Who Is Peeping at Your Passwords at Starbucks?
To Catch an Evil Twin Access Point
DSN 2010Yimin Song, Texas A&M UniversityChao Yang, Texas A&M UniversityGuofei Gy, Texas A&M University
Agenda
2
Introduction
Analysis
Algorithm
Evaluation
Conclusion
Agenda
3
Introduction• Wireless Network Review• Evil Twin Attack
Analysis
Algorithm
Evaluation
Conclusion
Wireless Network Review
4
Wireless terminology• AP – Access Point• SSID – Service Set Identifier• RSSI – Received Signal Strength Indication
BSS 1
BSS 2
Internet
hub, switchor routerAP
AP
802.11 CSMA/CA• DIFS – Distributed Inter-Frame Spacing• SIFS – Short Inter-Frame Spacing• BF – Random Backoff Time
sender receiver
BF
data
SIFS
ACK
DIFS
Evil Twin Attack
5
A phishing Wi-Fi AP that looks like a legitimate one (with the same SSID name).
Typically occurred near free hotspots, such as airports, cafes, hotels, and libraries.
Hard to trace since they can be launched and shut off suddenly or randomly, and last only for a short time after achieving their goal.
Evil Twin Attack (cont.)
6
Related work• Monitors radio frequency airwaves and/or
additional information gathered at router/switches and then compares with a known authorized list.
• Monitors traffic at wired side and determines if a machine uses wired or wireless connections. Then compare the result with an authorization list to detect if the associated AP is a rogue one.
Agenda
7
Introduction
Analysis• Network Setting in This Model• Problem Description• Server IAT (Inter-packet Arrival Time)
Algorithm
Evaluation
Conclusion
Network Setting in This Model
8
Table 1: Variables and settings in this model
Problem Description
9
An evil twin typically still requires the good twin for Internet access. Thus, the wireless hops for a user to access Internet are actually increased.
Fig. 1: Illustration of the target problem in this paper
• What statistics can be used to effectively distinguish one-hop and two-hop wireless channels on user side?
• Are there any dynamic factors in a real network environment that can affect such statistics?
• How to design efficient detection algorithms with the consideration of these influencing factors?
Server IAT
10
Server IAT (cont.)
11Fig. 2: Server IAT illustration in the normal AP scenario
Server IAT (cont.)
12Fig. 2: Server IAT illustration in the normal AP scenario
Server IAT (cont.)
13
Server IAT (cont.)
14
Fig. 5: IAT distribution under RSSI=50%
Fig. 4: IAT distribution under RSSI=100%
Agenda
15
Introduction
Analysis
Algorithm• TMM (Trained Mean Matching Algorithm)• HDT (Hop Differentiating Technique)• Improvement by Preprocessing
Evaluation
Conclusion
TMM
16
Trained Mean Matching Algorithm (TMM) requires knowing the distribution of Server IAT as a prior knowledge.
Given a sequence of observed Server IATs, if the mean of these Server IATs has a higher likelihood of matching the trained mean of two-hop wireless channels, we conclude that the client uses two wireless network hops to communicate with the remote server indicating a likely evil twin attack, and vice versa.
TMM (cont.)
17
TMM (cont.)
18
TMM (cont.)
19
HDT
20
HDT (cont.)
21
Fig. 2: Server IAT illustration in the normal AP scenario
Fig. 6: 6-AP IAT illustration in the normal AP scenario
HDT (cont.)
22
HDT (cont.)
