Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks最新文献

Countering cross-technology jamming attack 对抗跨技术干扰攻击

Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Pub Date : 2020-07-08 DOI: 10.1145/3395351.3399367

Zicheng Chi, Yan Li, Xin Liu, Wei Wang, Yao Yao, Ting Zhu, Yanchao Zhang

{"title":"Countering cross-technology jamming attack","authors":"Zicheng Chi, Yan Li, Xin Liu, Wei Wang, Yao Yao, Ting Zhu, Yanchao Zhang","doi":"10.1145/3395351.3399367","DOIUrl":"https://doi.org/10.1145/3395351.3399367","url":null,"abstract":"Internet-of-things (IoT) devices are sharing the radio frequency band (e.g., 2.4 GHz ISM band). The exponentially increasing number of IoT devices introduces potential security issues at the gateway in IoT networks. In this paper, we introduce a set of new attacks through concealed jamming - an adversary pretends to be (or compromises) a legitimate WiFi device, then sends out WiFi packets to prevent ZigBee devices' communication or collide with ZigBee's packets. By doing this, concealed jamming has the potential to severely delay the reception of ZigBee packets that may contain important information (e.g., critical health data from wearables, fire alarms, and intrusion alarms). To defend against these attacks, we designed a novel ZigBee data extraction technique that can recover ZigBee data from the ZigBee packets that were collided with WiFi packets. We extensively evaluated our design in different real-world settings. The results show that ZigBee devices (protected by our proposed methods) achieve similar performance as those that are not under the concealed jamming attack. Moreover, compared with unprotected devices, their throughput is more than 15 times higher than the unprotected one that is under concealed jamming attacks.","PeriodicalId":165929,"journal":{"name":"Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks","volume":"55 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-07-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127357451","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 17

Process skew: fingerprinting the process for anomaly detection in industrial control systems 过程偏差:工业控制系统中异常检测过程的指纹识别

Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Pub Date : 2020-07-08 DOI: 10.1145/3395351.3399364

Chuadhry Mujeeb Ahmed, J. Prakash, Rizwan Qadeer, Anand Agrawal, Jianying Zhou

引用次数: 11

Practical operation extraction from electromagnetic leakage for side-channel analysis and reverse engineering 用于边道分析和逆向工程的电磁泄漏实际操作提取

Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Pub Date : 2020-07-08 DOI: 10.1145/3395351.3399362

Pieter Robyns, Mariano Di Martino, Dennis Giese, W. Lamotte, P. Quax, G. Noubir

{"title":"Practical operation extraction from electromagnetic leakage for side-channel analysis and reverse engineering","authors":"Pieter Robyns, Mariano Di Martino, Dennis Giese, W. Lamotte, P. Quax, G. Noubir","doi":"10.1145/3395351.3399362","DOIUrl":"https://doi.org/10.1145/3395351.3399362","url":null,"abstract":"Determining which operations are being executed by a black-box device is an important challenge to tackle in reverse engineering. Furthermore, in order to perform a successful side-channel analysis (SCA) of said operations, their precise timing must be determined. In this paper, we tackle these two challenges in context of an electromagnetic (EM) analysis of a NodeMCU Amica IoT device. More specifically, we propose a convolutional neural network (CNN) architecture that is designed to classify operations performed by the NodeMCU out of a set of 8 possible operations, namely OpenSSL AES, native AES, TinyAES, OpenSSL DES, SHA1-PRF, HMAC-SHA1, SHA1, and SHA1Transform. In addition, we use the same architecture to predict the start and end times of the operation, thereby removing the need for firmware modifications or manual triggers in SCA. Our approach is evaluated using a 66 GB dataset containing 69,632 complex traces of EM leakage, captured with a USRP B210 software defined radio. The best variant of our methodology achieves a classification accuracy of 96.47%, and is able to predict the start and end times of the operation within 34 |is of the ground truth on average. We compare our methodology to classical template matching, and provide our open-source implementation and datasets to the community so that the achieved results can be reproduced.","PeriodicalId":165929,"journal":{"name":"Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks","volume":"66 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-07-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122930420","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

Protecting wi-fi beacons from outsider forgeries 保护wi-fi信标不受外人伪造

Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Pub Date : 2020-07-08 DOI: 10.1145/3395351.3399442

M. Vanhoef, Prasant Adhikari, C. Pöpper

引用次数: 15

AcousticPrint AcousticPrint

Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Pub Date : 2020-07-08 DOI: 10.1145/3395351.3401700

