Thursday, September 1, 2011

Remotely Exploiting the PHY Layer

or, Bobby Tables from 1938 to 2011

by Travis Goodspeed <travis at radiantmachines.com>
concerning research performed in collaboration with
Sergey Bratus, Ricky Melgares, Rebecca Shapiro, and Ryan Speers.

20110808_001

The following technique is a trick that some very good neighbors and I present in Packets in Packets: Orson Welles' In-Band Signaling Attacks for Modern Radios (pdf) at Usenix WOOT 2011. As the title suggests, Orson Welles authored and implemented the attack in 1938 as a form of social engineering, but our version acts to remotely inject raw frames into wireless networks by abuse of the PHY layer. As that paper is limited to a formal, academic style, I'd like to take the opportunity to describe the technique here in my people's native language, which has none of that formal mumbo-jumbo and high-faluttin' wordsmithin'. This being just a teaser, please read the paper for full technical details.

The idea is this: Layer 1 radio protocols are vulnerable injections similar to those that plague naively implemented SQL websites. You can place one packet inside of another packet and have the inner packet drop out to become a frame of its own. We call the technique Packet-in-Packet, or PIP for short.

As I've mentioned in my article on promiscuously sniffing nRF24L01+ traffic, every modern digital radio has a Layer 1 form that consists of a Preamble, followed by a Sync, followed by a Body. The Body here is Layer 2, and that is the lowest that a normal packet sniffer will give you. (Keykeriki, Ubertooth, and GoodFET/NRF give a bit more.)

In the specific case of IEEE 802.15.4, which underlies ZigBee, the Preamble consists of the 0 symbol repeated eight times, or 00000000. The Sync is A7. After that comes the Body, which begins with a byte for the length, a few bytes for flags, the addresses, and some sort of data. Suppose that an attacker, Mallory, controls some of that data, in the same way that she might control an HTTP GET parameter. To cause a PIP injection of a Layer 2 packet, she need only prepend that packet with 00000000A7 then retransmit a large--but not unmanageably large--number of times. I'm not joking, and I'm not exaggerating. It actually works like that.

Below is a photograph of the first packet capture in which we had this technique working. The upper packet capture shows those packets addressed to any address, while the lower capture only sniffs broadcast (0xFFFF) messages. The highlighted region is a PIP injection, a broadcast packet that the transmitter intended to only be data within the payload of an outer packet.
20110808_003

How it works.


When Alice transmits a packet containing Mallory's PIP to Bob, Bob's interpretation can go one of three ways, two of which are depicted in the diagram below. In the first case, as shown in the left column, Bob receives every symbol correctly and interprets the packet as Alice would like him to, with Mallory's payload sitting harmlessly in the Body. In the second case, which is not depicted, a symbol error within the Body causes the packet's checksum to fail, and Mallory's packet is dropped along with the rest of Alice's.

802.15.4 PIP

The third interpretation, shown above in the right column, is the interesting one. If a symbol error occurs before the Body, within the Preamble or the Sync, then there's no checksum to cause the packet to be dropped. Instead, the receiver does not know that it is within a packet, and Mallory's PIP is mistaken as a frame of its own. Mallory's Preamble and Sync will mark the start of the frame, and Mallory's Body will be returned to the receiver.

In this way, Mallory can remotely inject radio frames from anywhere on the network to which she can send her payload. That is, this is a PHY-Layer radio vulnerability that requires no physical access to the radio environment. Read the WOOT paper for complications that arise when applying this to IEEE 802.11, as well as the conditions under which a PIP injection can succeed on every attempt.

War of the Worlds


In 1938, Orson Welles implemented a similar exploit as a form of social engineering in order to cause panic with his War of the Worlds (mp3, transcript) performance.

Recall that PIP injection works by having the victim miss the real start of frame marker, then fraudulently including another start of frame marker inside of the broadcast. As per the FCC requirements of his time, Orson begins with a real start of broadcast marker:

ANNOUNCER: The Columbia Broadcasting System and its affiliated stations present Orson Welles and the Mercury Theatre on the Air in The War of the Worlds by H. G. Wells.

(MUSIC: MERCURY THEATRE MUSICAL THEME)

ANNOUNCER: Ladies and gentlemen: the director of the Mercury Theatre and star of these broadcasts, Orson Welles . . .

