IO PLC PLC

L0 Network RIO Process 2

Remote IO PLC PLC

L0 Network RIO Process n

... ...

PLC2a PLC2b PLCna PLCnb

HMI

Historian Internet VPN/Gateway

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CPS Security 3

slide-4
SLIDE 4

Cyber-Physical Systems (CPS) Security

  • Securing CPS is paramount, yet challenging

◮ Cyber, physical, and cyber-physical attacks ◮ Wired and wireless connections (to the Internet)

  • High impact attacks on CPS

◮ E.g. Stuxnet (nuclear), BlackEnergy (smart grid), TRISIS/TRITON (safety) Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CPS Security 4

slide-5
SLIDE 5

CPS Security Challenges and Research Questions

  • C1: Evaluation of CPS (IT and OT) technologies

◮ Q1: Can we build a low-cost real-time simulation environment for CPS? [CPS-SPC15]

  • C2: Cyber-physical attacks

◮ Q2: Can we detect and mitigate cyber-physical attacks? [CPS-SPC16]

  • C3: CPS security education

◮ Q3: Can we fill the gaps between IT and OT security professionals? [CPS-SPC17] Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CPS Security 5

slide-6
SLIDE 6

MiniCPS: A toolkit for security research on CPS networks [CPS-SPC15]

  • Q1: Can we build a low-cost real-time simulation environment for CPS?

(C)yber − → Network Emulation (P)hysical − → Physical Layer Simulation and API (S)ystem − → Simulation of Control Devices

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CPS Security 6

slide-7
SLIDE 7

MiniCPS: A toolkit for security research on CPS networks [CPS-SPC15]

  • Q1: Can we build a low-cost real-time simulation environment for CPS?

(C)yber − → Network Emulation (P)hysical − → Physical Layer Simulation and API (S)ystem − → Simulation of Control Devices

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CPS Security 6

slide-8
SLIDE 8

Towards high-interaction virtual ICS honeypots-in-a-box [CPS-SPC16]

  • Q2: Can we detect and mitigate cyber-physical attacks?

High-Interaction virtual honeypot Real ICS/SCADA system SI S Simulated PLC Simulated HMI Attacker Gateway PLC HMI

PLC

Gateway ICS network SSH T elnet Device Gateway SSH T elnet Device VPN

PLC

Internet Emulated network VPN Physical Process Simulation Physical Process

High Interaction − → Simulate physical process and ICS devices Virtual − → Linux container virtualization In–a-box − → Runs on a single Linux kernel

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CPS Security 7

slide-9
SLIDE 9

Towards high-interaction virtual ICS honeypots-in-a-box [CPS-SPC16]

  • Q2: Can we detect and mitigate cyber-physical attacks?

SDN Controller Switch Physical Process Simulation Physical Layer API

Gateway 192.168.1.77

Attacker Internet Attacker Internet

Device 192.168.1.76 PLC4 192.168.1.40

VPN VPN SSH T elnet SSH T elnet

PLC3 192.168.1.30 PLC2 192.168.1.20 PLC1 192.168.1.10 HMI 192.168.1.100

EtherNet/IP High-Interaction virtual honeypot

High Interaction − → Simulate physical process and ICS devices Virtual − → Linux container virtualization In–a-box − → Runs on a single Linux kernel

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CPS Security 7

slide-10
SLIDE 10

Gamifying ICS Security Training and Research: Design, Implementation, and Results of S3 [CPS-SPC17]

  • Q3: Can we fill the gaps between IT and OT security professionals?
  • SWaT Security Showdown (S3) contest

◮ ICS-centric, gamified security competition ◮ We run it at SUTD in 2016 and 2017 ◮ IT and OT security professionals from academia and industry

  • MiniCPS based security challenges

◮ Evaluate MiniCPS as an educational tool ◮ E.g. MitM attacks, sensor and actuator manipulations

  • Main outcomes

◮ Conducted (novel) attacks ◮ Evaluated (novel) defenses Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CPS Security 8

slide-11
SLIDE 11

CPS includes Wireless Communication Systems

  • Wireless systems (thesis’s Part II)

◮ Transmission and reception of electro-magnetic (EM) signals ◮ Over a wireless physical layer (e.g. over the air)

  • Pervasive use cases

◮ Mobile communications: Wi-Fi, Bluetooth, and cellular ◮ Localization: GPS and RFID Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems Wireless Security 9

slide-12
SLIDE 12

Wireless Systems Security

  • Wireless systems security is important, yet hard

◮ Wireless channel is broadcast ◮ Threats: eavesdropping, jamming, etc.

