Security Issues in the Optimized Link State Routing Protocol version 2 (OLSRv2)

Transcription

1 Seurity Issues in the Optimize Link Stte Routing Protool version 2 (OLSRv2) Thoms Heie Clusen, Ulrih Hererg To ite this version: Thoms Heie Clusen, Ulrih Hererg. Seurity Issues in the Optimize Link Stte Routing Protool version 2 (OLSRv2). [Reserh Report] RR-7218, INRIA <inri > HAL I: inri Sumitte on 1 Mr 2010 HAL is multi-isiplinry open ess rhive for the eposit n issemintion of sientifi reserh ouments, whether they re pulishe or not. The ouments my ome from tehing n reserh institutions in Frne or ro, or from puli or privte reserh enters. L rhive ouverte pluriisiplinire HAL, est estinée u épôt et à l iffusion e ouments sientifiques e niveu reherhe, puliés ou non, émnnt es étlissements enseignement et e reherhe frnçis ou étrngers, es lortoires pulis ou privés.

2 INSTITUT NATIONAL DE RECHERCHE EN INFORMATIQUE ET EN AUTOMATIQUE Seurity Issues in the Optimize Link Stte Routing Protool version 2 (OLSRv2) Thoms Clusen, Ulrih Hererg N 7218 Ferury 2010 pport e reherhe ISSN ISRN INRIA/RR FR+ENG

3

4 Seurity Issues in the Optimize Link Stte Routing Protool version 2 (OLSRv2) Thoms Clusen, Ulrih Hererg Thème : COM Systèmes ommunints Équipe-Projet Hiperom Rpport e reherhe n 7218 Ferury pges Astrt: Moile A ho NETworks (MANETs) re leving the onfines of reserh lortories, to fin ple in rel-worl eployments. Outsie speilize omins (militry, vehiulr, et.), ity-wie ommunity-networks re emerging, onneting regulr Internet users with eh other, n with the Internet, vi MANETs. Growing to enompss more thn hnful of truste prtiipnts, the question of preserving the MANET network onnetivity, even when fe with reless or mliious prtiipnts, rises, n must e resse. A first step towrs proteting MANET is to nlyze the vulnerilities of the routing protool, mnging the onnetivity. By unerstning how the lgorithms of the routing protool operte, n how these n e exploite y those with ill intent, ountermesures n e evelope, reying MANETs for wier eployment n use. This memornumtkes n strt look t the lgorithms tht onstitute the Optimize Link Stte Routing Protool version 2 (OLSRv2), n ientifies for eh protool element the possile vulnerilities n ttks in ertin wy, provies ookook for how to est ttk n opertionl OLSRv2 network, or for how to proee with eveloping protetive ountermesures ginst these ttks. Key-wors: Seurity, OLSR, OLSRv2, MANET, Vulnerility Anlysis LI - Eole Polytehnique, Thoms@ThomsClusen.org LI - Eole Polytehnique, Ulrih@Hererg.nme Centre e reherhe INRIA Sly Île-e-Frne Pr Orsy Université 4, rue Jques Mono, ORSAY Ceex Téléphone :

5 Seurity Issues in the Optimize Link Stte Routing Protool version 2 (OLSRv2) Résumé : Les réseux moiles MANETs (Moile A ho NETworks) sortent es lortoires e reherhe pour être éployés ns le mone réel. Outre les pplitions spéilisées (militires, véhiulires et.), es réseux ommunutires urins émergent pour onneter es simples utilisteurs Internet à utres utilisteurs et à Internet vi MANETs. Pour supporter un nomre roissnt utilisteurs u-elà une poignée e prtiipnts e onfine, l question e préserver l onnetivité es réseux MANET fe à es utilisteurs impruents ou mliieux se pose. Un premier ps vers l protetion e MANET est nlyser les vulnérilités u protoole e routge qui gère l onnetivité. En omprennt en profoneur omment les lgorithmes u protoole e routge opèrent et omment ils peuvent être exploités pr es utilisteurs inélits, es ontre-mesures peuvent être éveloppées fin e renre MANET prêt à être éployé à plus grne éhelle. Ce rpport exmine e mnière oneptuelle les lgorithmes qui onstituent le protoole OLSRv2 (Optimize Link Stte Routing Protool version 2) et pour hque élément u protoole ientifie les éventuelles vulnérilités et ttques possiles. En quelque sorte, le rpport proure un mnuel sur l meilleure fçon ttquer un réseu OLSRv2 opértionnel, mis ussi sur les méthoes pour évelopper les ontre-mesures pour se protéger e es ttques. Mots-lés : Seurity, OLSR, OLSRv2, MANET, Vulnerility Anlysis

6 Seurity Issues in OLSRv2 3 1 Introution OLSRv2 (the Optimize Link Stte Routing Protool version 2) [1], [2], [3], [4], [5] is suessor to the wiely eploye OLSR [6] routing protool for MANETs (Moile A ho NETworks). OLSRv2 retins the sme si lgorithms s its preeessor, however offers vrious improvements, e.g. moulr n flexile rhiteture llowing extensions, suh s for seurity, to e evelope s -ons to the si protool. The evelopments reflete in OLSRv2 hve een motivte y inrese rel-worl eployment experienes, e.g. from networks suh s FunkFeuer [7], n the requirements presente for ontinue suessful opertion of these networks. With prtiiption in suh networks inresing (the FunkFeuer ommunity network hs, e.g., roughly 400 iniviul prtiipnts), operting with the ssumption, tht prtiipnts n e truste to ehve in non-estrutive wy, is utopi. Tking the Internet s n exmple, s prtiiption in the network inreses n eomes more iverse, more efforts re require to preserve the integrity n opertion of the network. Most SMTP-servers were, e.g., initilly ville for use y ll n sunry on the Internet with n inrese popule on the Internet, ttks n uses use the reommene prtie is toy to require uthentition n ounting for users of suh SMTP servers [8]. A first step towrs hrening ginst ttks isrupting the onnetivity of network, is to unerstn the vulnerilities of routing protool, mnging the onnetivity. This memornum therefore nlyzes OLSRv2, to unerstn its inherent vulnerilities n resilienes. The uthors o not lim ompleteness of the nlysis, ut hope tht the ientifie ttks, s presente, form meningful strting-point for eveloping seure OLSRv2 networks. 1.1 OLSRv2 Overview OLSRv2 ontins three si proesses: Neighorhoo Disovery, MPR Flooing n Link Stte Avertisements, esrie in the elow with suffiient etils for elorting the nlysis in ltter setions of this memornum Neighorhoo Disovery Neighorhoo Disovery is the proess, wherey eh router isovers the routers whih re in iret ommunition rnge of itself (1-hop neighors), n etets with whih of these it n estlish i-iretionl ommunition. Eh router sens HELLOs, listing the ientifiers of ll the routers from whih it hs reently reeive HELLO, s well s the sttus of the link (her, verifie i-iretionl). A router reeiving HELLO from neighor, in whih inites to hve reently reeive HELLO from, onsiers the link - to e i-iretionl. As lists ientifiers of ll its neighors in its HELLO, lerns the neighors of its neighors (2-hop neighors) through this proess. HELLOs re sent perioilly, however ertin events my trigger non-perioi HELLOs. RR n 7218

