TC: Small: Active physical layer fingerprinting of 802.11 and 802.15.4 wireless devices

Dartmouth College, Hanover NH

Investigators

Abstract

From the ?smart grid? to healthcare to national security systems, wireless devices are playing an increasing role in technological solutions. Their security and trustworthiness should be a major concern. Fingerprinting is an important technique in the cyber-defender arsenal, because it helps expose deceptions essential to modern multi-step network attacks. We develop methods and tools for wireless physical (PHY) layer testing, thus improving trustworthiness of wireless devices and equipping cyber-defenders with the tools they need to protect wireless networks. Active fingerprinting methods are the most direct and effective ones, because they allow the administrators to initiate fingerprinting when necessary, probe for a broader range of expected behaviors (thus increasing the attacker?s workload to fake behaviors in order to escape detection), and are easily tweaked (further increasing said workload). We develop robust fingerprinting techniques for wireless devices that are based on active probing -- in the physical layer of 802.11 and 802.15.4 networks. To empower exploration of the attack surface of actual wireless networks and to facilitate active physical-layer testing of wireless devices, we also will develop a framework for crafting and injecting "marginally" malformed physical layer signals that correspond to common 802.11 and 802.15.4 frames. In particular, we will facilitate fuzz-testing of wireless devices. Both fingerprintable responses and (possibly exploitable) vulnerabilities of wireless devices amount to differences in implementations of protocol logic. We will develop methods for testing this logic in the wireless PHY layer, and look for potentially harmful security vulnerabilities in its common implementations.