WNV-Detector: automated and scalable detection of wireless network vulnerabilities

Abstract

The security of wireless routers receives much attention given by the increasing security threats. In the era of Internet of Things, many devices pose security vulnerabilities, and there is a significant need to analyze the current security status of devices. In this paper, we develop WNV-Detector, a universal and scalable framework for detecting wireless network vulnerabilities. Based on semantic analysis and named entities recognition, we design rules for automatic device identification of wireless access points and routers. The rules are automatically generated based on the information extracted from the admin webpages, and can be updated with a semi-automated method. To detect the security status of devices, WNV-Detector aims to extract the critical identity information and retrieve known vulnerabilities. In the evaluation, we collect information through web crawlers and build a comprehensive vulnerability database. We also build a prototype system based on WNV-Detector and evaluate it with routers from various vendors on the market. Our results indicate that the effectiveness of our WNV-Detector, i.e., the success rate of vulnerability detection could achieve 95.5%.

WND-Identifier: Automated and Efficient Identification of Wireless Network Devices

“…Yang et al [36] collect information from the Internet to build a complete product database of IoT devices and combine rules to label network devices. WNV-Detector [37] designs general rules for accessing device webpages and parse out fine-grained information. However, the response data of network devices often contain only partial information, limiting the effectiveness and coverage of the identification.…”

“…We assume that the adversaries conduct attacks in the WLAN, and the specific behaviors can be (1) connecting unauthorized devices to the wireless network such as hidden cameras and bugs [24,47]; (2) using IoT honeypots or virtual machines to forge legitimate real devices [48,49]; (3) utilizing software to counterfeit the wireless AP, which has the same SSID and MAC address as the legitimate one, deceiving the user to connect and further performing malicious attacks [17][18][19][20]; (4) exploiting the device vulnerabilities that have been disclosed on the Internet to endanger the security of user devices and the entire platform [37,50].…”

“…Furthermore, targeted security policies can be applied to protect the security of connected devices and the entire network. For example, we can configure firewall rules for different device types contrapuntally and scan the known security vulnerabilities of the devices by searching the Internet vulnerability database with the concrete device model information [37].…”

“…Rule-based device identification aims to make full use of the natural language features in the device-info-related protocol packets to specifically label the device. Previous works use banner grabbing [21,[31][32][33][34] and rules [35][36][37] to extract textual information from devices. However, these solutions need to actively send detections to the device and collect response data for analysis, which is easily blocked by firewall rules.…”

“…In addition, the above methods cannot provide concrete device information, resulting in limited application scenarios. By contrast, rulebased identification schemes [21,[31][32][33][34][35][36][37] extract specific identification information (e.g., device vendor and product model) from the response data in the application layer to label network devices. However, the above solutions need to send requests actively, which can be easily blocked by firewall rules.…”