Attack jams spy cameras

Date: 18/03/2005
Source: The Age
Author: Adam Turner

An electronic invisibility cloak generated by nothing more than an off-the-shelf PDA would allow intruders to elude wireless security cameras using vulnerabilities in the most common wireless technologies.

There is no defence against such a Mission Impossible-style attack, revealed last week, which can be used to knock out wireless networks and possibly transfer unwitting users to a spoofed wireless network.

Accidentally discovered last year by PhD students at the Queensland University of Technology's Information Security Research Centre, the exploit presents obvious applications for terrorism and espionage.

The vulnerability is "trivial" to exploit and only took 30 minutes to master, says Associate Professor Mark Looi, deputy head of QUT's School of Software Engineering and Data Communications.

"It just uses off-the-shelf hardware and you don't need to write specific software, you just need to know the correct commands to use with the software that's supplied. On a difficulty rating of one to 10, it's probably a two," Looi says.

The vulnerability exists in all flavours of the 802.11b wireless protocol and some types of 802.11g, including Apple's Airport Extreme technology. It affects equipment from all manufacturers, running with all operating systems.

The exploit allows users to jam all wireless devices within a one kilometre radius using any wireless-enabled computing device and can take down an entire network in seconds if the base station is within range. The source of such an attack would be extremely difficult to trace and network recovery is immediate, making it appear to administrators as simply network congestion.

A hand-held device could be used to temporarily jam wireless security cameras or disrupt a wireless network at a critical moment to create a diversion or cover unauthorised activity. Such a device could be pre-programmed or activated remotely using GPRS.

As the exploit can be targeted at specific networks, it could be used to hijack users by jamming a wireless network and causing wireless devices to automatically detect and connect to a fake network, the default setting for most wireless devices.

"Any organisation that continues to use the standard wireless technology, 802.11b, to operate critical infrastructure could be considered negligent," Looi says.

Encryption and Medium Access Control address filtering is powerless to stop such an attack, which targets devices using Direct Sequence Spread Spectrum technology.

The vulnerability takes advantage of the collision avoidance feature used to minimise the likelihood of two devices transmitting simultaneously. It causes all devices and access points within range to behave as if the channel is always busy and defer data transmission.

"Normal frequency jamming needs high-powered, non-consumer grade equipment, but we're using existing wireless network infrastructure," Looi says. "Rather than jamming the whole frequency, we're tricking the network into thinking the network is unavailable."

The Information Security Research Centre has been working with Australia's national computer emergency response team, AusCERT, to alert manufacturers since the discovery was made last November. After six months, a defence is yet to be found.

This article may be reproduced as long as the source Footprint Home Security is provided as a link.

Back to Free Expert Advice

Back to Footprint Home Security