ORSON WELLES: We know now that in the early years of the twentieth century this world was being watched closely by intelligences greater than man's and yet as mortal as his own. We know now that as human beings busied themselves about their various concerns they were scrutinized and studied, perhaps almost as narrowly as a man with a microscope might scrutinize the transient creatures that swarm and multiply in a drop of water. With infinite complacence people went to and fro over the earth about their little affairs, serene in the assurance of their dominion over this small spinning fragment of solar driftwood which by chance or design man has inherited out of the dark mystery of Time and Space. Yet across an immense ethereal gulf, minds that to our minds as ours are to the beasts in the jungle, intellects vast, cool and unsympathetic, regarded this earth with envious eyes and slowly and surely drew their plans against us. In the thirty-ninth year of the twentieth century came the great disillusionment.
It was near the end of October. Business was better. The war scare was over. More men were back at work. Sales were picking up. On this particular evening, October 30, the Crosley service estimated that thirty-two million people were listening in on radios.


That introduction is two minutes and twenty seconds long, and it was scheduled to begin while a popular show on another station was still in progress. Many of the listeners tuned in late, causing them to miss the Sync and not know which show they were listening to, just as in a PIP injection! What follows is thirty-eight minutes of a first act, without a single word out of character or a single commercial message from a sponsor. The play begins in the middle of a weather report, followed by repeated false station and show announcements, a few of which follow.

We now take you to the Meridian Room in the Hotel Park Plaza in downtown New York, where you will be entertained by the music of Ramón Raquello and his orchestra.
From the Meridian Room in the Park Plaza in New York City, we bring you the music of Ramón Raquello and his orchestra.
Ladies and gentlemen, we interrupt our program of dance music to bring you a special bulletin from the Intercontinental Radio News.
We are now ready to take you to the Princeton Observatory at Princeton where Carl Phillips, or commentator, will interview Professor Richard Pierson, famous astronomer.
Good evening, ladies and gentlemen. This is Carl Phillips, speaking to you from the observatory at Princeton.
Just a moment, ladies and gentlemen, someone has just handed Professor Pierson a message. While he reads it, let me remind you that we are speaking to you from the observatory in Princeton, New Jersey, where we are interviewing the world- famous astronomer, Professor Pierson.

By repeatedly lying to the listeners about the station and the program, Welles was able to convince them that they were listening to legitimate news broadcasts of an alien invasion. Ensuring that the listener missed the starting broadcast announcement breaks the encapsulation that was intended to prevent such confusion, just as a PIP injection relies upon the start of frame to be missed in order to break OSI model encapsulation.

How the hell did this happen?


This class of vulnerability is a really, really big deal. An attacker can use it to inject raw frames into any wireless network that lacks cryptography, such as a satellite link or an open wifi hotspot. Not only that, but because the injection is remote, the attacker needs no radio to perform the injection! Not only that, but this vulnerability has sat unexploited in nearly every unencrypted digital radio protocol that allows for variable frame length since digital radio began! So why did no one notice before 2011?

Packet in Packet injection works because when Bob forwards a wrapped string to Alice over the air, he is trusting Mallory to control the radio symbols that are broadcast for that amount of time. The potential for abusing that trust wasn't considered, despite communications experts knowing full well that sometimes a false Sync was detected or a true Sync missed. This is because a symbol error in the Sync field causes the packet to be implicitly dropped, with the same behavioral effect that would be had if the error were later in the packet and it were explicitly dropped. Except when faced with a weaponized PIP injection, nothing seems strange or amiss. Sync errors were just a nuisance to communications engineers, as we security guys were staying a few layers higher, allowing those layers of abstraction to become boundaries of competence.

That same trust is given in wired networks and busses, with the lesser probability of missing a Sync being the only defense against PIP injection. Just as PIP has shown that unencrypted wireless networks are vulnerable even when the attacker is not physically present, I expect wired networks to be found vulnerable as soon as an appropriate source of packet errors is identified. Packet collisions provide this in unswitched Ethernet networks, and noisy or especially long links might provide it for more modern wired networks.

If I've not yet convinced you that this attack is worth studying, I probably won't be able to. For the rest of you, please print and read the paper and extend this research yourself. There's a hell of a lot left to be done at the PHY layer, and it might as well be you who does it.

Thank you kindly,
--Travis Goodspeed




220 comments:

«Oldest   ‹Older   201 – 220 of 220
Nikehoods said...

nikehoodsgreat website you have got here.

north face jacket said...

