0913-2A Novel Approach for Rogue Access Point Detection on the Client-

A Novel Approach for Rogue Access Point Detection on the Client-Side

Somayeh Nikbakhsh Advanced Informatics School Universiti Teknologi Malaysia Kuala Lumpur, Malaysia nsomayeh2@live.utm.my

Mazdak Zamani Advanced Informatics School Universiti Teknologi Malaysia Kuala Lumpur, Malaysia

mazdak@utm.my

Azizah Bt Abdul Manaf

Advanced Informatics School

Universiti Teknologi Malaysia

Kuala Lumpur, Malaysia

azizah07@citycampus.utm.my

Maziar Janbeglou Auckland University of Technology (AUT) Auckland, New Zealand,

maziar@https://www.360docs.net/doc/3e16286126.html,

Abstract—There is a big risk for pub ic Wi-Fi users being tricked into connecting to rogue access points. Rogue access point is one of the most serious threats in WLAN, since it exposes a large number of users to MITM and evil twin attack. In this paper we propose a practical method that warns users to avoid connecting to the rogue access points. Proposed method compares the gateways and the routes that a packet travel s to determine whether an access point is l egitimate or not. This method can easily detect Man-In-The-Middle and evil twin attack without any assistance from the WLAN operator.

Keywords- Rogue access point (RAP); evil twin; wirel ess security; MITM attack

I.I NTRODUCTION

Wireless computer networks technology is one of the most popular technologies in recent years [1], [2]. This is due to the following reasons: mobility, flexibility, scalability, and ease of installation. Although the ability to access the Internet from anywhere has been a revolution in computer communication, it causes a lot of security issues. Some of these are as a result of shared media, such as air in wireless networks. Moreover, lack of knowledge and awareness possessed by the end-user make this issue extremely disturbing. Public wireless popularity cannot be stopped even though they present significant security risk to their users. One of these security threats is being tricked into connecting to a rogue access point by a hacker.

Rogue access points may be configured to perform like legitimate access points. Many wireless users simply connect to a wireless access point with the best signal strength, therefore they can easily be "tricked" into connecting to the rogue access points. Once a user is connected to a rouge access point, the hacker can monitor and capture all the user network traffic. Detecting rogue access points is the first step in dealing with this problem [3].

Rogue access point detection is an important aspect of wireless intrusion detection system (WIDS) because it poses a number of significant threats as mentioned above. Detecting such access points might not be a simple task. A few researches have been performed in this field. These researches mainly advice us to regularly scan the vicinity for checking any unauthorized access points , use wireless traffic analysis for detection, and use special hardware or software for detecting rogue access point.

This paper is concerned about one of the security issues in wireless networks, which is called installation of unauthorized access point or rogue access point. Some researchers define it as “wireless access point that is installed without explicit authorization from a local network management”. The others define it as “Wi-Fi Access Point which is setup by an attacker for the purpose of sniffing wireless network traffic”. In this paper when we use rogue access point we point out to the second definition [2].

The rest of the paper is organized as follows. Section II describes some of the related works. Section III describes the problem statement. The proposed method is presented in Section IV. And, finally, we conclude this work in Section V.

II.R ELATED W ORKS

Rogue device detection has been implemented by using different techniques like site survey, MAC (Media Access Control) address list checking, noise checking, and wireless traffic analysis. In general, detecting rogue APs (access points) can be classified into two categories. First category includes the methods that help wireless administrators to detect an unauthorized access point, and second category includes methods to help wireless users detect rogue access points.

2012 26th International Conference on Advanced Information Networking and Applications Workshops

Second category, which performs on client-side, are solutions which help the user of public Wi-Fi (who neither information about authorized list nor any sophisticated software or hardware) to detect the rogue AP. This approach presents a challenging problem because there is no prior information, which can be used as a reference.

A.Admin-side solution for rogue AP detection

First category which is admin-side solutions helps network administrators to protect the network from rogue access points. This category utilizes different methods. [4], [5], [6], [7] which monitors radio frequency airwaves for finding any violation. Radio frequency monitoring is a passive approach for rogue access points detection in wireless networks. In this kind of approach a client with a wireless network card, which is configured in radio frequency monitoring mode (RFMON) is able to monitor all radio frequency signals. It will be able to detect rogue access points by capturing and analyzing raw frames to discover if there are any telltale frames broadcasting by a rogue access point.