7 4 T. Clusen, U. Hererg MPR Flooing MPR Flooing is the proess wherey eh router is le to, effiiently, onut network-wie rosts. Eh router esigntes, from mong its i-iretionl neighors, suset (MPR set) suh tht messge trnsmitte y the router n relye y the MPR set is reeive y ll its 2-hop neighors. MPR seletion is enoe in outgoing HELLOs. Routers my express, in their HELO messges, their willingness (integer etween 1 will never n 7 will lwys ) to e selete s MPR, whih is tken into onsiertion for the MPR lultion, n whih is useful for exmple when n OLSRv2 network is plnne. The set of routers hving selete given router s MPR is the MPR-seletor-set of tht router. A stuy of the MPR flooing lgorithm n e foun in [9] Link Stte Avertisement Link Stte Avertisement is the proess wherey routers re etermining whih link stte informtion to vertise through the network. Eh router must vertise, t lest, ll links etween itself n its MPR-seletor-set, in orer to llow ll routers to lulte shortest pths. Suh link stte vertisements re rrie in TCs, rost through the network using the MPR flooing proess esrie ove. As router selets MPRs only from mong i-iretionl neighors, links vertise in TC re lso i-iretionl n routing pths lulte y OLSRv2 ontin only i-iretionl links. TCs re sent perioilly, however ertin events my trigger non-perioi TCs. 1.2 Link Stte Vulnerility Txonomy Proper funtioning of OLSRv2 ssumes tht (i) eh router n quire n mintin topology mp, urtely refleting the effetive network topology; n (ii) tht the network onverges, i.e. tht ll routers in the network will hve suffiiently ientil topology mps. An OLSRv2 network n e isrupte y reking either of these ssumptions, speifilly () routers my e prevente from quiring topology mp of the network; () routers my quire topology mp, whih oes not reflet the effetive network topology; n () two or more routers my quire inonsistent topology mps. 1.3 OLSRv2 Attk Vetors Besies rio jmming, ttks on OLSRv2 onsist of mliious router injeting orretly looking, ut invli, ontrol trffi (TCs, HELLOs) into the network. A mliious router n either () lie out itself (its ID, its willingness to serve s MPR), heneforth Ientity Spoofing or () lie out its reltionship to other routers (preten existene of links to other routers), heneforth Link Spoofing. Suh ttks will in-fine use isruption in the Link Stte Avertisement proess, through trgeting the MPR Flooing mehnism, or y using inorret link stte informtion to e inlue in TCs, using routers to hve inomplete, inurte or inonsistent topology mps. In ifferent lss of ttks, mliious router injets ontrol trffi, tune to use n in-router resoure exhustion, e.g. y using the lgorithms lulting routing tles INRIA

8 Seurity Issues in OLSRv2 5 or MPR sets to e invoke ontinuously, preventing the internl stte of the router from onverging. 1.4 Memornum Outline The reminer of this memornum is orgnize s follows: setion 2, 3, 4 n 5 eh represents lss of isruptive ttks ginst OLSRv2, etiling numer of ttks in eh lss. Setion 6 summrizes inherent resiliene, s oserve in OLSRv2, n the memornum is onlue in setion 7. 2 Topology Mp Aquisition Topology Mp Aquisition reltes to the ility for ny given router in the network to quire representtion of the network onnetivity. A router, unle to quire topology mp, is inple of lulting routing pths n prtiipting in forwring t. Topology mp quisition n e hinere y () TCs to not eing elivere to (ll) routers in the network, suh s wht hppens in se of Flooing Disruption, or () in se of jmming of the ommunition hnnel. 2.1 Flooing Disruption MPR seletion (setion 1.1.2) uses informtion out router s 1-hop n 2- hop neighorhoo, ssuming tht (i) this informtion is urte, n (ii) ll 1-hop neighors re eqully pt s MPR. Thus, mliious router seeking to ttk the MPR Flooing proess will seek to mnipulte the 1-hop n 2-hop neighorhoo informtion in router suh s to use the MPR seletion to fil Flooing Disruption ue to Ientity Spoofing Figure 1() illustrtes network in whih the mliious router (gry irle) spoofs the ientity of, i.e. reeives HELLOs from two routers, oth pretening to e. As HELLOs re itive, n with the mliious router not vertising ny neighors, the topologil view of the 1-hop n 2-hop neighorhoo of is unffete y the presene of : s MPR seletion will funtion orretly y seleting (if using greey lgorithm). e e spoofs spoofs () The gry mliious router spoofs ress of () The mliious router spoofs ress of n vertises link to Figure 1: Ientity Spoofing: flooing ttk: 1-hop ress uplition. Figure 1() illustrtes network in whih the mliious router (gry irle) spoofs the ientity of. In this exmple, link (the otte line) etween RR n 7218

