Subject: Re: [seamoby] DOS in wireless

From: Alper Yegin <[email-masked]>
Date: Tue, 12 Jun 2001 11:59:00 -0700 (PDT)

> > I'd like to add to that...
> > 
> > You don't even need to use access technology specific jamming. Now that 
> > bandwidth is very limited with wireless networks, a malicious node on the 
> > Internet can pump IP packets towards wireless link (to an existing IP 
address on 
> > this link), which would eat up bandwidth. Depending on access technology, 
this 
> > may or may not affect other devices on the wireless network.
> 
> Of course, this is very wireless technology specific. There are certain 
technologies
> that require that a channel be established with the "access point", and the 
"access
> point" must authorize any requests for channel establishment.
> 
> > 
> > Or, malicious node can send packets to random addresses in the wireless 
network. 
> > The access router would need to send neighbor solicitations for each 
different 
> > address... that eats up bandwidth.. [one solution to this problem is to have 
a 
> > large enough neighbor cache on the access router that holds all the attached 
> > nodes. And as soon as a device attaches to this network, this devices should 
> > send an unsolicited neighbor advertisement.. Now any node that doesn't exist 
in 
> > the neighbor cache doesn't exist on the link. And access router never 
solicits 
> > for random addresses.]
> 
> Again, this assumes that the wireless technology allows each node to 
communicate
> directly, which is not an assumption that you can make that easily, given 
differing
> technologies out there. Furthermore, sending random packets is always 
something
> one can do, but only given its allowable bandwidth. If one is on a wireless 
link
> that does not impose any bandwidth limitations, then I agree that would be a 
possible
> DoS.

Actually the malicious node I mentioned above is any host on the Internet. Not 
necessarily a node on the wireless network. It makes the access router send 
neighbor solicitations...

> 
> Of course, keep in mind that these are not CT specific DoS, and don't need to 
be
> addressed in the CT protocol. Again, we are concerned with CT-specific 
attacks.

Sorry, seeing the subject line, I couldn't help... These have nothing to do with 
CT.

> Thanks,
> PatC

alper

---

From: "Gary Kenward" <[email-masked]>
Date: Tue, 12 Jun 2001 15:41:18 -0400

Madjid: 

  This is absolutely wrong. I guarantee you that it is possible to
jam a CDMA channel with CAN$50 of hardware from radio shack. Indeed, 
as other posters have indicated, it has happened already by accident.

  Why hasn't it happened? Well, probably for the same reason why people
don't
go around cutting telephone wires. It does have the sex appeal of being an 
Internet hacker.

Gary

> -----Original Message-----
> From: Nakhjiri Madjid-MNAKHJI1 [mailto:[email-masked]]
> Sent: Tuesday, June 12, 2001 1:19 PM
> To: Kenward, Gary [WDLN2:AN10:EXCH]; 'seamoby'; 'seamoby-context'
> Subject: RE: [seamoby-context] DOS in wireless
> Sensitivity: Confidential
> 
> 
> Gary,
> 
> CDMA took  care of jamming long time ago. 
> I consider this more as humor than as serious DoS discussion.
> 
> -----Original Message-----
> From: Gary Kenward [mailto:[email-masked]]
> Sent: Tuesday, June 12, 2001 8:33 AM
> To: 'seamoby'; 'seamoby-context'
> Subject: [seamoby-context] DOS in wireless
> Sensitivity: Confidential
> 
> 
> We all got wrapped up in this discussion of DOS and, in particular, CT
> related DOS. It put a smile on my face last night to recall that with
> wireless, it is almost trivial to mount a DOS attack without referring
> to any protocol nor invading the access network. The 
> traditional term is
> "jamming". With the trend to lower power devices, it would 
> not be difficult
> nor expensive to mount a fairly widespread, difficult to stop 
> attack (and
> I'll stop there).
> 
> Perhaps too much attention is being given to putting bars on 
> the windows
> when the front door is missing.
> 
> Gary
>

---

From: "Gary Kenward" <[email-masked]>
Date: Tue, 12 Jun 2001 16:32:23 -0400

I'm sure you could. It's been done already for the various military
organizations. It's not clear you could do it and build a commercially
viable network.

