View
6
Download
0
Category
Preview:
Citation preview
Research ExamNishant Bhaskar
1
The problem
Passive Eavesdropper
1 2 3
4 5 6
Wireless personal devices have become a homing beacon2
ApplicationPresentation
SessionTransportNetworkData LinkPhysical
Existing measures not enough
Alwaysavailable
3
Not just a cautionary tale
4
Techniques for wireless device identification• Passive eavesdropping • Tradeoff decision made by an adversary in
choosing a technique
Implications of device identification• User tracking – Social, physical, behavioral
In this survey
5
Focused on papers in WiFi and Bluetooth
Limit analysis to link and physical layer device identification
Scope of survey
6
1. Identifying information in wireless signals• Link layer• Physical layer
2. Taxonomy
3. Identification techniques• Link layer – Packet Contents• Link layer – Packet Timing• Physical layer - Signal propagation• Physical layer – Hardware imperfections
4. Tracking the device owner
Outline
7
Due to manufacturer implementations
Packet contents transmitted in the clear• Device discovery packets • Link layer headers
Link layer controls packet timing• Packet scheduling and transmission• Timing properties can be measured
Identifying information - Link Layer
(a)
(b) (c)
8
PhysicallayertransmitsthephysicalRFsignal• Informationindependentofhigherlayerconstraints
Physicallayermeasurement• Effectofsignalpropagationthroughthewirelesschannel• Fundamentalnon-idealitiesduetoRFsignalchainimperfections
Identifying information - Physical Layer
9
1. Identifying information in wireless signals• Link layer• Physical layer
2. Taxonomy
3. Identification techniques• Link layer – Packet Contents• Link layer – Packet Timing• Physical layer - Signal propagation• Physical layer – Hardware imperfections
4. Tracking the device owner
Outline
10
Universality • Works for all device roles? (Role)
Stability• Features stable with changing environment? (Environment)• Features stable with software updates? (Software)
Practicality• Cheap data collection equipment? (Cost)• Proven to work outside controlled environments? (Outdoor)
Taxonomy
11
Technique Role Environment Software Cost OutdoorLink LayerPacket Contents Yes Yes No Yes YesPacket Timing No1 Yes No2 Yes YesPhysical LayerSignal Propagation Yes No Yes Yes NoHardware Imperfections Yes Yes Yes No No
Taxonomy
1:Inter-packetarrivalrate->Yes2:Clockskew->Yes
12
1. Identifying information in wireless signals• Link layer• Physical layer
2. Taxonomy
3. Identification techniques• Link layer – Packet Contents• Link layer – Packet Timing• Physical layer - Signal propagation• Physical layer – Hardware imperfections
4. Tracking the device owner
Outline
13
(a)
(b) (c)
Link Layer - Packet contents
14
Packet contents (Martin et al. [PETS ‘19])
Handoff
WiFi settings
InstantHotspot
WiFi JoinNetwork
Nearby
WatchConnection
15
Nearby messages broadcast 200 times/minute
MAC address changes, data field doesn’t• MAC addresses can be linked• Device can be continuously tracked
Use global MAC address• When sent concurrently with Handoff
Packet contents (Martin et al. [PETS ‘19])
16
Handoff messages• Sent by Handoff-enabled apps• User interaction, app open/close
Sequence number predictable• Identification possible after several days• Knowing HW/SW improves prediction
Packet contents (Martin et al. [PETS ‘19])
17
Freudiger et al. [WiSec ’15]• Sequence numbers link WiFi probe requests• Probes use global address when screen is active
Vanhoef et al. [Asia CCS ‘16]• IE fields identify WiFi device models, sequence numbers identify devices• SSID fingerprint of previously connected APs• WPS UUID derived from MAC address with a fixed seed
Martin et al. [PETS ‘17]• mDNS WiFi packets identify device model• Authentication packets contain global address
Packet contents overview
18
Spill et al. [WOOT ‘06]• Reverse engineered Bluetooth MAC address, clock bits• Determined hopping to be able to follow device
Ryan et al. [WOOT ‘13]• Observed channel hopping for BLE was fixed increments• Whitening was much simpler than Bluetooth
Becker et al. [PETS ‘19] • BLE MAC address randomize but same advertisement payload• Devices can be tracked after randomization
Packet contents overview
19
Most commonly used technique for user tracking
A reflection of protocol stack design choices• Properties susceptible to change with firmware upgrade
Identifying correct features is a manual process• There always is a feature out there!