9 6 T. Clusen, U. Hererg n is orretly etete n vertise y. Router will reeive HELLOs initing tht links exist from to oth e n, therey renering nite MPR on pr with. If oes not forwr flooe trffi (i.e.oes not ept MPR seletion), its presene entils flooing isruption: seleting over reners unrehle y flooe trffi. In orer to inrese the likelihoo tht the mliious is selete, it my set its willingess to 7 (mx), ensuring tht it is lwys selete n the routers so overe re not further onsiere in the MPR seletion lgorithm. spoofs x x Figure 2: Ientity Spoofing: flooing ttk: 2-hop ress uplition. Figure 2 illustrtes network in whih the mliious router (gry irle) spoofs the ientity of x, i.e. n oth reeive HELLOs from router pretening to e x. From the point of view of, it ppers s if n hve the sme neighor set, hene either is suitle hoie s MPR. Assuming tht selets s MPR, will not rely flooe trffi n thus the legitimte (white) x (n routers to the right of x) will not reeive flooe trffi. In orer to mximize the impt of the isruption, the mliious router my simultneously spoof multiple ientities: y overhering ontrol trffi for while, the mliious router my ttempt to lern the ientities of neighors of n spoof these n, in ition, ssume one itionl ientity (possily not otherwise present in the network). A wy of hieving this is to simply hve overher ll TCs, n spoof ll ientities of ll routers in the network (possily exluing ). Router will lern through the HELLOs of tht ll these ientities re 2-hop neighors of. As the set of ientities spoofe y the mliious is superset of the neighors of, this will use seletion of s MPR, n onsequently tht is not selete. x spoofs x Figure 3: Ientity Spoofing: flooing ttk: 1 n 2-hop ress uplition. Figure 3 illustrtes network in whih the mliious router (gry irle) spoofs the ientity of x, i.e. n oth reeive HELLOs from router pretening to e x. Router will therefore not selet s MPR s ll the 2-hop neighors rehle vi re lrey rehle iretly in one hop. As onsequene, the white x, n ny routers to the left of it, will not reeive flooe ontrol trffi from or trnsite vi from e.g.. INRIA

10 Seurity Issues in OLSRv Flooing Disruption ue to Link Spoofing Figure 4() illustrtes network, in whih the mliious router spoofs links to the non-existing, i.e. reeives HELLOs from, pretening the existene of link etween n. This fores to selet s MPR wheres it otherwise woul not nee to selet ny MPRs. In this simple exmple, this oes no hrm s suh. () Bsi Link Spoofing effet on MPR Seletion s w () Flooing isruption ue to Link Spoofing Figure 4: Link Spoofing: Flooing Disruption Figure 4() illustrtes network, in whih the mliious spoofs links to the existing, s well s to non-existing w. Router reeives HELLO from reporting links to n w, n from reporting link to only. Unless if hs vertise willingness of 7, this will use to selet s its only MPR, s presumly overs ll 2-hop neighors of (i.e.the rel neighors of s well s the imginry w). The onsequene is tht s will not selet s MPR, will not rely flooe messges reeive from. Thus, the network to the left of (strting with ) will not reeive ny flooe messges from or trnsiting, suh s messge originting from s n trnsiting through. 2.2 Rio Jmming Rio jmming is n ttk in whih legitimte ess to the ommunitions hnnel etween routers is forefully hinere y mliious evie. The lssi exmple hereof is where powerful trnsmitter is generting white noise over the ommunitions hnnel where the network interfes of the routers woul otherwise operte, effetively preventing these router interfes from suessfully reeiving trnsmissions from eh other. While this n hppen on ll network interfe n hnnel types, wireless networks re espeilly vulnerle to suh; ommeril WiFi jmmers re, for exmple, reily ville [10]. The onsequene of suh jmming is tht the router interfes, whih re so jmme, re unle to reeive routing protool ontrol trffi, n so re unle to prtiipte in the network. A router where ll its network interfes re vitim to jmming is, effetively, unle to quire topology mp of the network n, so, is isonnete from the network. It n e oserve tht router with multiple network interfes essing ifferent ommunitions hnnels, n where not ll ommunitions hnnels re jmme, my still e le to prtiipte in network vi links over these non-jmme interfes. RR n 7218

11 8 T. Clusen, U. Hererg Figure 5: Rio Jmming: is jmming reeption within the grye-out re, thus is unle to orretly reeive trnsmission. It n lso e oserve tht while iret jmming ffets reeption, it my (epening on whih lower lyers L1/L2 re employe) not ffet trnsmission. Thus, n s illustrte in figure 5,, my reeive trnsmissions from, the ltter of whih is otherwise jmme y, whih prevents reeptions in the grye re. The Neighorhoo Disovery mehnism of OLSRv2 ientifies uni- n iiretionlity of links, n only i-iretionl links re vertise n use for routing pth lultions. OLSRv2 hs, thus, y virtue of this etetion n use of only i-iretionl links, some resiliene to jmming: while the jmme routers re unle to quire n mintin topology mp of the network, the jmme routers pper s simply isonnete to the un-jmme prt of the network whih is le to oth mintin urte n onsistent topology mps. 2.3 Attk on Jittering OLSRv2 inorportes jittering: rnom, ut oune, ely on outgoing ontrol trffi. This my e neessry when link lyers (suh s [11]) re use, whih o not gurntee ollision-free elivery of frmes, n where jitter n reue the proility of ollisions of frmes on lower lyers is [1]. In OLSRv2, TC forwring is jittere y vlue etween 0 n MA_JITTER. In figure 6, router reeives three pkets, eh ontining one TC to e forwre. For eh of these, the sheule retrnsmission time is lulte s now plus jitter, illustrte y the horizontl rrows. In orer to reue the numer of trnsmissions, when ontrol messge is ue for trnsmission, OLSRv2 piggygs ll queue messges into single trnsmission. Thus, if mliious router sens mny TCs within very short time intervl, the jitter time of the ttke router tens to 0. This reners jittering ineffetive n n le to ollisions on L Hop-ount n Hop-limit Attks The hop-ount n hop-limit fiels re the only prts of TC tht re moifie when forwring. A mliious router n moify either of these when, when forwring TCs Moifying the Hop Limit A mliious router n erese the hop limit when forwring TC. This will reue the sope of forwring the messge, n my le to some routers in INRIA