Radio frequency sniffing method can be easily implemented by installing sensors in small coverage wireless networks, but for wider ones it would be so expensive and difficult to implement which is far from our study. [8], [9] proposed monitoring network traffics at the gateway and compare them with an authorized list to find the rogue AP. This method is usually utilized by a network administrator who has a list of authorized access point devices with their respective SSIDs (Service Set Identifier) and MA addresses. In the next step, the monitoring component listens to wireless frames (beacons, probe response and authentication /association frames etc) which are sent out by all access points and compare these information to the pre-recorded baseline information.

Jana and Kasera [10] proposed a new method for rogue access point detection. They used clock skew of access points in a wireless local area network as its unique characteristic or fingerprint for detection. The major problem at that time was inability to detect MAC (Medium Access Control) address spoofing.

Wei et al. [11] proposed two online algorithms for rogue access point detection that utilize sequential hypothesis tests. These algorithms monitor incoming traffic at aggregation point like a gateway or a router. Then it makes a prompt decision about TCP ACK-pairs that are passively collected.

Kao et al. [12] proposed a new access point detection method without using any specific hardware device. This technique decides whether the network packets of an IP address are routed from access points, according to client-side bottleneck bandwidth. The network administrator is simply able to monitor the packets passing through the core switch and the detection algorithm is a complementary part to the existing access point selection policy.

Shivaraj et al. [13] proposed a statistical based approach for rogue access point detection. This approach utilizes a Hidden Markov Model that is applied to measure packet-header collecting passively at a gateway. The main idea in this approach is using variations in packet inter-arrival time to differentiate between authorized access points and rogue access points.

Qu and Nefcy [14] proposed an indirect rogue access point detection (RAPiD) system. They analyzed extensive local round trip time (LRTT) data and designed RAPiD with several algorithms for detecting wireless hosts effectively. Their framework starts from passively monitoring network traffic to host discovery and detection Client-side solution for rogue AP detection.

Han et al. [1] proposed the first user-side rogue access point detection technique. Their solution is based on unique wireless characteristics. The traffic that they traced was self-generated and did not need any modifications or changes by a network service provider. They utilized Round Trip Time (RTT) between the user and the DNS server as a basis for their proposed technique. They demonstrated when a user connects to the network through a rogue access point; all the packets travel two wireless hops, one between the user and the rogue access point, and the other between the rogue access point and the legitimate access point.

Kindberg et al. [2] presented a model to enhance the security of public wireless networks. They allow users to authenticate the access point they have connected to without the need of any pre-existing certificates, keys, or trusted relationships. This model utilizes standard encryption, authentication techniques with slight modifications, and a proven cryptographic scheme.

Roth et al. [15] proposed a simple protection mechanism that helps the client to detect an evil twin in public Internet networks. This mechanism provides short authentication string protocols for exchanging cryptographic keys. The short string verification is executed by encoding the short strings as a sequence of colors, rendered sequentially by the user’s device, and by the designated access point.

Song et al. [16] proposed the first client-side system for detecting evil twin attacks on clientside. They propose two different algorithms for detection of evil twin; one, which is called Trained Mean Matching (TMM), requires training knowledge of one-hop and two-hop wireless channels; and the other one is called Hop Differentiating Technique (HDT), which does not rely on any training information or knowledge.

A novel approach for evil twin detection proposed in 2010 [17]. In this approach key exchange after mutual handshake proposed as an evil twin detection method.

III.P ROBLEM S TATEMENT

Existing rogue access point detection methods are mostly for wireless network administrators. These administrator-side solutions are expensive, limited and not available in many cases. For example, mobile users, who use public Wi-Fi at airports, hotels, or cafes, need to protect themselves from rogue access points [16]. As we cannot stop Wi-Fi popularity, it is necessary to protect Wi-Fi users by offering them a lightweight rogue access point detection system on their devices.

When a general user wants to use a public Wi-Fi, there are many access point SSID to choose from. Some of them

have similar SSIDs and pretend they provide same network. The main question is how to differentiate between a rogue access point and a legitimate one. How the average computer user, who does not have any information about wireless networks and authorized list of Access points, is able to use their own mobile device (laptop, cell phone) as a detection instrument is the main concern of this study.

Figure 1. Normal scenario and MITM scenario.

