Who Is Peeping at Your Passwords at Starbucks? To Catch an Evil Twin Access Point DSN 2010 Yimin Song, Texas A&M University Chao Yang, Texas A&M University Guofei Gy, Texas A&M University

Agenda 2  Introduction  Analysis  Algorithm  Evaluation  Conclusion

Agenda 3  Introduction Wireless Network Review Evil Twin Attack  Analysis  Algorithm  Evaluation  Conclusion

Wireless Network Review 4  Wireless terminology AP – Access Point SSID – Service Set Identifier RSSI – Received Signal Strength Indication BSS 1 BSS 2 Internet hub, switch or router AP  CSMA/CA DIFS – Distributed Inter-Frame Spacing SIFS – Short Inter-Frame Spacing BF – Random Backoff Time sender receiver BF data SIFS ACK DIFS

Evil Twin Attack 5  A phishing Wi-Fi AP that looks like a legitimate one (with the same SSID name).  Typically occurred near free hotspots, such as airports, cafes, hotels, and libraries.  Hard to trace since they can be launched and shut off suddenly or randomly, and last only for a short time after achieving their goal.

Evil Twin Attack (cont.) 6  Related work Monitors radio frequency airwaves and/or additional information gathered at router/switches and then compares with a known authorized list. Monitors traffic at wired side and determines if a machine uses wired or wireless connections. Then compare the result with an authorization list to detect if the associated AP is a rogue one.

Agenda 7  Introduction  Analysis Network Setting in This Model Problem Description Server IAT (Inter-packet Arrival Time)  Algorithm  Evaluation  Conclusion

Network Setting in This Model 8 Table 1: Variables and settings in this model Protocol802.11b802.11g 11 Mbps54 Mbps 100 Mbps Bytes 338 Bytes 402 Bytes 375 Bytes

Problem Description 9  An evil twin typically still requires the good twin for Internet access. Thus, the wireless hops for a user to access Internet are actually increased. Fig. 1: Illustration of the target problem in this paper What statistics can be used to effectively distinguish one-hop and two-hop wireless channels on user side? Are there any dynamic factors in a real network environment that can affect such statistics? How to design efficient detection algorithms with the consideration of these influencing factors?

Server IAT 10 

Server IAT (cont.) 11  Fig. 2: Server IAT illustration in the normal AP scenario

Server IAT (cont.) 12  Fig. 2: Server IAT illustration in the normal AP scenario

Server IAT (cont.) 13 

Server IAT (cont.) 14 Fig. 5: IAT distribution under RSSI=50% Fig. 4: IAT distribution under RSSI=100%

Agenda 15  Introduction  Analysis  Algorithm TMM (Trained Mean Matching Algorithm) HDT (Hop Differentiating Technique) Improvement by Preprocessing  Evaluation  Conclusion

TMM 16  Trained Mean Matching Algorithm (TMM) requires knowing the distribution of Server IAT as a prior knowledge.  Given a sequence of observed Server IATs, if the mean of these Server IATs has a higher likelihood of matching the trained mean of two-hop wireless channels, we conclude that the client uses two wireless network hops to communicate with the remote server indicating a likely evil twin attack, and vice versa.

TMM (cont.) 17 

TMM (cont.) 18 

TMM (cont.) 19 

HDT 20 

HDT (cont.) 21 Fig. 2: Server IAT illustration in the normal AP scenario Fig. 6: 6-AP IAT illustration in the normal AP scenario

HDT (cont.) 22  Protocol802.11b802.11g 11 Mbps54 Mbps 100 Mbps Bytes 338 Bytes 402 Bytes 375 Bytes

HDT (cont.) 23 

Improvement by Preprocessing 24 

Agenda 25  Introduction  Analysis  Algorithm  Evaluation Environment Setup Datasets Effectiveness Cross Validation  Conclusion

Environment Setup 26 Fig. 8: Environment for evil twin APFig. 7: Environment for normal AP

Datasets 27 RangeAB+B-C+C-DE Upper100%80%70%60%50%40%20% Lower80%70%60%50%40%20%0% AlgorithmProtocolAB+B-C+C-D HDT g0.8%0.86%3.91%3.72%4.69%7.09% b1.38%1.44%5.61%6.17%9.42%10.36% TMM g0.62%0.68%2.59%2.66%3.30%6.02% b0.99%1.04%3.33%4.72%7.44%8.29% Table 3: The percentage of filtered packets Table 2: RSSI ranges and corresponding levels

Effectiveness 28 Table 5: False positive rate for HDT and TMM Table 4: Detection rate for HDT and TMM AlgorithmProtocolAB+B-C+C-D HDT g99.08%98.72%93.53%94.31%87.29%81.39% b99.92%99.99%99.96%99.95%96.05%94.64% TMM g99.39%99.97%99.49%99.5%98.32%94.36% b99.81%95.43%94.81%96.09%91.94%85.71% AlgorithmProtocolAB+B-C+C-D HDT g2.19%1.41%2.06%1.93%2.48%6.52% b8.39%8.74%5.39%6.96%5.27%5.15% TMM g1.08%1.76%1.97%1.48%1.75%1.73% b0.78%1%1.07%1.27%6.65%7.01%

Effectiveness (cont.) 29 Fig. 9: Cumulative probability of the number of decision rounds for HDT to output a correct result

Effectiveness (cont.) 30 Table 7: False positive rate when number of input data in one decision round is 50 Table 6: Detection rate when number of input data in one decision round is 50 AlgorithmProtocolAB+B-C+C-D multi-HDT g99.62%100% 99.95%100% b100% multi-TMM g100%99.11%98.73%99.88%95.83%88% b100% AlgorithmProtocolAB+B-C+C-D multi-HDT g0%0.77%0% b0%0.03%0.02%0.11%0.73%0.1% multi-TMM g0%0.96%0.16%0.13%0.55%0.96% b0%1.07%1.16%1.02%1.36%1.41% Table 7: False positive rate when number of input data in one decision round is 100 AlgorithmProtocolAB+B-C+C-D multi-HDT g0% b0% 0.01% 0.02%0.01% multi-TMM g0% b0% 0.02% 0.03%

Effectiveness (cont.) 31 Fig. 10: Detection rate for multi-HDT using different numbers of input data in one decision round

Cross Validation 32 Fig. 11: Detection rate for TMM under different RSSI ranges

Cross Validation (cont.) 33 Fig. 12:Detection rate under different g networks

Cross Validation (cont.) 34 Fig. 13: False positive rate under different g networks

Agenda 35  Introduction  Analysis  Algorithm  Evaluation  Discussion and Conclusion Discussion Conclusion

Discussion 36  More wired hops? Several studies showed that the delays from the wired link is not comparable to those in the wireless link. We can trade-off for more decision rounds. Use a server within small hops. Maybe use techniques similar to “traceroute” to know the wired transfer time and then exclude/subtract them to minimize the noisy effect at wired side.

Discussion (cont.) 37  Will attacker increase IAT to avoid detection? Users don’t like a slow connection.  Eq. 1: Attacker may delay the packet to reduce the SAIR  What if some evil twin AP connect to wired network instead of using normal AP? That’s our future work.

Conclusion 38  We propose TMM and HDT to detect evil twin attack where TMM requires trained data and HDT doesn’t.  HDT is particularly attractive because it doesn’t rely on trained knowledge or parameters, and is resilient to changes in wireless environments.

The End