12 Seurity Issues in OLSRv2 9 pket inoming effetive tx time of ll messges sheule tx time time Figure 6: Jittering: If severl messges re sheule to e trnsmitte, ll the messges re sent t the minimum of the sheule trnsmission times. the network not reeiving tht TC. Note tht this is not neessrily the sme s not relying the messge (i.e. setting the hop limit to 0), s illustrte in figure 7. TC TC Figure 7: Hop limit ttk A TC rrives t n is forwre y, suh tht it is reeive y oth n the mliious. n forwr the TC without ny ely (inluing without jitter) suh tht its trnsmissions rrives efore tht of t. Before forwring, it signifintly reues the hop limit of the messge. Router reeives the TC, proesses (n forwrs) it, n mrks it s lrey reeive - using it to isr further opies reeive from. Thus, if the TC is forwre y, it hs very low hop limit n will not reh the whole network Moifying the Hop Count A mliious router n moify the hop ount when forwring TC. This my hve two onsequenes: (i) if the hop ount is set to the mximum vlue, then the TC will e forwre no further y, or (ii) rtifiilly mnipulting the hop ount my ffet the vliity time s lulte y reipients, when using istne-epenent vliity times s efine in [3] (e.g.s prt of fish-eye extension to OLSR2 [12]). v_time(3hops): 6s TC v_time(2hops): 4s v_time(1 hop): 2s Figure 8: Different vliity times se on the istne in hops In figure 8, sens TC with vliity time of two seons for neighors tht re one hop wy, four seons for routers in two-hop istne n six seons in three-hop istne. If is mliious router n moifies the RR n 7218

13 10 T. Clusen, U. Hererg hop ount (sy, y eresing it to 0), then will lulte the vliity time of reeive informtion to two seons fter whih it expires unless refreshe. If TCs from re sent less frequently thn tht up to 3 hops, this uses links vertise in suh TCs to e only intermittently ville to. 3 Effetive Topology Link-stte protools ssume tht eh router n quire n urte topology mp, refleting the effetive network topology. This implies tht the routing protool, through its messge exhnge, ientifies pth from soure to estintion, n this pth is vli for forwring t trffi. If n ttker isturs the orret protool ehvior, the pereive topology mp of router n permnently iffer from the effetive topology. Consiering the exmple in figure 9(), whih illustrtes the topology mp s quire y s. This topology mp inites tht the routing protool hs ientifie tht for s, pth exists to vi, whih it therefore ssumes n e use for trnsmitting t. If, effetively, oes not forwr t trffi from s, then the topology mp in s oes not urtely reflet the effetive network topology. Rther, the effetive network topology from the point of view of s woul e s inite in figure 9(): is not prt of the network rehle from router s. s s () Pereive topology y s () Effetive topology Figure 9: Inorret Dt Trffi Forwring 3.1 Inorret Forwring OLSRv2 routers exhnge informtion using link-lol trnsmissions (link-lol multist or limite rost) for their ontrol messges, with the routing proess in eh router retrnsmitting reeive messges estine for networkwie iffusion. Thus, if the operting system in router is not onfigure to enle forwring, this will not ffet the operting of the routing protool, or the topology mp quire y the routing protool. It will, however, use isrepny etween the effetive topology n the topology mp, s inite in figure 9() n figure 9(). This sitution is not hypothetil. A ommon error seen when eploying OLSRv2 se networks using Linux-se omputers s router is to neglet enling IP forwring. 3.2 Wormholes A wormhole, epite in the exmple in figure 10, my e estlishe etween two ollorting evies, onnete y n out-of-n hnnel; these evies sen trffi through the tunnel to their lter-ego, whih replys the trffi. Thus, n s pper s-if iret neighors n rehle from eh other in INRIA

14 Seurity Issues in OLSRv hop through the tunnel, with the pth through the MANET eing 100 hops long. 100 hop long pth s 1 hop long pth vi "wormhole" Figure 10: Wormholing etween two ollorting evies not prtiipting in the routing protool. The onsequenes of suh wormhole in the network epens on the etile ehvior of the wormhole. If the wormhole relys only ontrol trffi, ut not t trffi, the sme onsiertions s in setion 3.1 pplies. If, however, the wormhole relys ll trffi, ontrol n t like, it is onnetivity-wise ientil to usle link n the routing protool will orretly generte topology mp refleting the effetive network topology. The effiieny of the topology so otine epens on (i) the wormhole hrteristis, (ii) how the wormhole presents itself n (iii) how pths re lulte. Assuming tht pths re lulte with unit-ost for ll links, inluing the link presente y the wormhole: if the rel hrteristis of the wormhole re s-if it ws pth of more thn 100 hops (e.g. with respet to ely, nwith,...), then the presene of the wormhole results in egrtion in performne s ompre to using the non-wormhole pth. Conversely, if the link presente y the wormhole hs etter hrteristis, the wormhole results in improve performne. If pths re lulte using non-unit-osts for ll links, n if the ost of the link presente y the wormhole orretly represents the tul ost (e.g. if the ost is estlishe through mesurements ross the wormhole), then the wormhole my in the worst se use no egrtion in performne, in the est se improve performne y offering etter pth. If the ost of the link presente y the wormhole is misrepresente, then the sme onsiertions s for unit-ost links pply. An itionl onsiertion with regrs to wormholes is, tht suh my present topologilly ttrtive pths for the network however it my e unesirle to hve t trffi trnsit suh pth: n ttker oul, y virtue of introuing wormhole, quire the ility to reor n inspet trnsiting t trffi. 3.3 Sequene Numer Attks OLSRv2 uses two ifferent sequene numers in TCs, to (i) voi proessing n forwring the sme messge more thn one (Messge Sequene Numer), n (ii) to ensure tht ol informtion, rriving lte ue to e.g. long pths or other elys, is not llowe to overwrite fresher informtion (Avertise Neighor Sequene Numer ANSN). RR n 7218

