Complexity. An introduction to protocol chaos. Andrés Blanco. CC License - Swtiruty Rgbytw

Transcription

1 Complexity An introduction to protocol chaos Andrés Blanco CC License - Swtiruty Rgbytw

2 Motivation it s everywhere

3 Motivation Radio frequency has no defined boundaries CC License - Kirthiga

4 Motivation IEEE IEEE k IEEE IEEE a IEEE n IEEE aa IEEE b IEEE p IEEE ac IEEE c IEEE r IEEE ad IEEE d IEEE s IEEE ae IEEE e IEEE T IEEE af IEEE F IEEE u IEEE mc IEEE g IEEE v IEEE ah IEEE h IEEE w IEEE ai IEEE i IEEE y IEEE aj IEEE j IEEE z protocol is growing and constantly changing

5 Motivation is growing and constantly changing

6 Motivation Managed P2P Master Wireless NICs usually support more than one mode

7 Introduction Management Association Request Association Response Reassociation Request Reassociation Response Probe Request Probe Response Beacon ATIM Disassociation Authentication Deauthentication Action Control Block ACK Request Block ACK PS-Poll RTS CTS ACK CF-End CF-End+CF-ACK Data Data Data+CF-ACK Data+CF-Poll Data+CF-ACK+CF-Poll Null CF-ACK CF-Poll CF-ACK+CF-Poll QoS data QoS data+cf-ack QoS data+cf-poll QoS data+cf-ack+cf-poll QoS Null QoS+CF-Poll QoS+CF-ACK frame types and subtypes

8 Introduction Management Association Request Association Response Reassociation Request Reassociation Response Probe Request Probe Response Beacon ATIM Disassociation Authentication Deauthentication Action Control Block ACK Request Block ACK PS-Poll RTS CTS ACK CF-End CF-End+CF-ACK Data Data Data+CF-ACK Data+CF-Poll Data+CF-ACK+CF-Poll Null CF-ACK CF-Poll CF-ACK+CF-Poll QoS data QoS data+cf-ack QoS data+cf-poll QoS data+cf-ack+cf-poll QoS Null QoS+CF-Poll QoS+CF-ACK frame types and subtypes

9 Introduction Station Beacon Probe Request Probe Response Access Point Access Point Station Authentication Authentication Access Point Station Station Association Request Association Response Data Data Access Point Access Point Association process

10 Introduction MAC Header Frame Control Duration Destination Source BSSID Seq Control 2 bytes 2 bytes 6 bytes 6 bytes 6 bytes 2 bytes Body FCS N bytes 4 bytes Management frame structure

11 Introduction Type Length Value 1 byte 1 byte N bytes Information elements are variable-length components

12 Introduction Type 0x00 Length 0x?? Value SSID 1 byte 1 byte N bytes SSID information element

13 Introduction Type 0x30 Length 0x?? Version Group Cipher Suite Pairwise Cipher Suite Count Pairwise Cipher Suite Auth. Suite Count 1 byte 1 byte 2 bytes 4 bytes 2 bytes 4 x N bytes 2 bytes Auth. Suite RSN Capa. PMK Count PMK List 4 x N bytes 2 bytes 2 bytes 16 x N bytes RSN information element

14 Length Nonsense Type 0x30 Length 0x?? Version Group Cipher Suite Pairwise Cipher Suite Count Pairwise Cipher Suite Auth. Suite Count 1 byte 1 byte 2 bytes 4 bytes 2 bytes 4 x N bytes 2 bytes Auth. Suite RSN Capa. PMK Count PMK List 4 x N bytes 2 bytes 2 bytes 16 x N bytes CVE affected at least 15 different vendors

15 Cisco

16 Cisco If Aironet IE support is enabled, the access point sends an Aironet IE 0x85 (which contains the access point name, load, number of associated clients, and so on) in the beacon and probe responses of this WLAN, and the controller sends Aironet IEs 0x85 and 0x95 (which contains the management IP address of the controller and the IP address of the access point) in the reassociation response if it receives Aironet IE 0x85 in the reassociation request. CCX Cisco documentation

17 Cisco BSS Access Point 1 Access Point 2 reassociation Station roaming

18 Cisco Access Point name and number of associated clients

19 Cisco Fake reassociation request frame

20 Cisco Reassociation response frame

21 Cisco Wireless Network Traffic could be displayed during the demo. Please disable Wi-Fi if you don t want to be part of it.