  • Recent high impact attacks

◮ Wi-Fi: Key Reinstallation AttaCK (KRACK) on WPA2 ◮ Bluetooth: BlueBorne implementation flaws on Android and Linux Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems Wireless Security 10

slide-13
SLIDE 13

Our Wireless Security Challenges and Research Questions

  • C1: Wireless physical layer as a defense mechanism

◮ Q1: Can we leverage deployed physical layer features to secure communications?

[CANS17]

  • C2: Complexity and accessibility of wireless technologies

◮ Q2: Can we analyze and evaluate (proprietary) wireless technologies? [NDSS19]

  • C3: Security evaluations and hardening of wireless technologies

◮ Q3: Can we harden already deployed technologies? [USEC19] Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems Wireless Security 11

slide-14
SLIDE 14

Our Wireless Security Challenges and Research Questions

  • C1: Wireless physical layer as a defense mechanism

◮ Q1: Can we leverage deployed physical layer features to secure communications?

[CANS17]

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems Wireless Security 11

slide-15
SLIDE 15

C1: Wireless physical layer as a defense mechanism

  • Physical layer (PHY)

◮ From bits to EM signals and vice versa

  • Wireless PHY security

◮ Security guarantees from some physical layer features ◮ E.g. beamforming

  • Q1: Can we leverage deployed physical layer features to secure communications?

◮ Practical Evaluation of Passive COTS Eavesdropping in 802.11b/n/ac WLAN [CANS17] Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CANS17 - Motivation 12

slide-16
SLIDE 16

Practical Evaluation of Passive COTS Eavesdropping in 802.11b/n/ac WLAN [CANS17]

  • IEEE 802.11 PHY features

◮ 802.11b: single antenna, omnidirectional (SISO) ◮ 802.11n/ac: multiple antenna, beamforming (MIMO)

  • Threat model

◮ Alice (access point) communicates with Bob (user) ◮ Eve (attacker) wants to eavesdrop the downlink from Alice to Bob

  • Is Eve affected by 802.11n/ac PHY features compared to 802.11b?

◮ If yes, we should use it (together with crypto) Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CANS17 - Introduction 13

slide-17
SLIDE 17

802.11b Downlink (SISO, omnidirectional)

  • 802.11b

◮ Alice uses 1 antennas ◮ Eve’s eavesdropping success depends on: dAE Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CANS17 - Introduction 14

slide-18
SLIDE 18

802.11n/ac Downlink (MISO, beamforming)

  • 802.11n/ac

◮ Alice uses L antennas to dynamically beamform towards Bob ◮ Bob experiences a gain but Eve does not ◮ Eve’s eavesdropping success depends on: dAE, dBE, and L Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CANS17 - Introduction 15

slide-19
SLIDE 19

Metrics

  • Signal-to-Noise-Ratio (SNR)

◮ Power of the useful signal divided by the noise power at the receiver ◮ Usually expressed in dB (10 log10 SNR = SNRdB)

  • Bit-Error-Rate (BER)

◮ Probability of erroneously decoding 1-bit at the receiver ◮ Not an exact quantity (MCS, fading model) ◮ 10−6 considered reasonable

  • Packet-Error-Rate (PER)

◮ PER = 1 − (1 − BER)N ◮ N is the average packet size in bits Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CANS17 - Introduction 16

slide-20
SLIDE 20

Predictions and Experiments

  • 802.11n/ac (beamforming) vs. 802.11b (omnidirectional)

◮ Eve targets the downlink from Alice to Bob ◮ Is Eve affected by n/ac PHY features?