15 12 T. Clusen, U. Hererg Messge Sequene Numer An ttk my onsist of mliious router spoofing the ientity of nother router in the network, n trnsmitting lrge numer of TCs, eh with ifferent Messge Sequene Numers. Susequent TCs with the sme sequene numers, originting from the router whose ientity ws spoofe, woul thene e ignore, until eventully informtion onerning these spoofe TCs expires Avertise Neighor Sequene Numer (ANSN) An ttk my onsist of mliious router spoofing the ientity of nother router in the network, n trnsmitting single TC, with n ANSN signifintly lrger thn tht whih ws lst use y the legitimte router. Routers will retin this lrger ANSN s the most fresh informtion n isr susequent TCs with lower sequene numers s eing ol. 3.4 Messge Timing Attks In OLSRv2, eh ontrol messge my ontin expliit vliity time n intervl time, ientifying the urtion for whih informtion in tht ontrol messge shoul e onsiere vli until isre, n the time until the next ontrol messge of the sme type shoul e expete [3] Intervl Time Attk A use of the expete intervl etween two suessive HELLOs is for etermining the link qulity in Neighor Disovery proess, s esrie in [6]: if messges re not reeive with the expete intervls (e.g. ertin frtion of messges re missing), then this my e use to exlue link from eing onsiere s useful, even if (some) i-iretionl ommunition hs een verifie. If mliious spoofs the ientity of n existing, n sens HELLOs initing very low intervl time, reeiving this HELLO will expet the following HELLO to rrive within the intervl time inite or otherwise, erese the link qulity for the link -. Thus, my use s estimte of the link qulity for the link - to fll elow the limit, where it is no longer onsiere s useful n, thus, not use Vliity Time Attk A similr ttk with respet to the intervl time ttk uses the vliity time inlue in HELLO n TCs. The vliity time efines how long the informtion ontine in the messge shoul e onsiere s vli. After this time, the reeiving router must onsier the messge ontent to no longer e vli (unless repete in lter messge) [3]. A mliious router,, n spoof the ientity of n sen HELLO using very low vliity time (e.g. 1 ms)., reeiving this, will isr the informtion upon expirtion of tht intervl, i.e. link - will e torn own y. INRIA

16 Seurity Issues in OLSRv Iniret Jmming Iniret Jmming is n ttk in whih mliious router is, y its tions, using legitimte routers to generte inorinte mounts of ontrol trffi, therey inresing oth hnnel ouption n the overhe inurre in eh router for proessing this ontrol trffi. This ontrol trffi will e originte from legitimte routers, thus to the wier network, the mliious evie my remin unetete. The generl mehnism wherey mliious evie n use iniret jmming is for it to prtiipte in the protool y generting plusile ontrol trffi, n to tune this ontrol trffi to in turn trigger reeiving routers to generte itionl trffi. For OLSRv2, suh n iniret ttk n e irete t, respetively, the Neighorhoo Disovery mehnism n the Link Stte Avertisement mehnism Iniret Jmming: Neighorhoo Disovery An iniret jmming ttk on the Neighorhoo Disovery proess is illustrte in figure 11. MPRs: () MPRs: () Inite s SYM Inite s LOST t 0 t 1 t 2 t 3 Figure 11: Iniret Jmming in Neighorhoo Disovery: the mliious spoofs link to, flipping etween link sttus SYM n LOST. A mliious router,, vertises in HELLO tht it hs s link to, with sttus SYM (t 0 ). This will use, upon reeiving this HELLO, to onsier s 2-hop neighor, n relulte its MPR set seleting s MPR. This MPR seletion is signle y in susequent HELLO (t 1 ). Upon reeipt of this HELLO from, vertises in HELLO tht the link to is LOST (t 2 ). This will use, upon reeiving this HELLO, to no longer onsier s 2-hop neighor, n relulte its MPR set oringly, i.e. to no longer ontin. This new MPR set in is signle in susequent HELLO (t 3 ). Upon hving reeive this HELLO from, it my repet the yle, lternting vertising the link - s LOST n SYM. In orer to mximize the impt of the isruption use y this ttk, shoul ensure tht the router, to whih it lterntively vertises link s SYM or LOST, is not otherwise present in the 2-hop neighorhoo for exmple y vertising router not otherwise present in the network. Tht wy, ll neighors reeiving HELLO from will selet s MPR. A wy of omplishing this is to hve lern ll ientities in the network y overhering RR n 7218

17 14 T. Clusen, U. Hererg ll TCs n seleting (spoofing) n ientity not lrey present. will inite its willingness to e non-zero (thus, epting eing selete s MPR) n prtiipte in the Neighorhoo Disovery proeure n my ignore ll other protool opertions, while still remining effetive s n ttker. An esier version of this ttk is to hve simply e present in the network, n prtiipte in the Neighorhoo Disovery proeure. Without spoofing link to nother router, lterntes its willingness s vertise in suessive HELLO trnsmissions etween zero (will never e selete s MPR) n 7 (will lwys e selete s MPR). The impt of this version of the ttk is s ove: MPR set relultion n vertisement y neighors of the. The si Neighorhoo Disovery proess of OLSRv2 employs perioi messge emissions, n y this ttk it n e ensure tht for eh messge exhnge etween n, the MPR set in is relulte. As lultion of n optiml MPR set is known to e NP-hr [13], this lone my use internl resoure exhustion in. If the routers in the network hve triggere HELLOs enle, n tht suh re triggere y MPR set uptes (s suggeste in setion 9 in [5]) this ttk my lso use n inrese HELLO frequeny. A minimum messge intervl (typilly muh smller thn the regulr perioi messge intervl) is impose, to rte-limit worst-se messge emissions. This ttk n use the HELLO intervl to, permnently, eome equl to the minimum messge intervl. [5] proposes tht efult tht the minimum HELLO intervl e 1 4 HELLO intervl. Iniret Jmming of the Neighorhoo Disovery proess y mliious router n thus hve two effets: to use inrese frequeny of HELLO genertion n trnsmission y neighors of the mliious router, i.e. up to two hops wy from the mliious router, n to use itionl MPR set lultion in the routers whih re neighors of mliious router Iniret Jmming: Link Stte Avertisement The most effiient Iniret Jmming ttk in OLSRv2 is to trget ontrol trffi, estine for network-wie iffusion. This is illustrte in figure 12. ANS={} ANSN++ TC: (-) ANSN ANS={} ANSN++ TC: () ANSN Selet s MPR Inite s LOST t 0 t 1 t 2 t 3 Figure 12: Iniret Jmming in Link Stte Avertisement: the mliious flips etween link sttus MPR n LOST. The mliious selets the s MPR (t 0 ) in HELLO. This uses to pper s MPR seletor for n, onsequently, sets to e vertise in its Neighor Set n inrements the ssoite Avertise Neighor Sequene Numer (ANSN). must, then, vertise the link etween itself n in susequent outgoing TCs (t 1 ), lso inluing the ANSN in suh TCs. Upon INRIA