So?

> From: Phillip Neumiller [mailto:[email-masked]]
> Sent: Tuesday, June 12, 2001 3:55 PM
> To: Kenward, Gary [WDLN2:AN10:EXCH]; 'Nakhjiri Madjid-MNAKHJI1';
> 'seamoby'; 'seamoby-context'
> Subject: RE: [seamoby] RE: [seamoby-context] DOS in wireless
> Bzzzt.  Let's be specific here.  IS-95, cdma2000, umts all have
> slightly different anti-jam characteristics. For IS-95
> 
> Jamming Margin = W/R (dB) - (Eb/No)req(dB)
> 
> So W/R is just the processing gain (varies in IS-95 with coding
> rate), and Eb/No is the channel's signal to noise ratio.  
> 
> I can guarantee you that I can build a different CDMA system
> that you can not Jam with your ham shack or radio shack parts.  
>  
> 
> >Madjid:

---

From: [email-masked]
Date: Wed, 13 Jun 2001 09:37:25 +0300

Hi Gary,

> traditional term is "jamming". With the trend to lower power devices, it 
> would not be difficult nor expensive to mount a fairly widespread, 
> difficult to stop attack (and I'll stop there).
> 
> the windows when the front door is missing.

If CT is done correctly, it may have widespread uses which we
aren't currently thinking of - and that is a sign of success.  
Therefore, in designing new protocols, we should make some
effort not to create new problems, irrespective of existing 
problems.  

best regards,
John

---

From: "Gary Kenward" <[email-masked]>
Date: Wed, 13 Jun 2001 10:23:48 -0400

Actually, Ross, there were many "teething" problems with subscriber devices
that were "inadequately tested"; not just with power control, but with many
of
the protocol state machines. This is of course, normal with any new
technology
deployment, but the effect was to jam the channel at some layer.

(Far be it for me to imply that a vendor would want to build in a
competitive
advantage in their product by having it use slightly higher power ;^} ).

Gary

> From: Arthur Ross [mailto:[email-masked]]
> To: Pat Calhoun; Kenward, Gary [WDLN2:AN10:EXCH]
> Cc: 'seamoby'; 'seamoby-context'
> Subject: [seamoby-context] Re: [seamoby] DOS in wireless
> 
> 
> At 6:31 -0700 06/12/2001, Pat Calhoun wrote:
> >On Tue, Jun 12, 2001 at 09:32:52AM -0400, Gary Kenward wrote:
> >> nor expensive to mount a fairly widespread, difficult to 
> stop attack (and
> >> I'll stop there).
> >>
> >> Perhaps too much attention is being given to putting bars 
> on the windows
> There was quite a debate on this point in the original CDMA wireless
> standarization activities about 10 years ago. The concern 
> was, not only the
> malicious prankster/crook, but also the so-called "rogue 
> mobile", meaning
> one whose power control has lost it's mind and is no longer properly
> controlling its TX power.
> 
> The debate has run out of steam, and doesn't seem to be a 
> serious problem
> in practice. This may, in part, be due to the fact that a 
> phone that has
> lost its power control mind is likely to be seriously broken 
> somehow, or
> may run down its battery rapidly, thus leading its owner to 
> turn it off,
> take it for repair, or whatever.
> 
> The possibility of malicious DoS via plain ol' jamming is 
> always there. The
> capacity of a SSMA link is a function of the require received 
> Eb/N0 and the
> so-called processing gain (the ratio of the spreading BW to 
> the bit rate).
> The effect of a jammer, intentional or inadvertent, is to 
> consume some of
> the available capacity, depending on its power, bandwidth, etc.
> 
> If anyone wants the long form of this, I can do maybe two 
> hours impromputu
> presentation ... anytime, anyplace, anybody's slides! :-)
> 
> Then there's always the proverbial Big-Brother-esque spectrum 
> pollution
> police .... :-)
> 
>    -- ahmr
>