When a user connects to a rouge access point, which offers a fake portal and an Internet communication link, a hacker can simply capture all network packets including sensitive information. This attack is called Man-In-The-Middle (MITM) attack. Normal scenario and MITM scenario is compared in Figure 1.

The main problem here is, while a user enjoys public wireless network, they cannot be sure that they are connected to the legitimate wireless access point or an unauthorized one. The second problem is many common methods of client-side rogue access point detection are only limited to the MITM scenarios. For instance, those methods would not cover the state when a hacker shares their own broadband internet connection with the same SSID as public Wi-Fi.

In general the rogue access point threat can be classified in two different categories. The first category of rogue access points are those which threaten user by Man-In-The-Middle attack. An attacker can simply implement this attack by configuring a rogue access point which imitates an authorized one. Then they just forward packets to the legitimate access point. Man-In-The-Middle attack inserts the attacker between client and authorized access point. The attacker is able to sniff all the packets.

The second category of rogue access points are those which presents threats to user by evil twin attack. In this kind of attack, an attacker spoofs the MAC address of the legitimate access point. In the second step they begin to broadcast the same SSID as genuine access point. When user connects to the evil twin AP an attacker can easily access user’s traffic.

IV.T HE P ROPOSED M ETHOD

Detecting rogue access point is a challenging task. The main difference between our proposed model and the current methods is the steps and the way we apply to detect rogue access points for different type of rogue access points.

C urrent solutions are just available for MITM scenario or evil twin scenario. Because all rogue access points are not behaving in the same way, there is a necessity to have one comprehensive solution that is able to work in different scenarios. Our proposed solution detects both MITM attack and evil twin attacks. As shown in figure 2, there are three states according to the information it collects; this method is able to determine if there is a definite rogue access point (MITM scenario), possibility of being tricked by a rogue AP (evil twin scenario), or if it is a safe network.

As shown in Figure 2, we have two public APs broadcasting the same SSIDs and MAC addresses. In the first step, two IPs are compared. There are two possible results for this comparison. If they are equal, the trace routes will be compared.

The first situation could not happen, because both access points have same SSIDs, MAC and IP addresses and packet travels exactly the same route. According to network logic, we could not have two same IP addresses in one network simultaneously. If this situation happens it will cause IP address conflict and both devices will stop working. Therefore, in Figure 2 this situation is shown as “N/A”.

Therefore the only answer would be the same IP addresses with different trace routes. This condition is the result of IP spoofing. This method does not have any references to check which one is the authorized access point, so it just warns the user about evil twin attack.

Figure 2. Rogue access point detection algorithm.

In the first step, which is IP comparison another result is different IPs. In order to make decisions, this method

calculates network IDs based on different IP classes and

compares them. If network IDs are the same, it indicates that both APs are in the same network. This situation is the result of load balancing in the network.

The network administrator may use two access points (with same network ID) for load balancing purpose. Therefore, IPs are different but Net IDs are the same, it is safe to connect to either of them. In this state, the green light will ensure the user that they could connect securely to both of them.

Another possible result is different IPs and different network IDs. In this situation, the algorithm executes a trace route on both access points and compares the results. If there is any extra hop in the result, which is the proof of man in the middle, the red light will notify the user it is not safe to connect to this access point. In this state, the hacker had set up an access point to broadcast the same SSID as the public access point. The IP address of this network is different from the genuine one. The attacker lure users to connect to the rogue access point and after capturing packets they may pass them to the authorized access point. This will cause the extra hop in trace route result.

The last condition is when both access points’ IP addresses and network IDs are different, and the trace-route result indicates different routes to the same destination. In this state, the attacker brings his own access point to the public place and broadcast the same SSID. This state will cause some inexperienced users connect to the rogue one. In this state, the yellow light will be switched on. As it mentioned before, this technique could not decide which access point is the authorized one, because this technique works on client-side and there is not any previous knowledge about the network that could be used as the reference. Therefore, the yellow light just warns the user that this network is not safe.

In summary, the result of comparing two similar SSIDs is shown as a traffic light. If both SSIDs indicate the same route, the green light ensures the user that both networks are safe. If the result of comparison is completely different, the yellow light warns the user there would be a risk to connect either of the access points. The last state happens when the comparison result indicates one additional trace-route hop, which is the sign of MITM attack, and then a red light will warn the user not to connect to the access points.