18 Seurity Issues in OLSRv2 15 hving reeive this TC, it elres the link etween itself n s no longer vli (t 2 ) in HELLO (initing the link to s LOST). Sine only symmetri links re vertise y OLSRv2 routers, will upon reeipt hereof remove from the set of vertise neighors n inrement the ANSN. will then in susequent TCs vertise the remining set of vertise neighors (i.e. with remove) n the orresponing ANSN (t 3 ). Upon hving reeive this informtion in nother TC from, it my repet this yle, lternting vertising the link - s LOST n s MPR. Routers reeiving TC will prse n proess this messge, speifilly upting their topology mp s onsequene of suessful reeipt. If the ANSN etween two suessive TCs from the sme router hs inremente, then the topology hs hnge n routing tles re to e relulte. This is potentilly omputtionlly ostly opertion [14]. A mliious router my hose to onut this ttk ginst ll its neighors, thus ttining mximum isruptive impt on the network with reltively little overhe of its own: other thn prtiipting in the Neighorhoo Disovery proeure, the mliious router will monitor TCs generte y its neighors n lternte the vertise sttus for eh suh neighor, etween MPR n LOST. The mliious router will inite its willingness to e zero (thus, voi eing selete s MPR) n my ignore ll other protool opertions, while still remining effetive s n ttker. The si opertion of OLSRv2 employs perioi messge emissions, n y this ttk it n e ensure tht eh suh perioi messge will entil routing tle relultion in ll routers in the network. If the routers in the network hve triggere TCs enle, this ttk my lso use n inrese TC frequeny. Triggere TCs re intene to llow (stle) network to hve reltively low TC emission frequenies, yet still llow link rekge or link emergene to e vertise through the network rpily. A minimum messge intervl (typilly muh smller thn the regulr perioi messge intervl) is impose, to rte-limit worst-se messge emissions. This ttk n use the TC intervl to, permnently, eome equl to the minimum messge intervl. [5] proposes s efult tht the minimum TC intervl e 1 4 TC intervl. Iniret Jmming y mliious router n thus hve two effets: it my use inrese frequeny of TC genertion n trnsmission, n it will use itionl routing tle relultion in ll routers in the network. 4 Inonsistent Topology Inonsistent topology mps n our y mliious router employing either of ientity spoofing or link spoofing for onuting n ttk ginst n OLSRv2 network. 4.1 Ientity spoofing Ientity spoofing n e employe y mliious router vi the Neighorhoo Disovery proess n vi the Link Stte Avertisement proess; either of whih using inonsistent topology mps in routers in the network. RR n 7218

19 16 T. Clusen, U. Hererg Inonsistent Topology Mps ue to Neighorhoo Disovery Consiering the network in figure 13, two routers in fr ens of the network oth present themselves uner the sme ientity s x. The routers jent to these two routers ( n w in figure 13) oth pereive x s iret neighor, whih will e reflete in the neighor tles n routing tles of these two routers. Thus, the first onsequene is, tht trffi estine for x from n w, respetively, will e elivere to ifferent routers. As the Neighorhoo Disovery proeure lso provies topologil informtion up to two hops wy, this is lso true for trffi estine for x from n v, respetively. x v w spoofs x Figure 13: Ientity Spoofing: router (gry irle) ssumes the ientity of router x, lote fr wy in the network. Assuming unit-ost links, the istne to x from n w, s proue y the Neighorhoo Disovery proeure, is 1 hop. The istne to x from n v, s proue y the Neighorhoo Disovery proeure, is 2 hops. As these istnes re shorter thn (or equl to) the pth lengths otine vi the Link Stte Avertisement proeure, they will therefore e preferre y,, v n w, over those quire vi the Link Stte Avertisement proeure for when lulting routing tles. Thus, if the gry router in figure 13 is the one spoofing the ientity of the white router x, then ny trffi from or trnsiting through w n estine for x will e elivere to the gry router inste of to the white x. This hs s impt tht router spoofing the ientity of nother router, n y simply prtiipting in the Neighorhoo Disovery proeure, will e le to lter the topology mps in routers up to 2 hops wy, n therey (i) ttrt the trffi from or trnsiting through routers up to two hops wy, whih is otherwise estine for the router whose ientity is eing spoofe; n (ii) prevent trffi from or trnsiting through routers up to two hops wy, whih is otherwise estine for the router whose ientity is eing spoofe, from rehing the intene estintion. Strtegi plement of mliious router spoofing the ientity of nother router (or other routers) in the network, n simply prtiipting only in the Neighorhoo Disovery proess, n therey effiiently isrupt network onnetivity. First, overhering TCs will llow the router to lern suffiient informtion esriing the network topology to evelop n ttk strtegy whih hs mximum isruptive impt. Seon, y prtiipting only in the Neighorhoo Disovery proeure (i.e. y vertising its willingness s zero, n y not seleting MPRs), n y refully seleting the ientities to spoof, the mliious router n remin iffiult to etet. Consier the exmple in figure 14: overhers n lerns the network topology. In orer to minimize the risk of etetion, it elets to not selet ny MPRs (therey no Link Stte Avertisements re sent, vertising its presene in the network) n vertises its willingness s zero (therey it is not selete s MPR n thus not require to sen Link Stte Avertisements). lso elets to spoof the ientity of,, f n g only. As oes not prtiipte in INRIA

20 Seurity Issues in OLSRv2 17 e f g spoofs:,, f, g Figure 14: Ientity Spoofing: mximizing isruptive impt while minimizing risk of etetion. the Link Stte Avertisement proess, its presene is known only to, n e, i.e. the routers whose ientity it spoofs will not reeive ontrol messges llowing them to etet tht these ientities re lso vertise elsewhere in the network. Trffi trnsiting, from either sie, to estintions,, f n g will, rther thn eing forwre to the intene estintion, e elivere to. Trffi trnsiting n with s estintion will e elivere to the intene router. Trffi trnsiting n with s estintion my e elivere to the intene router vi or to vi s the pths will e of equl length. In figure 14, is the only router whih will reeive ontrol trffi initing two topologi lotions of the ientities,. However, espeilly in wireless environment, this is not in n y itself unusul: vli link might inee exist etween n s well s etween n, e.g. through nother wireless hnnel. Thus, the topology s pereive y n e oes not pper improle. If the network grows to the left of or to the right or g, ll hs to o to ontinue isrupting the network is to lern the ientities of the routers eyon n g n lso spoof the ientities of these. In generl, for mximum isruptive impt n minimum visiility, the mliious router woul selet to spoof the ientities of ll routers whih re topologilly 3 hops or more wy from itself. Ientity spoofing y mliious router, stritly prtiipting only in the Neighorhoo Disovery proess, thus, retes sitution wherein two or more routers hve sustntilly inonsistent topology mps: trffi for n ientifie estintion is, epening on where in the network it ppers, elivere to ifferent routers Inonsistent Topology Mps ue to Link Stte Avertisements An inonsistent topology mp my lso our when the mliious router tkes prt in the Link Stte Avertisement (LSA) proeure, y seleting neighor s MPR, whih in turn vertises the spoofe ientities of the mliious router. This ttk will lter the topology mps ll routers of the network. spoofs e f Figure 15: Ientity Spoofing: mliious router spoofs the ientity of, leing to wrongly pereive topology. In figure 15, spoofs the ress of. If selets f s MPR, ll routers in the network will e informe out the link f- y the TCs originting from f. RR n 7218