  • Predictions (numerical analysis)

◮ Eve’s SNR disadvantage in b vs. n/ac ◮ Eve’s PER disadvantage compared to Bob in n/ac

  • Experiments (COTS devices)

◮ Measure PER and SNR of Eve and Bob ◮ Compare the results with predictions Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CANS17 - Introduction 17

slide-21
SLIDE 21

Wireless Path Loss Models

  • Path loss model

◮ Parametric simulation ot wireless links (indoor, outdoor) ◮ dBP is the breakpoint distance ◮ σSF is the shadowing std dev (log-normal) ◮ sPL LOS and NLOS path loss slopes

  • Model B: Residential (intra-room)

◮ dBP = 5 m ◮ σSF = 3, 4 dB ◮ sPL = 2, 3.5

  • Model D: Office (large conference room)

◮ dBP = 10 m ◮ σSF = 3, 5 dB ◮ sPL = 2, 3.5 Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CANS17 - Analysis 18

slide-22
SLIDE 22

Model B (Residential) Expected PER

20 40 60 80 100 120 140

Distance from Alice d [m]

0.0 0.2 0.4 0.6 0.8 1.0

Expected PER

PER = 50% Eve Bob (L=2) Bob (L=4)

  • PER of Eve, Bob(L=2) and Bob(L=4) in 802.11n (BPSK)

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CANS17 - Analysis 19

slide-23
SLIDE 23

Model B (Residential) Expected PER

20 40 60 80 100 120 140

Distance from Alice d [m]

0.0 0.2 0.4 0.6 0.8 1.0

Expected PER 12.5 m: Eve’s PER = 0.5 20 m: Eve’s PER = 0.98, Bob’s PER = 0 129.5 m from Eve: Bob’s PER 0.5

PER = 50% Eve Bob (L=2) Bob (L=4)

  • PER of Eve, Bob(L=2) and Bob(L=4) in 802.11n (BPSK)

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CANS17 - Analysis 19

slide-24
SLIDE 24

Experimental Office Layout (NLOS)

~2.5 m

  • Alice, Bob, and Eve locations

◮ dAB = 2 m ◮

dAE = [2.5, 5.0, . . . , 20] m (8 distances)

◮ ∆dAE = 2.5 m ◮ Constant angle and elevation ◮ NLOS (exploit multipath) Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CANS17 - Evaluation 20

slide-25
SLIDE 25

Experimental Setup: Traffic and Metrics

  • UDP packets from Alice to Bob (targeted by Eve)

◮ Wireshark running on Alice, Eve, and Bob ◮ 30 repetitions per distance (2.5 m, 5.0 m, . . . , 20 m)

  • SNR measurements

◮ Received Signal Strength Indication (RSSI) and noise floor ◮ From radiotap headers

  • PER measurements

◮ From incorrect UDP checksums ◮ Over the total number of packet sent Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CANS17 - Evaluation 21

slide-26
SLIDE 26

Eve’s Measured PER vs. Model D (Office)

2.5 5.0 7.5 10.0 12.5 15.0 17.5 20.0

dAE [m]

20 40 60 80 100

Eve’s PER %

Model D prediction 802.11b Model D prediction 802.11n Model D prediction 802.11ac Measured values 802.11b Measured values 802.11n Measured values 802.11ac

  • Eve’s PER is increasing among 802.11b/n/ac

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CANS17 - Evaluation 22

slide-27
SLIDE 27

Conclusions about 802.11 Eavesdropping

  • Q1: Can we leverage deployed physical layer features to secure communications?

