Subscribe to the gold package and get unlimited access to Shamra Academy
Register a new userOpenwifi CSI fuzzer for authorized sensing and covert channels
86
0
0.0
(
0
)
Added by
Xianjun Jiao
Publication date
2021
fields
Informatics Engineering
and research's language is
English
Ask ChatGPT about the research
No Arabic abstract
CSI (Channel State Information) of WiFi systems contains the environment channel response between the transmitter and the receiver, so the people/objects and their movement in between can be sensed. To get CSI, the receiver performs channel estimation based on the pre-known training field of the transmitted WiFi signal. CSI related technology is useful in many cases, but it also brings concerns on privacy and security. In this paper, we open sourced a CSI fuzzer to enhance the privacy and security of WiFi CSI applications. It is built and embedded into the transmitter of openwifi, which is an open source full-stack WiFi chip design, to prevent unauthorized sensing without sacrificing the WiFi link performance. The CSI fuzzer imposes an artificial channel response to the signal before it is transmitted, so the CSI seen by the receiver will indicate the actual channel response combined with the artificial response. Only the authorized receiver, that knows the artificial response, can calculate the actual channel response and perform the CSI sensing. Another potential application of the CSI fuzzer is covert channels based on a set of pre-defined artificial response patterns. Our work resolves the pain point of implementing the anti-sensing idea based on the commercial off-the-shelf WiFi devices.
rate research
Read More
To operate efficiently across a wide range of workloads with varying power requirements, a modern processor applies different current management mechanisms, which briefly throttle instruction execution while they adjust voltage and frequency to accommodate for power-hungry instructions (PHIs) in the instruction stream. Doing so 1) reduces the power consumption of non-PHI instructions in typical workloads and 2) optimizes system voltage regulators cost and area for the common use case while limiting current consumption when executing PHIs. However, these mechanisms may compromise a systems confidentiality guarantees. In particular, we observe that multilevel side-effects of throttling mechanisms, due to PHI-related current management mechanisms, can be detected by two different software contexts (i.e., sender and receiver) running on 1) the same hardware thread, 2) co-located Simultaneous Multi-Threading (SMT) threads, and 3) different physical cores. Based on these new observations on current management mechanisms, we develop a new set of covert channels, IChannels, and demonstrate them in real modern Intel processors (which span more than 70% of the entire client and server processor market). Our analysis shows that IChannels provides more than 24x the channel capacity of state-of-the-art power management covert channels. We propose practical and effective mitigations to each covert channel in IChannels by leveraging the insights we gain through a rigorous characterization of real systems.
Covert wireless communication or low probability of detection (LPD) communication that employs the noise or jamming signals as the cover to hide users information can prevent a warden Willie from discovering users transmission attempts. Previous work on this problem has typically assumed that the warden is static and has only one antenna, often neglecting an active warden who can dynamically adjust his/her location to make better statistic tests. In this paper, we analyze the effect of an active warden in covert wireless communications on AWGN channels and find that, having gathered samples at different places, the warden can easily detect Alices transmission behavior via a trend test, and the square root law is invalid in this scenario. Furthermore, a more powerful warden with multiple antennas is harder to be deceived, and Willies detection time can be greatly shortened.
This work proposes a novel framework to identify and exploit vulnerable MAC layer procedures in commercial wireless technologies for covert communication. Examples of covert communication include data exfiltration, remote command-and-control (CnC) and espionage. In this framework, the SPARROW schemes use the broadcast power of incumbent wireless networks to covertly relay messages across a long distance without connecting to them. This enables the SPARROW schemes to bypass all security and lawful-intercept systems and gain ample advantage over existing covert techniques in terms of maximum anonymity, more miles per Watts and less hardware. The SPARROW schemes can also serve as an efficient solution for long-range M2M applications. This paper details one recently disclosed vulnerability (CVD-2021-0045 in GSMA coordinated vulnerability disclosure program) in the common random-access procedure in the LTE and 5G standards This work also proposes a rigorous remediation for similar access procedures in current and future standards that disrupts the most sophisticated SPARROW schemes with minimal impact on other users.
In this paper we present methods for attacking and defending $k$-gram statistical analysis techniques that are used, for example, in network traffic analysis and covert channel detection. The main new result is our demonstration of how to use a behaviors or process $k$-order statistics to build a stochastic process that has those same $k$-order stationary statistics but possesses different, deliberately designed, $(k+1)$-order statistics if desired. Such a model realizes a complexification of the process or behavior which a defender can use to monitor whether an attacker is shaping the behavior. By deliberately introducing designed $(k+1)$-order behaviors, the defender can check to see if those behaviors are present in the data. We also develop constructs for source codes that respect the $k$-order statistics of a process while encoding covert information. One fundamental consequence of these results is that certain types of behavior analyses techniques come down to an {em arms race} in the sense that the advantage goes to the party that has more computing resources applied to the problem.
Fuzzing has become one of the most popular techniques to identify bugs in software. To improve the fuzzing process, a plethora of techniques have recently appeared in academic literature. However, evaluating and comparing these techniques is challenging as fuzzers depend on randomness when generating test inputs. Commonly, existing evaluations only partially follow best practices for fuzzing evaluations. We argue that the reason for this are twofold. First, it is unclear if the proposed guidelines are necessary due to the lack of comprehensive empirical data in the case of fuzz testing. Second, there does not yet exist a framework that integrates statistical evaluation techniques to enable fair comparison of fuzzers. To address these limitations, we introduce a novel fuzzing evaluation framework called SENF (Statistical EvaluatioN of Fuzzers). We demonstrate the practical applicability of our framework by utilizing the most wide-spread fuzzer AFL as our baseline fuzzer and exploring the impact of different evaluation parameters (e.g., the number of repetitions or run-time), compilers, seeds, and fuzzing strategies. Using our evaluation framework, we show that supposedly small changes of the parameters can have a major influence on the measured performance of a fuzzer.
Log in to be able to interact and post comments
comments
Fetching comments
Sign in to be able to follow your search criteria
