So near and yet so far: distance-bounding attacks in wireless networks

  • Authors:
  • Jolyon Clulow;Gerhard P. Hancke;Markus G. Kuhn;Tyler Moore

  • Affiliations:
  • Computer Laboratory, University of Cambridge, Cambridge, United Kingdom;Computer Laboratory, University of Cambridge, Cambridge, United Kingdom;Computer Laboratory, University of Cambridge, Cambridge, United Kingdom;Computer Laboratory, University of Cambridge, Cambridge, United Kingdom

  • Venue:
  • ESAS'06 Proceedings of the Third European conference on Security and Privacy in Ad-Hoc and Sensor Networks
  • Year:
  • 2006

Quantified Score

Hi-index 0.00

Visualization

Abstract

Distance-bounding protocols aim to prevent an adversary from pretending that two parties are physically closer than they really are. We show that proposed distance-bounding protocols of Hu, Perrig and Johnson (2003), Sastry, Shankar and Wagner (2003), and Čapkun and Hubaux (2005, 2006) are vulnerable to a guessing attack where the malicious prover preemptively transmits guessed values for a number of response bits. We also show that communication channels not optimized for minimal latency imperil the security of distance-bounding protocols. The attacker can exploit this to appear closer himself or to perform a relaying attack against other nodes. We describe attack strategies to achieve this, including optimizing the communication protocol stack, taking early decisions as to the value of received bits and modifying the waveform of transmitted bits. We consider applying distance-bounding protocols to constrained devices and evaluate existing proposals for distance bounding in ad hoc networks.