1 / 38

EECS 598

EECS 598. Analysis of 802.11 Privacy Jim McCann & Daniel Kuo. Overview. Part 1: The idea What our software does Part 2: Applications: Locating rogue access points How our software can help. Part 1. User identity / MAC address Relationship Identification. Collection Method.

phyllis
Download Presentation

EECS 598

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. EECS 598 Analysis of 802.11 Privacy Jim McCann & Daniel Kuo

  2. Overview Part 1: • The idea • What our software does Part 2: • Applications: Locating rogue access points • How our software can help

  3. Part 1 User identity / MAC address Relationship Identification

  4. Collection Method • Run a laptop as a sniffer in a wireless network • Record packets that are sent • Software used: • Kismet • Ethereal • Lots of PERL

  5. Personal Information Some interesting packets that leak personal information: • SMTP packets – unencrypted packets contain source and destination email address • IMAP packets – though encrypted versions are available, some people don’t use them

  6. Personal Information • Multicast DNS packets – information broadcast for device discovery in Apple’s Rendezvous service. Reveals a computer’s ID (user’s name by default) • NetBIOS Name Service – used when browsing windows networks, also shows computer’s name (though windows defaults are less revealing)

  7. Personal Information • HTTP post – some personal information may be leaked if unencrypted post is used • MSN Messenger packets – the hotmail address is found in some packets • Also AIM, YMSG, FTP, Telnet (if anyone still use it), many other protocols.

  8. Findings Most of our data is collected in the EECS building, where two networks are available: • EECS-PRIV: an unencrypted wireless network • CAEN wireless: can be connected only with VPN client

  9. Findings • Two weeks of data from the EECS-PRIV network: • Of the 1744 MACs we saw: • 850 had some identifying information • About 200 had strong identifying info • Why not more? • This counts computers on the VPN which we make no attempt to identify.

  10. Time profile of user At a coarser level …

  11. Time profile of user • Based on a MAC address, a time plot of network usage can be used to analyze user’s behavior. • Typical plots reveal:- what time of the day - what days of the weeka user is present. • Might be interesting for malicious parties when MAC can be correlated to identity.

  12. Demo • Demo of our software

  13. Feasibility of identity analysis • Unencrypted network like EECS-PRIV is easiest to perform the analysis on user identity from an attacker’s perspective • In a WEP environment, it is also possible for an “insider” who has the key, or an attacker who can break the key using chosen plaintext attacks. • Much more difficult in the CAEN VPN environment

  14. Implications • A user’s movement can be tracked if the laptop’s wireless card is on, and data collecting nodes are set up in multiple locations. • Also, attackers can use this technique to target important people (for example, professors or network administrators).

  15. Possible Defense Mechanism Simple ways to stop others from correlating your personal information with MAC Addresses: • Don’t send personal data or • Don’t keep the same MAC address

  16. Possible Defense Mechanism Not sending personal data: • Be paranoid- Do not send email, passwords in the clear- Do not name your computer with your name or uniqname • Use encryption whenever possible- Best to use VPN- Using WEP is still better than nothing

  17. Possible Defense Mechanism Changing your MAC Addresses: • Software can change the MAC address of many wireless cards • When is a good time interval?

  18. Possible Defense Mechanism • Changing every time you start using the network will be a problem if you stay connected for a long time. • Changing MAC address every given amount of time (say 1 hour) may help. • Special software to do this seamlessly would be nice, but there are hard cases to deal with (MAC address conflicts!).

  19. Part 2: Laptops as Rogue Access Points

  20. Laptops as Rogue Access Points • How to do this: • Have the laptop establish an ad-hoc network using the wireless card • Access the internet through ethernet • This is similar to a commercial access point.

  21. Laptops as Rogue Access Points • It is possible for a laptop to act as a wireless router and allow access to an authorized network. • It establishes an ad-hoc network with unauthorized clients and routes their packets over to the network that it is authorized on.

  22. Laptops as Rogue Access Points • This requires additional hardware (second wireless card) and/or software for the laptop to establish both an ad-hoc network and connect to the authorized network.

  23. Discovering access points Finding if unauthorized access points or ad hoc networks exist isn’t hard. • Look for people sending packets with BSS Id’s you don’t approve of (if you are an admin). • Look for networks you can connect to (if you are an attacker).

  24. Discovering access points • Kismet does just this:

  25. Tracking Finding where they actually are is harder.

  26. Tracking by Identity (our method) • Possible to figure out who controls the access point by looking at identity data. • Hypothesis: unauthorized APs are carelessly administrated and don’t use encryption. • Our software can figure out who is using them.

  27. Tracking by Connections • Find identity on our network of the rogue access provider by comparing data sent over the ad-hoc network. • In an unencrypted network (or one we have the keys for), this can be detected by passively sniffing packets. • More tricky if the data is encrypted – Using Signal Processing to Analyze Wireless Data Traffic (Craig Partridge, et al.)

  28. Tracking by Connections • Problem: We haven’t found a person, just another computer address. • We need a list of who uses what on the local network. • Our software helps!

  29. Tracking by Signal Strength Alternative: • Collect data and use signal strength to pinpoint the location of unauthorized clients and access points. • More complicated. • A Practical Approach to Identifying and Tracking Unauthorized 802.11 Cards and Access Points (Interlink Networks)

  30. Tracking by Signal Strength • Locating an access point with signal strength

  31. Uses and Abuses • Some users may not want their locations to be revealed. • Spammers may start wardriving.

  32. Conclusion • Privacy is an issue for wireless networks, especially unencrypted networks. • MAC addresses can be used to track users. • Our software can be used to help discover what types of privacy information are leaked over the network. • Can also help track users related to an unauthorized access point.

  33. Questions Questions?

  34. Laptops as Rogue Access Points Situation where this may be a problem: • Lufthansa airline is providing in-flight wireless internet service starting this month • Cost is $29.95 for flights over 6 hours • Can imagine people ‘sharing’ the internet by using their laptops as rogue access points to share the cost

  35. Uses and Abuses • Making the location of a user available may be beneficial. • Google has a beta version of local search. This returns local information like restaurants for a location you enter. • Can imagine in the future that the location of the user can be made available for google by the access point.

  36. Uses and Abuses Tradeoff between convenience and privacy • Apple’s Rendezvous service automatically discovers available services. • User will (by default), name the computer “<First name> <Last name>’s Computer” for sharing purpose, and broadcast this info. • This reveals the user’s personal information, so it would be better in privacy’s perspective to set the default identifier to something else.

  37. Collection Method • A captured packet viewed with Tethereal

More Related