◮ Yes, 802.11n/ac PHY features disadvantage an eavesdropper

  • Predicted 802.11n/ac disadvantages for Eve

◮ SNR is bounded by 6-41 dB ◮ PER increases to 98% when dAE > 20 m ◮ Eve has to be 129.5 m closer to get same performance as Bob

  • Experimental results about Eve

◮ PER increases significantly when dAE > 15 m ◮ PER is 20% higher in 802.11n than in 802.11b ◮ PER is 30% higher in 802.11ac than in 802.11b Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems CANS17 - Conclusions 23

slide-28
SLIDE 28

Our Wireless Security Challenges and Research Questions

  • C1: Wireless physical layer as a defense mechanism

◮ Q1: Can we use physical layer features to build security mechanisms? [CANS17]

  • C2: Complexity and accessibility of wireless technologies

◮ Q2: Can we analyze and evaluate (proprietary) wireless technologies? [NDSS19]

  • C3: Security evaluations and hardening of wireless technologies

◮ Q3: Can we harden already deployed technologies? [USEC19] Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Motivation 24

slide-29
SLIDE 29

Our Wireless Security Challenges and Research Questions

  • C2: Complexity and accessibility of wireless technologies

◮ Q2: Can we analyze and evaluate (proprietary) wireless technologies? [NDSS19] Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Motivation 24

slide-30
SLIDE 30

C2: Complexity and accessibility of wireless technologies

  • Wireless technologies are complex

◮ Specifications have amendments (revisions) ◮ Different implementations of a specification

  • Wireless technologies are difficult to access

◮ Proprietary specifications ◮ Closed-source implementations

  • Q2: Can we analyze and evaluate (proprietary) wireless technologies?

◮ Nearby Threats: Reversing, Analyzing, and Attacking Google’s ‘Nearby Connections’ on

Android [NDSS19]

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Motivation 25

slide-31
SLIDE 31

Nearby Threats: Reversing, Analyzing, and Attacking Google’s ‘Nearby Connections’ on Android [NDSS19]

  • Nearby Connections

◮ API for Android and Android Things ◮ In-app proximity-based services

  • Implemented in the Google Play Services

◮ Available across different Android versions ◮ Applications use it as a shared library Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Introduction 26

slide-32
SLIDE 32

Why Analyzing Nearby Connections?

  • Wide attack surface

◮ Any Android (version ≥ 4.0) and Android Things device ◮ Uses Bluetooth and Wi-Fi (even at the same time)

  • Proprietary technology

◮ No public specifications ◮ Implementation is closed-source and obfuscated Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Introduction 27

slide-33
SLIDE 33

Our Core Contributions

  • First (security) analysis of Nearby Connections

◮ Uncovers its proprietary mechanisms and protocols ◮ Based on reversing its Android implementation

  • Re-implementation of Nearby Connections (REarby)

◮ Exposes parameters not accessible with the official API ◮ Impersonates nearby devices from any application

  • Attacking Nearby Connections on Android

◮ Connection manipulation and range extension attacks ◮ Responsible disclosure with Google Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Introduction 28

slide-34
SLIDE 34

Nearby Connections Public Information

  • The server advertises a service (sid) and the client discovers it
  • Two connection strategies: P2P_STAR and P2P_CLUSTER

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Background 29

slide-35
SLIDE 35

Nearby Connections Public Information 2

  • Automatic connection using Bluetooth and/or Wi-Fi
  • Node exchanges encrypted payloads (peer-to-peer)

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Background 30

slide-36
SLIDE 36

Our Dynamic Binary Instrumentation

  • Workhorse: Frida, https://www.frida.re

◮ Profiling of processes, e.g. NC-App, NC-GPS ◮ Hook function and methods calls ◮ Override parameters and return values ◮ Read and write processes’ memory Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Setup 31

slide-37
SLIDE 37

Reversed Phases of a Nearby Connection

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - RE 32

slide-38
SLIDE 38

Reversed Phases of a Nearby Connection

1 Discovery: Bluetooth name (BR/EDR) and BLE reports

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - RE 32

slide-39
SLIDE 39

Reversed Phases of a Nearby Connection

1 Discovery: Bluetooth name (BR/EDR) and BLE reports 2 Connection Request: automatic over Bluetooth, not authenticated

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - RE 32

slide-40
SLIDE 40

Reversed Phases of a Nearby Connection

1 Discovery: Bluetooth name (BR/EDR) and BLE reports 2 Connection Request: automatic over Bluetooth, not authenticated 3 Key Exchange Protocol: Establishment of a shared secret

