The Dangers of Mitigating Security Design Flaws: A Wireless Case Study
description
Transcript of The Dangers of Mitigating Security Design Flaws: A Wireless Case Study
![Page 1: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/1.jpg)
The Dangers of Mitigating Security Design Flaws:
A Wireless Case Study
Nick Petroni Jr., William Arbaugh
University of Maryland
Presented by: Abe Murray
CS577: Advanced Computer Networks
![Page 2: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/2.jpg)
Outline• Abstract / Intro• WEP Overview• Attacks
– Dictionary– Inductive– Authors’ Implementation
• Implementation Results• “Mitigation” Angle• Closing
CS577: Advanced Computer Networks
![Page 3: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/3.jpg)
Abstract• Mitigating system flaws is hard to do right
– But vendors do this all the time…
• Design flaws are hard to patch– Often best approach is to re-architect system…
• WLAN Security (WEP)– Shows the FUNDAMENTAL PREMISE that adding
security after the fact is near impossible…
CS577: Advanced Computer Networks
![Page 4: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/4.jpg)
Introduction• The authors present a case study showing:
– Mitigating one flaw worsens another flaw– Overall security remains the same
• The authors develop an “inductive” attack against WEP:– 1st synchronous attack against WEP– Example of mitigation problem– Does not rely on knowledge of target network
CS577: Advanced Computer Networks
![Page 5: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/5.jpg)
Introduction• The authors present a case study showing:
– Mitigating one flaw worsens another flaw– Overall security remains the same
• The authors develop an “inductive” attack against WEP:– 1st synchronous attack against WEP– Example of mitigation problem– Does not rely on knowledge of target network
CS577: Advanced Computer Networks
![Page 6: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/6.jpg)
Outline• Abstract / Intro• WEP Overview• Attacks
– Dictionary– Inductive– Authors’ Implementation
• Implementation Results• “Mitigation” Angle• Closing
CS577: Advanced Computer Networks
![Page 7: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/7.jpg)
WEP Overview• IEEE 802.11 specification calls for
“reasonably strong” protection– WEP - “Wired Equivalent Privacy” - fails to deliver– Protects at the Data Link Layer– Symmetric Stream RC4 cipher
• Shared secret “k”• Secret used to generate stream of pseudorandom bytes
equal in length to target plaintext
– Encryption:– Decryption:
CS577: Advanced Computer Networks
PkRCC )(4
PPkRCkRCCkRCP )(4)(4)(4'
![Page 8: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/8.jpg)
WEP Overview
CS577: Advanced Computer Networks
Graphic by Petroni and Arbaugh
![Page 9: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/9.jpg)
Outline• Abstract / Intro• WEP Overview• Attacks
– Dictionary– Inductive– Authors’ Implementation
• Implementation Results• “Mitigation” Angle• Closing
CS577: Advanced Computer Networks
![Page 10: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/10.jpg)
Dictionary Attacks• Definition:
Any brute-force attack in which a large table is used or generated
• Relevance:RC4 – each key has unique associated pseudorandom stream used for encryption & decryption
• Build dictionary of all streams (1 per IV)Don’t need key to participate in network!
• IV size → 224 possible key streams,• WLAN MTU 2312 Bytes
→ ~40 GB Dictionary!
CS577: Advanced Computer Networks
![Page 11: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/11.jpg)
Inductive Attacks• Approach:
Obtain full network access without knowing the key with minimal knowledge of target
• HOW?Use known network protocols (redundantly encrypted
data) to intelligently guess an initial number of encrypted bytes
CS577: Advanced Computer Networks
![Page 12: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/12.jpg)
Step 1: Guess the first byte(s):
CS577: Advanced Computer Networks
Table by Petroni and Arbaugh
Graphic by Petroni and Arbaugh
![Page 13: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/13.jpg)
Step 2: Guess the next byte:
CS577: Advanced Computer Networks
Graphic by Petroni and Arbaugh
![Page 14: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/14.jpg)
The Author’s Attack
CS577: Advanced Computer Networks
• Attack System:– WLAN card operating in promiscuous
mode (Intersil Prism 2 chipset)– Ability to directly manipulate transmitted
bytes (OpenBSD 3.1 with modified drivers)
• Attack Approach:– Choice between ICMP and SNAP/ARP– Choose ARP so at Layer 2, though both
work
![Page 15: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/15.jpg)
Outline• Abstract / Intro• WEP Overview• Attacks
– Dictionary– Inductive– Authors’ Implementation
• Implementation Results• “Mitigation” Angle• Closing
CS577: Advanced Computer Networks
![Page 16: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/16.jpg)
Implementation Results
CS577: Advanced Computer Networks
Table by Petroni and Arbaugh
![Page 17: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/17.jpg)
Outline• Abstract / Intro• WEP Overview• Attacks
– Dictionary– Inductive– Authors’ Implementation
• Implementation Results• “Mitigation” Angle• Closing
CS577: Advanced Computer Networks
![Page 18: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/18.jpg)
“Mitigation” Angle
CS577: Advanced Computer Networks
Table by Petroni and Arbaugh
![Page 19: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/19.jpg)
Outline• Abstract / Intro• WEP Overview• Attacks
– Dictionary– Inductive– Authors’ Implementation
• Implementation Results• “Mitigation” Angle• Closing
CS577: Advanced Computer Networks
![Page 20: The Dangers of Mitigating Security Design Flaws: A Wireless Case Study](https://reader035.fdocuments.us/reader035/viewer/2022062723/56813dc5550346895da78e58/html5/thumbnails/20.jpg)
Closing Remarks• Authors showed how to mitigate their attack
– Stop forwarding packets with bad data– Detect attack activity– Packet Filtering (though effectively cripples
network)– Dynamic Rekeying
• Neat attack all by itself• Interesting example of how patching bad
security rarely works• Questions?
CS577: Advanced Computer Networks