77
Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013

Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

  • Upload
    others

  • View
    4

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks

Hunter Scott / August 3, 2013

Page 2: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Radio

Page 3: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

+

Software Defined Radio

Page 4: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Cognitive Radio

+

Page 5: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Cognitive Radio Network

Page 6: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 7: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 8: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 9: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 10: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Cognitive Engine

Page 11: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Center Frequency

Bandwidth

Transmit power

Type of modulation

Coding rate

Channel access protocol

Encryption algorithm

Frame size

Page 12: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 13: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 14: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 15: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 16: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 17: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 18: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 19: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 20: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 21: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 22: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 23: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 24: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 25: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Attacks specific to cognitive radio networks

Page 26: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 27: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 28: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 29: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Change cognitive messages being sent through network

Page 30: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Change cognitive messages being sent through network

Incumbent on channel 6

Page 31: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Incumbent on channel 6

Change cognitive messages being sent through network

Page 32: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Incumbent on channel 1

Change cognitive messages being sent through network

Page 33: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Incumbent on channel 1

Change cognitive messages being sent through network

Page 34: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Recalculating…

Change cognitive messages being sent through network

Page 35: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Routing Disruption

Page 36: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Sybil Attack

Page 37: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Sybil Attack

Page 38: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Sybil Attack

Page 39: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Sybil Attack

Page 40: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Priority Attack

Page 41: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

>

Page 42: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Attacks on Crypto

Page 43: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

VS

Page 44: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Attacks on Data Privacy

Page 45: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 46: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Primary User Emulation

Page 47: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Primary User Emulation

Page 48: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Primary User Emulation

Primary user on

channel 4

Primary user on

channel 4

Primary user on

channel 4

Primary user on

channel 4

Page 49: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Primary User Emulation

Primary user on channel 4

Page 50: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Primary User Emulation

Recalculating…

Page 51: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Countermeasures

Page 52: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Cooperative Intrusion Detection

Page 53: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 54: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Device Reputation

Page 55: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Device Location

Page 56: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Why this matters

Page 57: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 58: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 59: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 60: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Tools

Page 61: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 62: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 63: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Level

30 MHz to 4.4 GHz 60 mW SimpliciTI Fits Arduino shields ~$100 in quantity

Page 64: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 65: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 66: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 67: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 68: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 69: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 70: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 71: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 72: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software
Page 73: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

MyriadRF ($300)

Other tools

HackRF ($300)

Michael Ossmann Azio

BladeRF ($420)

Nuand

Page 74: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

What’s next

Page 75: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Latest version of these slides + code & schematics:

defcon21.hscott.net

Page 76: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Image Credits:

Radio designed by Monika Ciapala from The Noun Project

Radio Tower designed by iconoci from The Noun Project

Brain designed by Samuel Dion-Girardeau from The Noun Project

Person designed by Björn Andersson from The Noun Project

Plant designed by Luke Anthony Firth from The Noun Project

Lock from The Noun Project

Speedometer designed by Volodin Anton from The Noun Project

Location designed by Ricardo Moreira from The Noun Project

Page 77: Hacking Wireless Networks of the Future: Security …...Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks Hunter Scott / August 3, 2013 Radio + Software

Further Reading:

FCC. In the matter of unlicensed operation in the TV broadcast bands: second report and order and memorandum opinion and order., Nov. 2008.

Fadlullah, Zubair Md, et al. "An Intrusion Detection System (IDS) for Combating Attacks Against Cognitive Radio Networks." IEEE Network (2013): 52.

Jackson, David. "Exploiting Rogue Signals to Attack Trust-based Cooperative Spectrum Sensing in Cognitive Radio Networks." (2013).

Du, Jiang, Chunjiao Zhu, and Zhaohui Chen. "Security issues in cooperative spectrum sensing for cognitive radio network." 2012 International Conference on Graphic and Image Processing. International Society for Optics and Photonics, 2013.

For even more readings, see the references of these papers.