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - RE 32

slide-41
SLIDE 41

Reversed Phases of a Nearby Connection

1 Discovery: Bluetooth name (BR/EDR) and BLE reports 2 Connection Request: automatic over Bluetooth, not authenticated 3 Key Exchange Protocol: Establishment of a shared secret 4 Optional Authentication: Based on the shared secret

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - RE 32

slide-42
SLIDE 42

Reversed Phases of a Nearby Connection

1 Discovery: Bluetooth name (BR/EDR) and BLE reports 2 Connection Request: automatic over Bluetooth, not authenticated 3 Key Exchange Protocol: Establishment of a shared secret 4 Optional Authentication: Based on the shared secret 5 Application Layer Connection Establishment: Interactive

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - RE 32

slide-43
SLIDE 43

Reversed Phases of a Nearby Connection

1 Discovery: Bluetooth name (BR/EDR) and BLE reports 2 Connection Request: automatic over Bluetooth, not authenticated 3 Key Exchange Protocol: Establishment of a shared secret 4 Optional Authentication: Based on the shared secret 5 Application Layer Connection Establishment: Interactive 6 Key Derivation Functions: Session, AES and HMAC keys

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - RE 32

slide-44
SLIDE 44

Reversed Phases of a Nearby Connection

1 Discovery: Bluetooth name (BR/EDR) and BLE reports 2 Connection Request: automatic over Bluetooth, not authenticated 3 Key Exchange Protocol: Establishment of a shared secret 4 Optional Authentication: Based on the shared secret 5 Application Layer Connection Establishment: Interactive 6 Key Derivation Functions: Session, AES and HMAC keys 7 Optional Physical Layer Switch: Bluetooth to Wi-Fi

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - RE 32

slide-45
SLIDE 45

Reversed Phases of a Nearby Connection

1 Discovery: Bluetooth name (BR/EDR) and BLE reports 2 Connection Request: automatic over Bluetooth, not authenticated 3 Key Exchange Protocol: Establishment of a shared secret 4 Optional Authentication: Based on the shared secret 5 Application Layer Connection Establishment: Interactive 6 Key Derivation Functions: Session, AES and HMAC keys 7 Optional Physical Layer Switch: Bluetooth to Wi-Fi 8 Exchange Encrypted Payloads: Proximity-based service

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - RE 32

slide-46
SLIDE 46

Reversed Phases of a Nearby Connection

1 Discovery: Bluetooth name (BR/EDR) and BLE reports 2 Connection Request: automatic over Bluetooth, not authenticated 3 Key Exchange Protocol: Establishment of a shared secret 4 Optional Authentication: Based on the shared secret 5 Application Layer Connection Establishment: Interactive 6 Key Derivation Functions: Session, AES and HMAC keys 7 Optional Physical Layer Switch: Bluetooth to Wi-Fi 8 Exchange Encrypted Payloads: Proximity-based service 9 Disconnection: automatic after a 30 seconds timeout

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - RE 32

slide-47
SLIDE 47

Key Exchange Protocol (KEP)

Client C Server S Generate skC, pkC Pick NC cC = Hash(pkC) Generate skS, pkS Pick NS Kep1: 1, endpointId, ncname, version Kep2: 2, NC, cC, algo Kep3: 3, NS, pkS Kep4: 4, pkC Verify cC (Sx, Sy) = skS · pkC (Sx, Sy) = skC · pkS

  • Based on ECDH, NIST P256 curve, shared secret is Sx

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - RE 33

slide-48
SLIDE 48

Optional Physical Layer Switch

  • Bluetooth to soft access point (Wi-Fi Direct, hostapd)