Packet contents summary
20
1. Identifying information in wireless signals• Link layer• Physical layer
2. Taxonomy
3. Identification techniques• Link layer – Packet Contents• Link layer – Packet Timing• Physical layer - Signal propagation• Physical layer – Hardware imperfections
4. Tracking the device owner
Outline
21
Link layer schedules transmissions• Device discovery packets• Data packets
Timing side channel for device identification
Packet timing identification• Clock skew• Inter-packet arrival rate
Link layer - Packet timing
22
Clock skew for device identification• Measured arrival time of preambles• Baseband properties filter preambles • Same properties for transmitter clock• Similarity distance for identification
Packet timing (Huang et al. [INFOCOM ‘14])
23
Minimal variation in skew • 0.5 ppm across devices in an hour• 0.55 ppm across temperature ranges
High accuracy in identification• 38/56 devices were the exact same make
Packet timing (Huang et al. [INFOCOM ‘14])
24
Jana et al. [MobiCom ‘08]• Computed clock skew for 802.11 radios• Used TSF timestamp in AP beacons, and microsecond timer on receiver side
Arackaparambil et al [WiSec ‘10]• Used TSF timestamp at receiver to improve measurement variance• Demonstrated virtual AP clock skew impersonation attack.
Packet timing overview
25
Franklin et al. [SEC ‘06]• Inter probe request time identifies (NIC driver, host OS)
Loh et al. [WiSec ‘08]• Use time between probe request bursts for identification• Lower resolution of measurement needed (order of minutes)
Matte et al. [WiSec ‘16]• Combined inter burst and inter probe request timings• Needed only 4 group of bursts per transmitter for identification
Packet timing overview
26
Inter packet arrival rate works for all devices.• Not stable to firmware upgrades
Clock skew is stable to firmware upgrades• But works only for master devices
Packet timing is a dangerous user tracking tool• Packet arrival rate reveals wireless application usage
Packet timing summary
27
1. Identifying information in wireless signals• Link layer• Physical layer
2. Taxonomy
3. Identification techniques• Link layer – Packet Contents• Link layer – Packet Timing• Physical layer - Signal propagation• Physical layer – Hardware imperfections
4. Tracking the device owner
Outline
28
Signal propagation through medium • Modifies signal properties
Idea of location as identity• Signal propagation used for localization• Utilize existing network of wireless devices
Signal changes can be measured through• Received Signal strength• Channel State Information
Physical layer - Signal propagation
29
Multiple signal strength readings• Authentication request tagged with RSS from
different APs
Signalprints identify location of transmitter• Close transmitters differ by a max threshold• Far transmitters differ by atleast a min threshold
Signal propagation (Faria et al. [WiSec ‘06])
Faria etal.,Detectingidentity-basedattacksinwirelessnetworksusingsignalprints.WiSe’0630
Accuracy of 91% in identifying devices• Devices separated by 7m in a room 45m X 24m• Using RSS values from 4 APs
Signalprint values influenced by environment• Moving furniture or people
Signal propagation (Faria et al. [WiSec ‘06])
31
Bauer et al. [PETS ‘09]• Performed k-means clustering on signal strength values
Sheng et al. [INFOCOM ‘08]• Due to antennae diversity, RSS distributions follow GMM• Used mixture models to identify transmitter at particular location
Ghose et al. [INFOCOM ‘18]• RSS patterns vary according to relative motion of transmitter/receiver• Used that to design an authenticator with a helper device
Signal propagation overview
32
Sen et al. [MobiSys ‘12]• CFRs at same location from same subcarrier form clusters.• Sampling multiple locations in a 1m X 1m grid to identify exact location
Jin et al. [ToWC ‘10]• CIR based localization by taking IFFT on CFR• Log scale ensures large delay components contribute to CIR
Signal propagation overview
33
Signal propagation represents the wireless environment• Not stable to environment changes• Typically used indoors or in a constrained environment
Used to supplement other identification techniques• Predominately a localization technique• Signal strength can be measured by any radio
Signal propagation summary
34
1. Identifying information in wireless signals• Link layer• Physical layer
2. Taxonomy
3. Identification techniques• Link layer – Packet Contents• Link layer – Packet Timing• Physical layer - Signal propagation• Physical layer – Hardware imperfections
4. Tracking the device owner