V.C ONCLUSION

A new client-side rogue access point detection method was proposed in this paper. The proposed model is a kind of wireless Intrusion Detection System (Wireless IDS). The main approach in this work is using client devices to perform scanning of rogue access point instead of using dedicated scanning devices. The second approach in this paper is to have one comprehensive solution for all possible rogue access points including Man-In-The-Middle attacks and evil twin attacks. The proposed method has the following advantages compared to existing solution:

?Proposed method can detect both MITM and evil twin attack.

?An end user can be warned of a rogue access point to prevent being exposed to the attacker.

?There is no need to modify the network architecture.

?End user mobile device can serve as detection mechanism.

A CKNOWLEDGMENT

This research is supported by Advanced Informatics School (AIS), Universiti Teknologi Malaysia (UTM).

R EFERENCES

[1]Han, H., Sheng, B., Tan C. C., Li, Q. and Lu, S. (2009). A

Measurement Based Rogue AP Detection Scheme. In Proc. IEEE INFOCOM'09

[2]Kindberg,T., Mitchell, J., Grimmett, J., Bevan, C., and O’Neill, E.

(2009). Authenticating Public Wireless Network with Physical Evidence. IEEE International C onference on Wireless and Mobile Computing, Networking and Communications.

[3]Saruhan, I. H. (2007). Detecting and Preventing Rogue Devices on

the Network. Retrieved August 30, 2010, from

https://www.360docs.net/doc/3e16286126.html,/reading_room/whitepapers/detection/detecting-

preventing-rogue-devices-network_1866

[4]Air magnet. Available: https://www.360docs.net/doc/3e16286126.html,

[5]AirDefense enterprise: a wireless intrusion prevention system

Available: https://www.360docs.net/doc/3e16286126.html,/.

[6]C isco Wireless LAN Solution Engine (WLSE). White paper,

https://www.360docs.net/doc/3e16286126.html,/en/US/products/sw/cscowork/ps3915/prod_whi

te_papers_list.html

[7]Bahl, P., C handra, R., Padhye, J., Ravindranath, L., Singh, M.,

Wolman, A. and Zill, B. (2006). Enhancing the security of corporate Wi-Fi networks using DAIR. InProc. MobiSys ’06.

[8]Beyah, R., Kangude, S., Yu, G., Strickland, B. and C opeland, J.

(2004) Rogue Access point detection using temporal traffic characteristics. In IEEE Global Telecommunications C onference (GLOBECOM'04).

[9]Beyah, R., Watkins, L., C orbett, C. (2007). A Passive Approach to

Rogue Access Point Detection.InProc. GLOBECOM ‘07

[10]Jana S. and Kasera S. K. (2008). On fast and accurate detection of

unauthorized wireless access points using clock skews. MobiCom’08, September 14–19, San Francisco, California, USA

[11]Wei, W., Suh, K., Wang, B., Gu, Y., Kurose, J. and Towsley, D.

(2007) Passive online rogue access point detection using sequential hypothesis testing with TC P AC K-pairs. In Proc. 7th ACM SIGCOMM conference on Internet measurement (IMC '07).

[12]Kao, K., Liao, I., Li, Y.(2009) Detecting rogue access points using

client-side bottleneck bandwidth analysis, S cience direct, computers & security 28- 144 –152

[13]Shivaraj, G., Song, M. and Shetty, S., (2008). A Hidden Markov

Model Based Approach to Detect Rogue Access Points. IEEE, 978-1-4244-2677

[14]Qu, G. And Nefcy M. M. (2010). RAPid: An indirect Rogue Access

Point Detection System. IEEE 978-1-4244-9328-9/10

[15]Roth, V., Polak, W., Rieffel, E. and Turner, T., (2008). Simple and

effective defense against Evil twin Access Points. WiSec’08, March 31–April 2, 2008, Alexandria, Virginia, USA.

[16]Song, Y., Yang, C. and Gu, G. (2010). Who Is Peeping at Your

Passwords at Starbucks? To Catch an Evil Twin Access Point, IEEE /FIP International C onference on Dependable Systems & Networks (DSN).

[17]Panch, A. and Sing, S. K. (2010). A Novel approach for Evil Twin or

Rogue AP mitigation in wireless environment. International Journal of Security and Its Applications .Vol. 4, No. 4, October, 2010