◮ Server instructs the client over Bluetooth (e.g. ESSID, password) ◮ Client contacts the server over Wi-Fi Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - RE 34

slide-49
SLIDE 49

Range Extension MitM Attack

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Attacks 35

slide-50
SLIDE 50

Range Extension MitM Attack

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Attacks 36

slide-51
SLIDE 51

Soft Access Point Manipulation Attack

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Attacks 37

slide-52
SLIDE 52

Victim Connects to Attacker’s REarby Server

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Attacks 38

slide-53
SLIDE 53

Attacker Manipulates Bluetooth to Wi-Fi Switch

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Attacks 39

slide-54
SLIDE 54

Victim Connects to Attacker’s Wi-Fi AP

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Attacks 40

slide-55
SLIDE 55

Attacker Configures Victim’s Network Interface

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Attacks 41

slide-56
SLIDE 56

Attacker Eavesdrops All Wi-Fi Traffic

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Attacks 42

slide-57
SLIDE 57

Conclusions about Nearby Connections

  • Q2: Can we analyze and evaluate (proprietary) wireless technologies?

◮ Yes, and they should not use security through obscurity.

  • First security analysis of Nearby Connections

◮ Android and Android Things API for proximity-based services

  • Reversed its Android implementation and re-implemented it

◮ REarby https://francozappa.github.io/project/rearby/

  • Demonstrate attacks and proposed countermeasures

◮ Range extension MitM: authenticate nodes and check proximity ◮ Soft access point manipulation: authenticate nodes Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems NDSS19 - Conclusions 43

slide-58
SLIDE 58

Conclusion and Q&A

  • CPS security contributions (Thesis Part I, Chapter 1-5)

◮ C1: Evaluation of CPS (IT and OT) technologies

  • MiniCPS: A toolkit for security research on CPS networks [CPS-SPC15]
  • Legacy-Compliant Data Authentication for Industrial Control System Traffic [ACNS17]

◮ C2: Cyber-physical attacks

  • Towards high-interaction virtual ICS honeypots-in-a-box [CPS-SPC16]
  • State-Aware Anomaly Detection for Industrial Control Systems [SAC18]

◮ C3: CPS security education

  • Gamifying ICS Security Training and Research: Design, Implementation, and Results of S3

[CPS-SPC17]

  • Wireless systems security contributions (Thesis Part II, Chapter 6-10)

◮ C1: Wireless physical layer as a defense mechanism

  • Practical Evaluation of Passive COTS Eavesdropping in 802.11b/n/ac WLAN [CANS17]

◮ C2: Complexity and accessibility of wireless technologies

  • Nearby Threats: Reversing, Analyzing, and Attacking Google’s ‘Nearby Connections’ on

Android [NDSS19]

◮ C3: Security evaluations and hardening of wireless technologies

  • The KNOB is broken: Exploiting low entropy in the encryption key negotiation of Bluetooth

BR/EDR [USEC19]

Thanks for your time! Questions? More at: https://francozappa.github.io

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems Conclusions 44

slide-59
SLIDE 59

Our Wireless Security Challenges and Research Questions

  • C1: Wireless physical layer as a defense mechanism

◮ Q1: Can we leverage deployed physical layer features to secure communications?

[CANS17]

  • C2: Complexity and accessibility of wireless technologies

◮ Q2: Can we analyze and evaluate (proprietary) wireless technologies? [NDSS19]

  • C3: Security evaluations and hardening of wireless technologies

◮ Q3: Can we harden already deployed technologies? [USEC19] Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Motivation 45

slide-60
SLIDE 60

Our Wireless Security Challenges and Research Questions

  • C3: Security evaluations and hardening of wireless technologies

◮ Q3: Can we harden already deployed technologies? [USEC19] Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Motivation 45

slide-61
SLIDE 61

C3: Security evaluations and hardening of wireless technologies

  • Bluetooth is a pervasive wireless technology

◮ Wide attack surface: IT, mobile, automotive, medical, and industrial

  • Bluetooth security posture

◮ Open specification ◮ Custom security mechanisms ◮ No public reference implementation

  • Q3: Can we evaluate and harden already deployed technologies?

