Letting the puss in boots sweat
Fabian Lanze, Andriy Panchenko, Benjamin Braatz, Thomas Engel · 2014
The only available IEEE 802.11 network identifiers (i.e., the network name and the MAC address) can be easily spoofed. Consequently, an attacker is able to fake a real hotspot and attract its traffic. By this means, the attacker can intercept, collect, or change users' traffic (often even if it is encrypted). In this paper, we describe an efficient method for detecting the replacement of access points (APs) by passive remote physical device fingerprinting. The main feature of our fingerprinting approach is the clock skew - an unavoidable phenomenon that causes clocks to run at minuscule yet remotely observable different speeds - which is extracted from information contained in beacon frames. We are the first to achieve a high discriminability of devices by completely eliminating the fingerprinters' influence and considering the clock skew's dependency on temperature. Finally, we develop a method for reliable detection of the presence of AP impostors that works without explicit temperature information. Compared to the best state-of-the-art approach, our method improves detection accuracy from about 30% to 90% without generating any traffic and requires less than one minute to collect a sufficient number of observations. Our approach yields a strong feature for passive remote physical device fingerprinting in wireless networks.