21 18 T. Clusen, U. Hererg Assuming tht (the rel) selets s MPR, the link - will lso e vertise in the network, resulting in pereive topology s epite in figure 16. e f Figure 16: Ientity Spoofing: the gry mliious router spoofs the ientity of router. When lulting pths, n will lulte pths to vi, s illustrte in figure 17(); for these routers, the shortest pth to is vi. e n f will lulte pths to vi f, s illustrte in figure 17(); for these routers, the shortest pth to is vi the mliious router, n these re thus isonnete from the rel. will hve hoie: the pth lulte to vi is of the sme length s the pth vi the mliious router, s illustrte in figure 17(). spoofs f g () Routers n. () Routers e n f. spoofs e f () Router. Figure 17: Routing pths towrs, s lulte y the ifferent routers in the network in presene of mliious router, spoofing the ress of. In generl, the following oservtions n e me: The network will e split in two, with those routers loser to thn to rehing, wheres those routers loser to thn to will e unle to reh. Routers eyon, i.e. routers eyon one hop wy from will e unle to etet this ientity spoofing. The ientity spoofing ttk vi the Link Stte Avertisement proeure hs higher impt thn the ttk esrie in setion 4.1.1, sine it lters the topology mps of ll routers in the network, n not only in the 2-hop neighorhoo. However, the ttk is esier to etet y other routers in the network. Sine the mliious router is vertise in the whole network, routers whose ientities re spoofe y the mliious router n etet the ttk. For exmple, when reeives TC from f vertising the link f-, it n eue tht some entity is injeting inorret Link Stte informtion s it oes not hve f s one of its iret neighors. As the mliious router oes not itself sen the TCs, ut rther, y virtue of MPR seletion, ensures tht the resses it spoofs re vertise in TCs from its MPR seletor f, the ttk my e iffiult to ounter: simply ignoring TCs tht originte from f my lso suppress the link stte informtion for other, legitimte, MPR seletors of f. Ientity spoofing y mliious router, prtiipting in the Link Stte Avertisement proess y seleting MPRs only, thus, retes sitution wherein INRIA

22 Seurity Issues in OLSRv2 19 two or more routers hve sustntilly inonsistent topology mps: trffi for n ientifie estintion is, epening on where in the network it ppers, elivere to ifferent routers. 4.2 Link Spoofing Link Spoofing is sitution in whih router vertises non-existing links to nother router (possily not present in the network). Essentilly, TCs n HELLOs oth vertise links to iret neighor routers, with the ifferene eing the sope of the vertisement. Thus, link spoofing onsists of mliious router, reporting tht it hs s s neighors routers whih re, either, not present in the network, or whih re effetively not neighors of the mliious router. It n e note tht sitution similr to Link Spoofing my our temporrily in n OLSR or OLSRv2 network without mliious routers: if ws, ut is no more, neighor of, then my still e vertising link to for the urtion of the time it tkes for the the Neighorhoo Disovery proess to etermine this hnge neighorhoo. In the ontext of this memornum, Link Spoofing refers to persistent sitution where mliious router intentionlly vertises links to other routers, for whih it is not iret neighor Inonsistent Topology Mps ue to Neighorhoo Disovery Returning to figure 4(), MPR seletion serves to ientify whih routers re to vertise whih links in the network s prt of the Link Stte Avertisement proess.olsrv2 stipultes tht router must, s minimum, vertise links etween itself n its MPR seletors, i.e. links etween itself n the routers whih hve selete it s MPR. A router is not require to vertise other links. Thus, in the exmple network in figure 4() with seleting the mliious router s its sole MPR, only is expete to vertise links to. s selets s its MPR, thus is expete to vertise the link -S. s, then, expets to hve selete suitle MPRs for the MPR flooing proess to suee in network-wie iffusion of the vertisement of the link -s. The topology mps quire y the vrious other routers in this exmple re: Routers n will, ue to the Neighorhoo Disovery proess proviing topologil informtion up to 2 hops wy, quire n urte Topology Mp. For this is extly orresponing to the network in figure 4(). For this my or my not ontin the otte routers n w, epening on whether genertes Link Stte Avertisements (see setion 4.2.2). Router will pereive topology mp s illustrte in figure 18(): the link stte vertisements from re not forwre y, hene the existene of s n the link -s is not known eyon ; the sme is true for link stte vertisement from, shoul it prtiipte in the link stte vertisement proess. The link -, n the existene of is known to only through the Neighorhoo Disovery proess. Routers n eyon will reeive Topology Mp s illustrte in figure 18(). RR n 7218

23 20 T. Clusen, U. Hererg Router s will quire n urte Topology Mp orresponing to the network in figure 4(). This my or my not ontin the otte routers n w, epening on if router genertes Link Stte Avertisements (see setion 4.2.2). () Inonsistent Topology Mp in. () Inonsistent Topology Mp in n eyon. Figure 18: Pereive Topology Mps with performing Link Spoofing in the Neighorhoo Disovery Proess: In orer to mximize the impt of the isruption of Link Spoofing in the Neighorhoo Disovery proess, the mliious router my simultneously spoof links to multiple routers: y overhering ontrol trffi for while, my ttempt to lern the ientities of 2-hop neighors of n spoof these n, in ition, ssume t lest one itionl ientity (possily not otherwise present in the network). A wy of hieving this is to simply hve the mliious overher ll TCs, n spoof links to ll ientities of ll routers in the network, plus one ientity not otherwise present in the network. As the set of links spoofe y is thus superset of the 2-hop links s seen from, will selet s its sole MPR. e f g h i f g h i Figure 19: Link Spoofing: Mliious router spoofs links to ll routers in the network exept router e. By only prtiipting in the Neighorhoo Disovery n not the LSA proess, it is more iffiult to etet the spoofing, while in the sme time isturing the topology of the whole network. Symmetri to figure 14, figure 19 illustrtes network with is positione in the mile. If vertises links to,,,, f, g, h n i in the Neighorhoo Disovery proess, these ientities s spoofe y re visile only to e s 2- hop neighors. e my etet tht no link to is vertise y its own 1-hop neighor routers n f. Thus, to voi suh etetion y e, shoul voi spoofing links to routers vertise s 1-hop neighors y e, i.e. vertise in its HELLOs only spoofe links to,,, g, h n i, s illustrte in figure 20. The impt of this this ttk is tht: will pper s the most ttrtive nite MPR for e, y virtue of spoofing links to ll other 2-hop neighors of e n then some. Thus, sent or f initing willingness of 7, will e selete s the sole MPR of e. INRIA