◮ The KNOB is broken: Exploiting low entropy in the encryption key negotiation of

Bluetooth BR/EDR [USEC19]

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Motivation 46

slide-62
SLIDE 62

The KNOB is broken: Exploiting low entropy in the encryption key negotiation of Bluetooth BR/EDR [USEC19]

  • Bluetooth BR/EDR (Basic Rate/Extended Data Rate)

◮ P2P

, master-slave

◮ Better performance, yet less battery life than Bluetooth Low Energy (BLE) Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Motivation 47

slide-63
SLIDE 63

Bluetooth BR/EDR’s Security

  • Bluetooth BR/EDR link layer security guarantees

◮ Confidentiality, integrity, and authentication

  • Secure Simple Paring (SSP), since Bluetooth v2.1

◮ Pairing to generate a link key (long term secret) ◮ ECDH and nonce-based key authentication ◮ Session keys derived from the link key (AES, HMAC)

  • Secure Connections (SC), since Bluetooth v4.1

◮ AES-CCM rather than E0 ◮ P-256 curve rather than P-192 curve Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Background 48

slide-64
SLIDE 64

Key Negotiation of Bluetooth (KNOB)

  • Paired devices share KL and negotiate a new K ′

C per connection

  • Q: What is the smallest yet standard-compliant N?

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 KNOB 49

slide-65
SLIDE 65

KNOB from the Bluetooth core spec v5.0 (page 1650)

“For the encryption algorithm, the key size may vary between 1 and 16 octets (8-128 bits). The size of the encryption key is configurable for two reasons. The first has to do with the many different requirements imposed on cryptographic algorithms in different countries - both with respect to export regulations and

  • fficial attitudes towards privacy in general. The second reason is to facilitate a

future upgrade path for the security without the need of a costly redesign of the algorithms and encryption hardware; increasing the effective key size is the simplest way to combat increased computing power at the opponent side.” https://www.bluetooth.org/DocMan/handlers/DownloadDoc.ashx?doc_ id=421043

  • Q: How hard is to decrease the key size (entropy) to 1 Byte?

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 KNOB 50

slide-66
SLIDE 66

Our Contribution: the KNOB Attack

  • How hard is to adversarially set N=1 (break the KNOB)?
  • Well, we demonstrated that the KNOB is broken

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 KNOB 51

slide-67
SLIDE 67

Threat Model

  • Alice (master) establishes a secure Bluetooth connection with Bob (slave)

◮ Victims already performed pairing (they share KL) ◮ Link layer is encrypted (using K ′

C)

  • Charlie (attacker)

◮ In range with the Alice and Bob ◮ Wants to eavesdrop and manipulate the victims’s information Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 KNOB 52

slide-68
SLIDE 68

KNOB Attack Stages

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 KNOB 53

slide-69
SLIDE 69

Entropy Negotiation is Not Integrity Protected

  • Devices negotiate N, between 1 and 16, according to their Lmin and Lmax

Alice (controller) A Bob (controller) B LMP: AU RAND LMP: SRES LMP encryption mode req: 1 LMP accept Negot’n LMP K′

C entropy: 16

LMP K′

C entropy: 1

LMP accept LMP start encryption: EN RAND LMP accept Encryption key K′

C has 1 byte of entropy

  • Over the air LMP packets are not integrity protected

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Key Negotiation 54

slide-70
SLIDE 70

Adversarial Entropy Negotiation

  • Charlie (attacker) forces Alice and Bob to negotiate N=1

Alice (controller) A Charlie (attacker) C Bob (controller) B LMP: AU RAND LMP: AU RAND LMP: SRES LMP: SRES LMP encryption mode req: 1 LMP encryption mode req: 1 LMP accept LMP accept Negot’n LMP K′

C entropy: 16

LMP K′

C entropy: 1

LMP accept LMP K′

C entropy: 1

LMP accept LMP start encryption: EN RAND LMP start encryption: EN RAND LMP accept LMP accept Encryption key K′

C has 1 byte of entropy

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Key Negotiation 55

slide-71
SLIDE 71

Brute Forcing the Encryption Key (K ′

C)

