Scheme Protects Against Wireless Network Security Breach

(WiFi Alliance/Wikimedia Commons)

Computer scientists at MIT have devised a method for plugging a security gap in wireless networks that allows attackers to hijack log-on signals from network devices. MIT faculty Nickolai Zeldovich and Dina Katabi, with postdoc Nabeel Ahmed and grad student Shyam Gollakota presented their findings and demonstrated the system earlier this month at the Usenix Security Symposium in San Francisco.

The method developed by the MIT team addresses a type of attack known as man-in-the-middle (MITM; there’s no pretense of gender neutrality in the hacker community), where the attacker tries to broadcast his own encryption key at the exact moment that the exchange of encryption keys establishing a secure connection takes place. If the attacker is successful, one or both of the devices will mistake the attacker for the legitimate user, and he will be able to intercept their transmissions.

MITM attacks take place most frequently on public or shared Wi-Fi networks, such as those offered by hotels and libraries, where a password is required for access, but the password is readily distributed. Also vulnerable are home networks with no or weak password protection.

These attacks succeed by drowning out the signals of legitimate users. The MIT team’s approach counters the attack by detecting the drowning-out attempt. The legitimate sender, after transmitting its encryption key, sends a second string of numbers related to the key by a recognized mathematical operation.

The scheme adds another wrinkle: The additional string of numbers is sent as alternating bursts of radiation and silences, while the key is converted to a wireless signal in the traditional way. Attempts to mimic the additional number string, will also have to precisely copy the sequence of radiation and silences. Anything less than complete replication of the second numerical string results in transmitting during the prescribed silences, which would tip-off the receiver that a hijack attempt was underway.

While this wireless pairing scheme, as it is called, was designed for Wi-Fi networks, the developers say it can be applied to wider electronic networks, such as cellular telephone and 4G mobile technology. In fact, also earlier this month, 4G and CDMA mobile telephone transmissions were reportedly hacked at the DEFCON 19 conference of computer hackers, using an MITM attack.

Read more: First Flaw Reportedly Found in Advanced Encryption Standard

*     *     *