Harini Kolamunna, Junye Li, T. Dahanayaka, Suranga Seneviratne, Kanchana Thilakaratne, Albert Y. Zomaya, Aruna Seneviratne

引用次数: 5

Valkyrie: a generic framework for verifying privacy provisions in wireless networks Valkyrie:在无线网络中验证隐私条款的通用框架

Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Pub Date : 2020-07-08 DOI: 10.1145/3395351.3399340

Guillaume Celosia, M. Cunche

{"title":"Valkyrie: a generic framework for verifying privacy provisions in wireless networks","authors":"Guillaume Celosia, M. Cunche","doi":"10.1145/3395351.3399340","DOIUrl":"https://doi.org/10.1145/3395351.3399340","url":null,"abstract":"Wireless communications integrated in connected devices can expose their users to tracking via the exposure of link layer identifiers (e.g. MAC addresses). To counter this threat, it has been proposed to replace those permanent identifiers with periodically changing random pseudonyms [17]. This practice, called address randomization has been progressively adopted by vendors [28, 36] and has even made its way to wireless standards [1, 35]. However, an effective implementation of address randomization requires more than periodically rotating the link layer identifier. Indeed, several works [8, 11, 12, 16, 27, 28, 36] identified issues with address randomization implementation, where in-frames counters and identifiers can undermine the anti-tracking measure. In this paper, we address the problem of verifying the correctness of an address randomization implementation. To this end, we introduce an approach to identify issues based on a capture of the traffic generated by a device. This approach relies on rules specifying requirements for a correct implementation of address randomization. Then, we prototype Valkyrie (Verification of Addresses LinKabilitY in address Randomization ImplemEntations), a software tool that, based on a set of rules, verifies that a given sequence of frames generated by a device does not compromise the address randomization scheme. Finally, we evaluate this tool on a corpus of frame captures corresponding to 60 devices implementing address randomization for Wi-Fi and Bluetooth Low Energy (BLE).","PeriodicalId":165929,"journal":{"name":"Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks","volume":"39 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-07-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134329081","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

MAVPro MAVPro

Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Pub Date : 2020-07-08 DOI: 10.1145/3395351.3399361

Ala Darabseh, Hoda AlKhzaimi, C. Pöpper

{"title":"MAVPro","authors":"Ala Darabseh, Hoda AlKhzaimi, C. Pöpper","doi":"10.1145/3395351.3399361","DOIUrl":"https://doi.org/10.1145/3395351.3399361","url":null,"abstract":"Automatic Dependent Surveillance Broadcast (ADS-B) centrally contributes to aircraft traffic control in the US and Europe since 2020. ADS-B messages contain information about aircraft location and tracks to provide better real-time traceability of aircraft in space. However, the lack of security mechanisms will be an obstacle for trusting the ADS-B technology. Thus, countermeasures should be integrated to secure the communication and evaluate the integrity and trustworthiness of received messages. In this paper, we design a message verification protocol called MAVPro to evaluate the trustworthiness of received ADS-B messages whose authenticity and integrity could otherwise not be verified. The main idea behind MAVPro is to compare location claims in received ADS-B messages with expected aircraft locations, which are computed using predicted trajectory information (e. g., velocity, elapsed time, aircraft acceleration, heading information) and a set of pre-trusted, continuously updated anchors. Our protocol is able to evaluate the trustworthiness of received messages if as little as one ADS-B receiver obtains a message --- as opposed to four receivers required for using multilateration-based techniques to verify position claims. Thus we are able to considerably extend the coverage area where security checks can be applied compared to existing solutions. We evaluate MAVPro based on real-time data from the OpenSky network, analyze its performance, and verify its applicability to address ADS-B security concerns. MAVPro is backwards compatible and does not require changes to the ADS-B infrastructure.","PeriodicalId":165929,"journal":{"name":"Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks","volume":"252 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-07-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124653497","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

A plug-n-play game theoretic framework for defending against radio window attacks 一个用于防御无线电窗口攻击的即插即用博弈论框架

Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Pub Date : 2020-07-08 DOI: 10.1145/3395351.3399368

Pruthuvi Maheshakya Wijewardena, Aditya Bhaskara, S. Kasera, S. A. Mahmud, Neal Patwari