23
Improvement by Preprocessing
24
Agenda
25
Introduction
Analysis
Algorithm
Evaluation• Environment Setup• Datasets• Effectiveness• Cross Validation
Conclusion
Environment Setup
26
Fig. 8: Environment for evil twin APFig. 7: Environment for normal AP
Datasets
27
Range A B+ B- C+ C- D E
Upper 100% 80% 70% 60% 50% 40% 20%
Lower 80% 70% 60% 50% 40% 20% 0%
Algorithm Protocol A B+ B- C+ C- D
HDT802.11g 0.8% 0.86% 3.91% 3.72% 4.69% 7.09%
802.11b 1.38% 1.44% 5.61% 6.17% 9.42% 10.36%
TMM802.11g 0.62% 0.68% 2.59% 2.66% 3.30% 6.02%
802.11b 0.99% 1.04% 3.33% 4.72% 7.44% 8.29%
Table 3: The percentage of filtered packets
Table 2: RSSI ranges and corresponding levels
Effectiveness
28
Table 5: False positive rate for HDT and TMM
Table 4: Detection rate for HDT and TMM
Algorithm Protocol A B+ B- C+ C- D
HDT802.11g 99.08% 98.72% 93.53% 94.31% 87.29% 81.39%
802.11b 99.92% 99.99% 99.96% 99.95% 96.05% 94.64%
TMM802.11g 99.39% 99.97% 99.49% 99.5% 98.32% 94.36%
802.11b 99.81% 95.43% 94.81% 96.09% 91.94% 85.71%
Algorithm Protocol A B+ B- C+ C- D
HDT802.11g 2.19% 1.41% 2.06% 1.93% 2.48% 6.52%
802.11b 8.39% 8.74% 5.39% 6.96% 5.27% 5.15%
TMM802.11g 1.08% 1.76% 1.97% 1.48% 1.75% 1.73%
802.11b 0.78% 1% 1.07% 1.27% 6.65% 7.01%
Effectiveness (cont.)
29
Fig. 9: Cumulative probability of the number of decision rounds for HDT to output a correct result
Effectiveness (cont.)
30
Table 7: False positive rate when number of input data in one decision round is 50
Table 6: Detection rate when number of input data in one decision round is 50
Algorithm Protocol A B+ B- C+ C- D
multi-HDT802.11g 99.62% 100% 100% 99.95% 100% 100%
802.11b 100% 100% 100% 100% 100% 100%
multi-TMM802.11g 100% 99.11% 98.73% 99.88% 95.83% 88%
802.11b 100% 100% 100% 100% 100% 100%
Algorithm Protocol A B+ B- C+ C- D
multi-HDT802.11g 0% 0.77% 0% 0% 0% 0%
802.11b 0% 0.03% 0.02% 0.11% 0.73% 0.1%
multi-TMM802.11g 0% 0.96% 0.16% 0.13% 0.55% 0.96%
802.11b 0% 1.07% 1.16% 1.02% 1.36% 1.41%
Table 7: False positive rate when number of input data in one decision round is 100
Effectiveness (cont.)
31
Fig. 10: Detection rate for multi-HDT using different numbers of input data in one decision round
Cross Validation
32
Fig. 11: Detection rate for TMM under different RSSI ranges
Cross Validation (cont.)
33
Fig. 12:Detection rate under different 802.11g networks
Cross Validation (cont.)
34
Fig. 13: False positive rate under different 802.11g networks
Agenda
35
Introduction
Analysis
Algorithm
Evaluation
Discussion and Conclusion• Discussion• Conclusion
Discussion
36
More wired hops?• Several studies showed that the delays from the
wired link is not comparable to those in the wireless link.
• We can trade-off for more decision rounds.• Use a server within small hops.• Maybe use techniques similar to “traceroute” to
know the wired transfer time and then exclude/subtract them to minimize the noisy effect at wired side.
Discussion (cont.)
37
Will attacker increase IAT to avoid detection?• Users don’t like a slow connection.
Eq. 1: Attacker may delay the packet to reduce the SAIR
What if some evil twin AP connect to wired network instead of using normal AP?• That’s our future work.
Conclusion
38
We propose TMM and HDT to detect evil twin attack where TMM requires trained data and HDT doesn’t.
HDT is particularly attractive because it doesn’t rely on trained knowledge or parameters, and is resilient to changes in wireless environments.
The End