Wireless Side-Lobe Eavesdropping Attacks
Total Page：16
File Type：pdf, Size：1020Kb
Wireless Side-Lobe Eavesdropping Attacks Yanzi Zhu, Ying Ju§†, Bolun Wang, Jenna Cryan‡, Ben Y. Zhao‡, Haitao Zheng‡ University of California, Santa Barbara §Xi’an Jiaotong University †State Radio Monitoring Center ‡University of Chicago {yanzi, bolunwang}@cs.ucsb.edu, [email protected], {jennacryan, ravenben, htzheng}@cs.uchicago.edu ABSTRACT cation. Many such applications have already been deployed. Facebook has deployed a mesh network using 60GHz com- Millimeter-wave wireless networks offer high throughput and munications in downtown San Jose [7]. Google is consider- can (ideally) prevent eavesdropping attacks using narrow, ing replacing wired fiber with mmWave to reduce cost [5]. directional beams. Unfortunately, imperfections in physi- Academics have proposed picocell networks using mmWave cal hardware mean today’s antenna arrays all exhibit side signals towards next 5G network [29, 32, 42]. lobes, signals that carry the same sensitive data as the main With a growing number of deployed networks and ap- lobe. Our work presents results of the first experimental plications, understanding physical properties of mmWave is study of the security properties of mmWave transmissions critical. One under-studied aspect of directional transmis- against side-lobe eavesdropping attacks. We show that these sions is the artifact of array side lobes. Fig. 1 shows an ex- attacks on mmWave links are highly effective in both indoor ample of the series of side lobes pointing in different direc- and outdoor settings, and they cannot be eliminated by im- tions. Side lobes are results of imperfect signal cancellation proved hardware or currently proposed defenses. among antenna elements. While weaker than the main lobe, 1. INTRODUCTION side lobes carry the same information, and can be exploited by eavesdroppers to recover the transmission. As physical Wireless communication has always been more vulnera- imperfections, they are very difficult to eliminate. ble to attacks than its wired counterparts. The fact that wire- In thispaper, we conductthe first empiricalstudy of the se- less signals are broadcast means they are more easily eaves- curity properties of mmWave communications against side- dropped. This weakness has been exploited in many wire- lobe eavesdropping attacks. While theoretical studies have less networks [33, 34, 36]. Even more recent security pro- shown the problem of side-lobe leakage [25], it is never vali- tocols like WPA2-PSK have been successfully compromised dated using network measurements, especially for long-range by snooping attacks [11, 30] via simple tools [2]. Despite communications. We use a commercial 60GHz testbed from existing encryptions, one can still infer the specific sources Facebook’s Terragraph project [4] to evaluate the effective- of traffic by observing just packet sizes and counts in data ness of side-lobe eavesdropping in both indoor and outdoor transmissions [17, 28]. scenarios. Specifically, we answer three key questions: While we continue to improve encryption algorithms, an • How severe is mmWave side-lobe eavesdropping? (§3) equally promising direction is to use wireless beamform- We observe that side-lobe eavesdropping is incredibly ef- arXiv:1810.10157v1 [cs.CR] 24 Oct 2018 ing to defend against eavesdroppers at the physical layer. fective in both indoor and outdoor scenarios. Attacker can Beamforming allows a transmitter (TX) to send a highly fo- recover transmission in a large area with high success rate cused, directional signal towards a target receiver (RX), so (details below). Particularly for outdoor scenarios, most that nearby attackers not directly between the two endpoints eavesdropping areas are connected, and the attacker can cannot capture the transmission. The narrow beam is built by move freely and launch stealthy attacks. leveraging signal cancellations among multiple antennas in 2 Attacker’s Packet Success Rate 1 Eavesdropping Area (m ) a phased array , and is most easily built on millimeter-wave >10% >50% >95% (mmWave) transmitters [1]. For example, 60GHz phased ar- Mesh 79 64.6 55 rays could fit on small devices like smartphones, and can Picocell 109 88.6 54 Peer-to-Peer 16.6 15.7 13.1 generate highly focused beams (e.g., 3◦ using 32×32 anten- nas) while achieving Gbps throughput. • Can better mmWave hardware improve security? (§4) While earlier applications focused on short-range indoor We find that improved hardware can only reduce the im- applications, e.g., home routers [8] and wireless virtual real- pact of the eavesdroppingattack, but not fully defend against ity headsets [10], new applications of mmWave leverage its it. Eavesdropping side lobes is still possible even after re- high directionality and throughput for long-range communi- moving hardware artifacts from antennas and deploying more antenna elements. 