22 WiFi Alliance

23 WiFi Alliance Wi-Fi Protected Setup is an optional certification program based on technology designed to ease the setup of security-enabled Wi-Fi networks in home and small office environments. Wi-Fi Protected Setup supports methods (pushing a button, entering a PIN, or using NFC) that are familiar to most consumers to configure a network and enable security.

24 WiFi Alliance Probe Response with WPS information element

25 WiFi Alliance Disabling WPS can protect a device from some know attacks

26 WiFi Alliance Even disabling WPS doesn t disable completely

27 WiFi Alliance WPS serial numbers

28 WiFi Alliance Wireless Network Traffic could be displayed during the demo. Please disable Wi-Fi if you don t want to be part of it.

29 WiFi Alliance Wi-Fi Direct, initially called Wi-Fi P2P, is a Wi-Fi standard enabling devices to easily connect with each other without requiring a wireless access point.

30 WiFi Alliance Wi-Fi Direct information element on Probe Response frame

31 WiFi Alliance Sharing serial numbers

32 WiFi Alliance Wireless Network Traffic could be displayed during the demo. Please disable Wi-Fi if you don t want to be part of it.

33 Endianness Nonsense Big-endian is the most common format in data networking

34 Apple

35 Apple With AirPlay, you can stream music, photos, and videos to your Apple TV, or stream music to your AirPort Express or AirPlay-enabled speakers. And with AirPlay Mirroring, you can display your ios screen on your Apple TV.

36 Apple AirPlay action frame from an AppleTV 3rd Generation

37 Apple With AirDrop, you can wirelessly send photos, videos, websites, locations, and more to a nearby iphone, ipad, ipod touch, or Mac.

38 Apple AirDrop action frame from an ipod touch

39 Messy Implementations WD TV Live Media Player

40 Messy Implementations WD TV Live Media Player has WiFi Direct enabled by default

41 Protocol Complexity Messy Implementations Samsung TV authenticating a WiFi Direct connection request

42 Messy Implementations Wireless Network Traffic could be displayed during the demo. Please disable Wi-Fi if you don t want to be part of it.

43 Platform Complexity Introduction MLME stands for MAC Layer Management Entity. Examples of states a MLME may assist in reaching: Authenticate Deauthenticate Associate Disassociate Reassociate Beacon Probe Timing Synchronization Function (TSF)

44 Platform Complexity Introduction SoftMAC is a term used to describe a type of Wireless NIC where the MLME is expected to be managed in software. Kernel Wireless NIC MLME MAC PHY

45 Platform Complexity Introduction Wireless NIC FullMAC is a term used to describe a type of wireless card where the MLME is managed in hardware. MLME MAC PHY

46 Platform Complexity Android Architecture Hardware Kernel User Firmware (Broadcom) Kernel Module (Broadcom) wpa_supplicant (Jouni Malinen) Android Framework (Google)

47 Platform Complexity Architecture Analysis Firmware No symbols, bare metal binary. Shared code with some kernel modules. Segment on chipset ROM. Kernel modules Open Source. ** Kernel debugging & debug parameters. wpa_supplicant & hostapd Open Source. Debugging & client interaction. Framework Open Source. Debugging & Log analysis.

48 Platform Complexity ios Architecture Hardware Kernel User Firmware (Broadcom) Kernel Extension (Broadcom) wifid (Apple) ios Framework (Apple)

49 Platform Complexity Architecture Analysis Firmware No symbols, bare metal binary. Shared code with OS X kernel extension. Segment on chipset ROM. Kernel extensions wifid Encrypted kernel. ** Shared code between OS X and ios. Handles more than functionality. Framework Private framework.

50 Conclusions Specifications or proprietary protocols could help device fingerprinting. Specifications or proprietary protocols could break privacy features such as MAC address randomization. Bad implementations could expose devices to unauthenticated access. WD TV Live Streaming Media Player Wi-Fi Direct Unauthenticated Access - Protocol and platform complexity could lead to vulnerabilities. Broadcom BCM4325 and BCM4329 wireless chipset denial-of-service vulnerability - CVE Android WiFi-Direct DoS - CVE

51 Future Work Research other platforms and vendors. Implement Apple Bluetooth Low Energy scanning protocol on Ubertooth and extend the reverse engineering on Apple proprietary protocols. Develop a information gathering tool.

52 Questions WIG Project Repository