  • Alice and Bob

◮ Use an encryption key (K ′

C) with 1 Byte of entropy

◮ K ′

C is one within 256 candidates

  • Charlie

◮ Eavesdrops the ciphertext ◮ Tests the 256 K ′

C candidates against the ciphertext (in parallel)

◮ Use K ′

C to decrypt all packets and inject new packets

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Key Negotiation 56

slide-72
SLIDE 72

Example of a KNOB Attack Scenario

  • Victims: Nexus 5 and Motorola G3 (SSP

, no SC)

  • Attacker: ThinkPad X1 and Ubertooth (Bluetooth sniffer)
  • Attacker decrypts a file exchanged over a secure Bluetooth link (OBEX)

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Key Negotiation 57

slide-73
SLIDE 73

KNOB Attack Evaluation

  • The KNOB attack is at the architectural level

◮ All standard compliant Bluetooth devices are (potentially) vulnerable ◮ Regardless their implementations, SSP

, and SC

  • KNOB Attack Evaluation

◮ We tested all the Bluetooth devices that we had access to Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Evaluation 58

slide-74
SLIDE 74

Vulnerable chips and devices (Bluetooth 5.0, 4.2)

Bluetooth chip Device(s) Vulnerable? Bluetooth Version 5.0 Snapdragon 845 Galaxy S9

  • Snapdragon 835

Pixel 2, OnePlus 5

  • Apple/USI 339S00428

MacBookPro 2018

  • Apple A1865

iPhone X

  • Bluetooth Version 4.2

Intel 8265 ThinkPad X1 6th

  • Intel 7265

ThinkPad X1 3rd

  • Unknown

Sennheiser PXC 550

  • Apple/USI 339S00045

iPad Pro 2

  • BCM43438

RPi 3B, RPi 3B+

  • BCM43602

iMac MMQA2LL/A

  • = Entropy of the encryption key (K ′

C) reduced to 1 Byte

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Evaluation 59

slide-75
SLIDE 75

Vulnerable chips and devices (Bluetooth 4.1 and below)

Bluetooth chip Device(s) Vulnerable? Bluetooth Version 4.1 BCM4339 (CYW4339) Nexus5, iPhone 6

  • Snapdragon 410

Motorola G3

  • Bluetooth Version ≤ 4.0

Snapdragon 800 LG G2

  • Intel Centrino 6205

ThinkPad X230

  • Chicony Unknown

ThinkPad KT-1255

  • Broadcom Unknown

ThinkPad 41U5008

  • Broadcom Unknown

Anker A7721

  • Apple W1

AirPods * = Entropy of the encryption key (K ′

C) reduced to 1 Byte

* = Entropy of the encryption key (K ′

C) reduced to 7 Byte

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Evaluation 60

slide-76
SLIDE 76

Countermeasures for the KNOB Attack

  • Legacy compliant (do not require to change the specification)

◮ Set N to 16 (set Lmin = Lmax = 16) ◮ Check N from the host (OS) upon connection ◮ Security mechanisms on top of the link layer

  • Non legacy compliant

◮ Secure entropy negotiation with KL (ECDH shared secret) ◮ Get rid of the entropy negotiation protocol Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Countermeasures 61

slide-77
SLIDE 77

Conclusion

  • Discovered an architectural vulnerability of Bluetooth BR/EDR

◮ The entropy of any encryption key can be reduced to 1 Byte ◮ All standard compliant devices are (potentially) vulnerable

  • Demonstrated the exploitability of this vulnerability

◮ Key Negotiation Of Bluetooth (KNOB) attack ◮ Evaluated on more than 14 chips (e.g. Intel, Broadcom, Apple, Qualcomm)

  • Provided effective countermeasures (while doing disclosure)

◮ Legacy and non legacy compliant ◮ Today the embargo is over and the KNOB should be fixed

https://github.com/francozappa/knob

  • Thanks for your time! Questions?

Daniele Antonioli Design, Implementation, and Evaluation of Secure Cyber-Physical and Wireless Systems USEC19 Conclusions 62