Wireless Intrusion Detection and Device Fingerprinting through Preamble Manipulation

Abstract

Wireless networks are particularly vulnerable to spoofing and route poisoning attacks due to the contested transmission medium. Recent works investigate physical layer features such as received signal strength or radio frequency fingerprints to localize and identify malicious devices. In this paper we demonstrate a novel and complementary approach to exploiting physical layer differences among wireless devices that is more energy efficient and invariant with respect to the environment. Specifically, we exploit subtle design differences among transceiver hardware types. Transceivers fulfill the physicallayer aspects of wireless networking protocols, yet specific hardware implementations vary among manufacturers and device types. In this paper we demonstrate that precise manipulation of the physical layer header prevents a subset of transceiver types from receiving the manipulated packet. By soliciting acknowledgments from wireless devices using a small number of packets with manipulated preambles and frame lengths, a response pattern identifies the true transceiver class of the device under test. Herein we demonstrate a transceiver taxonomy of six classes with greater than 99% accuracy, irrespective of environment. We successfully demonstrate wireless multi-factor authentication, intrusion detection, and transceiver type fingerprinting through preamble manipulation.

A PSD-based fingerprinting approach to detect IoT device spoofing

“…Some interesting works focus on the characterization of the device behaviour when faced with specific errors or alterations of the packets. For instance, in [11], the authors study the reception rate of different devices when packet headers are modified, to uniquely identify devices based on their tolerance to those modified packets. Some physical fingerprinting methods have been also proposed for specific applications or devices, for example to distinguish two brands of mobile phones [12], or in [13].…”

Efficacy of physical layer preamble manipulation for IEEE 802.11a/ac

“…The classification decision tree in Fig. 3 is a proof‐of‐concept modelled after those in [4], for IEEE 802.11b, and [7], for IEEE 802.15.4. The tree is designed using fewest states (STF length) such that the number of required test packets at each step ( n ) is minimised.…”

“…For example, wireless packets manipulated to have a physical layer preamble shorter than the protocol specification become unreceivable by some hardware designs, while reception by other hardware designs remains unaffected. Applications of this phenomenon are numerous, from obfuscated encryption key distribution [5] and wireless intrusion detection system evasion [6], to device fingerprinting [4, 7]. Once implementation differences are discovered and published, they can be immediately leveraged in conjunction with any of the millions of such devices worldwide.…”

“…Device manufacturers produce unique and proprietary transceiver designs; recent work reveals that these transceiver design idiosyncrasies can be reliably exploited [4][5][6][7]. The true hardware class of remote transceivers is determined through the use of physical layer preamble manipulation.…”

“…The true hardware class of remote transceivers is determined through the use of physical layer preamble manipulation. Promising results have been demonstrated for 2.4 GHz IEEE 802.11b [4] and IEEE 802.15.4 [5][6][7] transceivers. These novel physical layer techniques exploit design idiosyncrasies present in all like-model devices from the same manufacturer.…”