{"title":"A plug-n-play game theoretic framework for defending against radio window attacks","authors":"Pruthuvi Maheshakya Wijewardena, Aditya Bhaskara, S. Kasera, S. A. Mahmud, Neal Patwari","doi":"10.1145/3395351.3399368","DOIUrl":"https://doi.org/10.1145/3395351.3399368","url":null,"abstract":"The large scale deployment of multi-antenna wireless networks in homes and office buildings introduces new privacy concerns for people residing in these spaces. By measuring the signal strength using receivers placed outside the premises, an attacker can track the movement of people inside. One way to defend against such an attack is to have the signal strengths of the transmitters vary (sometimes reducing to zero) according to some randomized schedule. We show that the question of finding the schedule that minimizes the worst-case \"privacy loss\" can be formulated as a constant-sum Stackelberg game between an attacker, whose goal is to place receivers in order to learn the movement of users, and a defender who tries to prevent the attacker while maintaining the connectivity and QoS requirements of the network. We introduce a flexible framework that enables us to capture the constraints of the attacker and the defender. The framework allows us to capture features of modern wireless systems such as directional antennas and also allows us to plug in different path-loss models with minimal changes to the setup. We then formulate the problem of finding the optimal defender strategy as a linear program and show that it can be solved efficiently. We also perform numerical evaluations on how the payoffs are affected as the requirements of the defender and the resources the attacker can afford to exhaust change.","PeriodicalId":165929,"journal":{"name":"Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks","volume":"749 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-07-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133590549","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

SemperFi SemperFi

Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Pub Date : 2020-07-08 DOI: 10.1145/3395351.3401703

Harshad Sathaye, Aanjhan Ranganathan

{"title":"SemperFi","authors":"Harshad Sathaye, Aanjhan Ranganathan","doi":"10.1145/3395351.3401703","DOIUrl":"https://doi.org/10.1145/3395351.3401703","url":null,"abstract":"With the advent of autonomous cyber-physical systems such as self-driving cars and unmanned aerial vehicles, the use of Global Positioning System (GPS) for positioning and navigation has become ubiquitous. It is well-known that GPS is vulnerable to signal spoofing attacks. There is a need to design and develop a standalone GPS receiver capable of autonomous recovery during a spoofing attack. In this work, we present SemperFi, a single antenna, standalone, GPS receiver that is capable of tracking legitimate GPS satellite signals and estimating the true location even during a spoofing attack. Unlike majority of wireless systems where data contained in the wireless signals is important, GPS relies on the time of arrival of satellite signals. This presents a unique challenge and to address this challenge, SemperFi consists of specially designed algorithms and modules based on successive interference cancellation that are capable of recovering legitimate GPS signals that are overshadowed completely by a powerful adversary. We implement our design using Soft-GNSS and evaluate its performance against a variety of GPS datasets. Our evaluations show that SemperFi can recover from a seamless takeover attack with an accuracy of 100 m and power advantage of an attacker up to 15 dB. SemperFi can also be incorporated as a pluggable module capable of generating a spoofer free GPS signal for processing on any COTS GPS receiver available today. Finally, we release the implementation of our receiver design to the community for further development.","PeriodicalId":165929,"journal":{"name":"Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks","volume":"47 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-07-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116277041","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Unprotected geo-localisation data through ARGOS satellite signals: the risk of cyberpoaching 通过ARGOS卫星信号获得的无保护的地理定位数据:网络偷猎的风险

Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Pub Date : 2020-07-08 DOI: 10.1145/3395351.3401706

J. Finger, Aurélien Francillon

{"title":"Unprotected geo-localisation data through ARGOS satellite signals: the risk of cyberpoaching","authors":"J. Finger, Aurélien Francillon","doi":"10.1145/3395351.3401706","DOIUrl":"https://doi.org/10.1145/3395351.3401706","url":null,"abstract":"Biologists often need to rely on satellite transmitters to obtain otherwise inaccessible data on animal movements. This data is critical for the understanding and conservation of endangered species. In parallel, in the cybersecurity world, satellites have often been found to have low level of security, and transmit unprotected sensitive data. A junction of these two worlds could reveal a potential security breach that would present a real danger to already struggling animals. We have investigated one of the most widespread tracking system, ARGOS, to identify potential attack surfaces, with conservation biology in mind. We first describe ARGOS communications and localization mechanisms, from the transmitters to the reception stations. We identify the main threat model as being the possibility to decode the communications. Then, we mention tools already publicly available to receive and reverse-engineer the ARGOS signal. Intercepting this data could greatly facilitate the localization of protected animals for poachers. Then, we briefly discuss two other potential attacks (jamming and injection) that should be further considered. We finally discuss potential solutions to prevent these attacks. It is troubling that by tracking endangered animals for conservation efforts, security issues in the design of the trackers reveals their location and makes them easy prey for poachers.","PeriodicalId":165929,"journal":{"name":"Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks","volume":"80 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-07-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125573000","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0