This is a very nice blogShop Here and learned more knowledge to read this post thanks for sharing this informative post.

mini dapple dachshund said...

mini dapple dachshund

EIbass said...

Nice blog you have here. you can check crk jamb past question

5star said...

Thanks for sharing this post with us.
Best Mini Ping Pong Table

Supriya said...

Did you know that a Good Quotes can make a radical change in your life? So start reading Popular Quotes from today. Thank you.

My Homework Help said...

My Homework Help is an established online academic platform that is famous for its progressive techniques related to helping countless students across the world with their homework and assignments and other related issues. Our site is renowned for its dedicated service to its customers and is recognized by Google as one of the best sites gaining trust and appreciation in Australia, the United States of America (USA), and the United Kingdom (UK). Our aim is not only to provide utmost assistance to the students in writing and analyzing their thesis paper but also to provide assistance to the students in solving academic computer science assignments (or homework) and its critical analysis.

Unknown said...

Travis Goodspeed's blog is a great resource for tech enthusiasts. It's also important to prioritize our health, especially in cases of chronic viral bronchitis. Meri Sehat online medical services offer a convenient and reliable way to seek medical advice and manage chronic conditions from the comfort of our homes.

williamgarner said...

When you think of exams or assignments, think TestBank23, the top website to download Solution Manual For Business Statistics Global Edition 10th Edition hazzle free.

Sarfraz Ahmad said...

Really a great post. The topic you discuss is so inspiring and motivating. Thank you for the share macmillermerchstore

Rasheed Khan said...

I am grateful to this blog for providing unique and helpful knowledge on this topic. Visit us for Getting online ib O level course with best tutors. Thank You!

M.Mehar Din said...

Billionaire Boys Club Clothing Official Shop for BBC ICECREAM Fans. Get Amazing BBC Hoodies & ‎BBC T-Shirts at Official EU Store.

saran said...

"Thanks for sharing ths valuable content!.

I've found a web portal and APIs can be very useful when sending bulk SMS offers. The thing I like most about them is that they allow me to send really targeted messages based on specific criteria, which makes it easier for me to increase sales and customer satisfaction at the same time!

Click to know more:
bulk sms
bulk sms india
dlt registration
"

Hamza said...

Thank you for providing this information. Visit us for getting know about Top 10 Best WordPress SEO Plugins.

Astrovaidya said...

White Spots on the Nails are a common cosmetic concern and are usually harmless. They are also known as leukonychia and can appear as small white dots, lines, or streaks on the nails.

Fungal infections of the nails can cause white spots, along with other symptoms such as thickening, discoloration, and crumbling of the nails.

Astrovaidya said...


Dreams can often be confusing and strange, and they can be influenced by our thoughts, feelings, and experiences. Seeing dead person alive in dream may be unsettling or even frightening, but it's important to remember that dreams are not always literal representations of reality.

The appearance of a dead person in a dream can be symbolic and may represent unresolved issues or emotions related to that person.

Astrovaidya said...


Aquarius Rising Sign Meaning people who known for their independent, unconventional, and intellectual approach to life.

They may enjoy exploring new and alternative ways of thinking and being, and they may be drawn to social causes that promote equality and justice.

Rose Bell said...

Great blog post! Keep posting more updates like this! Thank You for sharing valuable thoughts with us! Hotel management is a complex and multifaceted field that involves the supervision & coordination of various activities related to hotel operations. As a hotel management student, you need to acquire knowledge & skills in several areas of the industry, including marketing, finance, operations & human resources. Many students enrolling in this course need to write management-related assignments. So, due to their busy plans, they cannot take the time to write the best tasks. In this situation, they seek the best Hotel Management Assignment Help USA Service Online from top skilled experts to obtain good marks.

Astrovaidya said...

We are the Best Astrology Service Provider in UK.

The main idea of Astrovadiya is to offer astrological forecasts online and to assist consumers to avoid customer hustle of searching for an astrologer.

We analyze birth chart, kundli Milan, Vastu Consultant, and many more.

Astrovaidya said...

Aries and Aries are both fire signs, which can create a dynamic and passionate relationship between them. However, when it comes to Aries and Aries Compatibility, there are both strengths and challenges to consider.
Aries individuals share many traits that can contribute to a strong connection. Both are energetic, ambitious, and driven, with a natural inclination towards taking the lead.
They understand and appreciate each other's need for independence and freedom, which can create a sense of mutual respect.

«Oldest ‹Older   201 – 220 of 220   Newer› Newest»