Outline
35
Manufacturing imperfections • Quantified using signal non-idealities
Signal properties reflect hardware identity
Can be measured using • Transient signal • steady state signal
Physical layer - Hardware imperfections
36
Physical layer - Hardware imperfections
37
Attach a sensor to AP• Vector signal analyzer for measurement• Data relayed to central server for fingerprinting
Use steady state signal modulation properties for identification
• Frequency error, SYNC correlation, I/Q offset, magnitude error and phase error
Briketal.,WirelessDeviceIdentificationwithRadiometricSignatures.,MobiCom ’08,ACM
Hardware imperfections (Brik et al. [MobiCom‘08 ])
38
High accuracy and stability for device identification• > 99.5% for over 138 devices• Minimal change in accuracy when devices moved around
Too ideal a test environment?• Vo-Huu et al. (WiSec 16) attempted reproducing results• Significant lower accuracy but high reproducibility
Briketal.,WirelessDeviceIdentificationwithRadiometricSignatures.,MobiCom ’08,ACM
Hardware imperfections (Brik et al. [MobiCom‘08 ])
39
Hall et al. [WOC ‘03]• Detected Bluetooth radios using phase of transients• Observed slope of phase is linear at start of transmission
Hall et al. [IASTED ‘04]• Detected WiFi radios using phase, frequency and amplitude of transient
Suski et al. [GLOBECOM ‘08]• Amplitude of transient works better at low SNR• Used power spectral density to classify WiFi radios
Hardware imperfections overview
40
Vo-Huu et al. [WiSec ‘16]• Used combination of CFO, SFO, transient for identification• Transient has higher contribution than modulation properties
Liu et al. [INFOCOM ‘19]• I/Q mismatch phase error from channel estimate• Phase gradients due to signal have lower variance than noise
Sun et al. [HotWireless ‘17]• Observed variation in CFO values, for detecting BLE signal• A BLE transmission exhibits constant CFO
Hardware imperfections overview
41
A technique of great promise and frustration!• Best identifier for transmitter hardware• Measurement of properties reliably and accurately is hard
Require costly hardware • Demonstrated to work in only controlled environment
Further work needs to be done • Cost effective SDR tools and designing more reliable techniques
Hardware imperfections summary
42
Identification techniques - Summary
Technique Role Environment Software Cost OutdoorLink LayerPacket Contents Yes Yes No Yes YesPacket Timing No1 Yes No2 Yes YesPhysical LayerSignal Propagation Yes No Yes Yes NoHardware Imperfections Yes Yes Yes No No1:Inter-packetarrivalrate->Yes2:Clockskew->Yes
43
A number of identifiers exist at link and physical layer
An adversary’s choice is a tradeoff decision
Link layer techniques efficacy can be reduced by not transmitting so often
Physical layer techniques harder to defend against, but still not mature
Identification techniques - Summary
44
1. Identifying information in wireless signals• Link layer• Physical layer
2. Taxonomy
3. Identification techniques• Link layer – Packet Contents• Link layer – Packet Timing• Physical layer - Signal propagation• Physical layer – Hardware imperfections
4. Tracking the device owner
Outline
45
Tracking the device owner
Passive Eavesdropper
1 2 3
4 5 6
Device identification information can be used to track the user46
User social linkages
Preferred Network List can be obtained by eavesdropping probe requests47
PNL indicates likely city of residence• Geographic locations of APs from Wigle• Provenance rank for each likely city
Performed analysis on dataset collected at political rallies
• Closely predicted city-wise voting patterns• Social linkages revealed
User social linkages (Luzio et al. [INFOCOM ‘16])
48
Connectedstate
User activity tracking
Physical activity related to data traffic of tracker49
Fitness tracker leaks physical activity• Increased activity -> more data packets• Classification accuracy of activity -> 97.6%
Accelerometer features related to data traffic• Strong correlation observed• Can distinguish individual walking patterns
User activity tracking (Das et al. [HotMobile ‘16])
50
A large amount of user tracking information is available
User tracking features exposed predominately at the link layer
We need to make better design choices and not keep repeating mistakes
Tracking the device owner - Summary
51
Practical physical layer device identification
Analyzing potential privacy concerns with directed BLE advertisements
Wireless privacy leakage in personal medical devices
Directions for future work
52
Questions?
53
Recommended