1 We do not consider horn antennas as they are bulky, expensive, and can only be rotated mechanically. They are not suitable for our • Are existing defenses effective against side-lobe eaves- application scenarios. drop attacks? (§5) Although existing defenses show 1 TX RX Examined promising results against single-device eavesdroppers, they Scenario Distance Max Area EIRP Height Height either impose impractical hardware requirements, or re- to TX Throughput (m2) (dBm) (m) (m) main vulnerable against more advanced attackers, e.g., those (m) (Gbps) Mesh 32 6 200 6 1.0 10×20 with multiple devices. Picocell 32 6 50 1 1.5 10×20 Peer-to-Peer 23 1 10 1 1.5 4×5 2. BACKGROUND Table 1: Detailed experiment setup and configurations. To provide context for later study, we first describe the adversarial model and then our measurement methodology. Isotropically Radiated Power (EIRP) of 32dBm, supporting Adversarial Model. We consider passive eavesdropping, 1Gbps (QPSK) transmissions at 200m range (line-of-sight). where an attacker listens to side-lobe signals and recovers But we could re-purpose these radios for picocell and peer- packet header or payload. The attacker stays hidden from to-peer scenarios as well, by lowering the EIRP. Each receiv- its victim TX and RX, but is unable to manipulate the com- ing radio can report received signal-to-noise-ratio (SNR) of munication between the victims. Without knowing the at- each packet in real time. tacker’s physical location, victims cannot apply conventional Measurement Setup. We place our testbed radios at dif- defenses like null-forming2. ferent heights and distances apart to emulate the three ap- We do not consider eavesdropping attacks on the main plication scenarios. In all scenarios, TX sends 32KB TCP lobe of the transmission. Such an attack would affect the packets to RX at 1Gbps by default. Equipment placement communication between TX and RX, as the attacker has to details and specifications are listed in Table 1. In particular stay inside the main lobe or use a reflector, and thus can be for (c) peer-to-peer, we choose 23dBm EIRP the same as the detected [35]. Finally, we assume the attacker has one or commodity 60GHz chipset from Wilocity [9]. Given TX’s more synchronized devices as powerful as the victim’s hard- EIRP and the distance from victim RX to TX, RX can at ware. The attacker knows the victim’s location and hard- best communicate with TX at 1Gbps, 1.5Gbps, and 1.5Gbps ware configuration3. The attacker and his device(s) are free with less than 5% packet loss in mesh, picocell, and peer-to- to move around the victims. peer networks, respectively. Further reducing TX power will Application Scenarios. We consider three practical sce- affect RX’s performance. narios where mmWave signals are commonly used: mesh During transmission, we move the attacker radio around networks [7], picocell networks [42], and indoor peer-to- TX to eavesdrop side lobes at different locations. We grid the area around TX (200m2 for two outdoor scenarios and peer transmissions [8, 10]. Fig. 2 shows an illustration of 2 the three. 20m for the indoor scenario) into 816 (34×24) rectangles. mmWave signals are commonly considered for indoor peer- In each grid, we face the attacker radio at TX and eaves- to-peer scenarios (Fig. 2(c)), e.g., virtual reality [10, 12] and drop the transmission for 30s. Our testbed could record 100k wireless display [3]. Here TX and RX are within very short packet samples and 30 SNR values in each grid. In each ap- range (≤10m)and oftenat thesame height(∼1m). As mmWave plication scenario, we collected a total of 80 million packets signals degrade much faster than lower frequency signals in and 24k SNR measurements. the air, it is less known that they can also be used outdoor 3. EFFECTIVENESS OF EAVESDROPPING for long-range communications (20–200m). For example, Facebook has deployed a mesh network in downtown San From our collected measurements, we now present the Jose [7], supporting up to 200m link using 60GHz phased severity of side-lobe eavesdropping under three mmWave array radios4. Researchers [29, 42] also propose picocell network scenarios. We use the following two metrics to networks using 60GHz signals. In both scenarios, TX is quantify the effectiveness of side-lobe eavesdropping. mounted higher than human height, e.g., 6m. Depending on • Packet success rate (PSR) measures the percentage of pack- the scenario, RX is either mounted at a similar height or on ets the attacker could successfully retrieve from eaves- the ground, shown in Fig. 2(a) and (b), respectively. dropping through side lobes, calculated from 100k packets Measurement Hardware. Our testbed consists of three per location. When the attacker’s PSR is no less than that identical 60GHz radios. We use them as TX, RX, and the of the victim RX (>95% in our experiments), we consider attacker. Each radio has a 16×8 rectangular phased array ittobea full attack. (Fig. 3) and follows the 802.11ad single-carrier standard for • Eavesdropping area measures the area where the attacker 60GHz communication [6]. Our radios are designed for out- can achieve PSR higher than a given threshold by eaves- door mesh network scenario with a maximum Equivalent dropping on side lobe signals.