24 Seurity Issues in OLSRv2 21 e f g h i g h i Figure 20: Link Spoofing: remins more iffiult to e etete when it oes not vertise spoofe links to routers t most 2 hops wy. No routers, other thn, will e requeste to sen Link Stte Avertisements, vertising links to the. No routers, other thn, will e requeste to forwr flooe trffi originting in or trnsiting through Inonsistent Topology Mps ue to Link Stte Avertisements Figure 21 illustrtes network, in whih the mliious router spoofs links to the existing router y prtiipting in the Link Stte Avertisement proess n inluing this non-existing link in its vertisements. e f g Figure 21: Link Spoofing: The mliious router vertises spoofe link to in its TCs, thus ll routers will reor oth of the links - n -. As TCs re flooe through the network, ll routers will reeive n reor informtion esriing link - in this link stte informtion. If hs selete router s MPR, will likewise floo this link stte informtion through the network, thus ll routers will reeive n reor informtion esriing link -. When lulting routing pths,, n will lulte pths to vi, s illustrte in figure 22(); for these routers, the shortest pth to is vi. f n g will lulte pths to vi, s illustrte in figure 22(); for these routers, the shortest pth to is vi, n these re thus isonnete from the rel router. e will hve hoie: the pth lulte to vi is of the sme length s the pth vi, s illustrte in figure 22(). f g () Routers, n. () Routers f n g. e f g () Router e. Figure 22: Routing pths towrs router, s lulte y the ifferent routers in the network in presene of mliious router, spoofing link to router. In generl, the following oservtions n e me: RR n 7218

25 22 T. Clusen, U. Hererg The network will e seprte in two, with those routers loser to thn to rehing, wheres those routers loser to thn to unle to reh. Routers eyon, i.e. routers eyon one hop wy from will e unle to etet this link spoofing. Returning to figure 19, if vertises spoofe links to,,,, f, g, h n i in Link Stte Avertisements, the risk of etetion y e is ientil to if these were vertise in the Neighorhoo Disovery proess: e my etet tht is vertising links to n f, while is not reore s 2-hop neighor vi neither nor f. Suppressing links to n f from eing vertise y the woul prevent e from eteting tht is mliious. However, upon reeiving Link Stte Avertisement, router is le to etet if it itself is eing spoofe the vertising router is not neighor of the router eing spoofe. Furthermore, for the resons elorte ove, routers up to one hop wy from the spoofe estintion my etet the spoofing. In the se of figure 20 woul e le to etet spoofing of links to (s woul e le to etet spoofe links to et.) possily leing to signifint frtion of routers eing le to etet tht is onuting isruptive ttk n, therefore, engging pproprite ountermesures. e woul, in this se, e the only router unle to etet the spoofing. While this might suffie to isrupt the network, it is no ifferent from the ientity spoofing ttk illustrte in figure 14, whih rries less risk of etetion of the mliious router. The impt of this ttk is similr to tht presente in setion 4.1.2, however, is esier to etet s the mliious router is generting ontrol trffi rehing the entire network. 4.3 Creting Loops Consier the exmple in figure 23(). The mliious router,, spoofs the ientity of g, n prtiiptes (with this spoofe ientity) in oth the Neighorhoo Disovery proess n the Link Stte Avertisement proess. In orer to over ll its 2-hop neighors, must selet oth n s MPRs. Hene, the link - is vertise y, n the link g- is vertise y the mliious router. The topology pereive y f is s inite in figure 23(): pths to the estintion exist vi g (2 hops) or vi e (3 hops). The topology pereive y g is s inite in figure 23(): s g oes not proess TCs originting from itself, the only pth reognize y g towrs is vi f. Therefore, if t pket estine for rrives t f, it will e forwre through g. g will forwr the t pket through f, therey reting loop in the network. Consier the exmple in figure 24(). The mliious router,, spoofs the ientity of g, n selets s MPR. Hene, the link -g is vertise y is trike into vertising non-existing link. The topology pereive y f is s inite in figure 24(): pths to the estintion exists is vi g (2 hops) or vi f (3 hops). The topology pereive y g is s inite in figure 24(): s g oes not proess TCs originting from itself, the only pth reognize y g towrs is vi f. Therefore, if t pket estine for rrives t f, it will e forwre through g. g will forwr the t pket through f, therey reting loop in the network. INRIA

26 Seurity Issues in OLSRv2 23 Spoofs g Spoofs g Dt to f g h f g h e e () Rel network topology, with mliious router spoofing the ientity of g. Spoofs g () Topology Mp in f. Dt to f g h e () Topology Mp in g. Figure 23: Pereive Topology Mps with mliious router performing Ientity Spoofing in the Link Stte Avertisement proess Spoofs g f g h () Rel network topology, with mliious router spoofing the ientity of g. Dt to f g h () Topology Mp in router f. Dt to f g h () Topology Mp in router g. Figure 24: Pereive Topology Mps with mliious router performing Ientity Spoofing in the Neighorhoo Disovery proess 5 Why this Memornum oes not onsier Reply Attks A ommonly onsiere ttk type is for mliious router to reor ontrol trffi from legitimte routers, n reply this possily somewhere else in the network, n possily t some lter point in time. While suh inee is possile, it shoul not e onsiere s lss of ttks on OLSRv2 in n y itself: in-fine, the mliious router replying messges is performing omintion of ientity-spoofing, spoofing the ientity of the router from whih it RR n 7218