SenSys Attack Tool
BlackHat Europe 2010
 |
...SenSys is the first instance of an attack tool that can be used by an adversary to penetrate the confidentiality of a sensor network. Not only can it identify common applied protocols and a sensor network's functionality by analyzing overheard radio messages but it can also use this information to perform attacks such as Sinkhole attack, Replay |
attack, or Injecting malicious code in order to take control over the network. Also, it can extract useful network information such as node crashes, reboots, routing problems, network partitions, and traffic analysis (overall network traffic or overheard traffic by each sensor node).
Features
- Network Sniffer for passive monitoring and logging of radio packets.
- Network Attack Tool that provides functionalities for compromising a sensor networks's security profile.
- Network Visualization for displaying overheard neighborhood topology, network traffic, node states, and status of any performed attack.
The key design goal of this tool is its wide applicability; it should support passive inspection and compromise of a wide variety of sensor network protocols and applications. Currently, it allows deep inspection of commonly used protocols like MultiHopLQI and MintRoute, with more being to be added at later stages.
By considering popular underlying protocols and message structures that are most widely used by the research community, we make the tool scalable and adaptive. When any raw network packets are available in the neighborhood, it uses them as the audit source in order to identify current used software versions and extract vital network information. While packet capture is performed in real time, traffic analysis can be done either online or offine. We believe that offine analysis provides a better way of monitoring and understanding a network's deployment.
More information can be found in the published paper “Weaponizing Wireless Networks: An Attack Tool for Launching Attacks against Sensor Networks”, published in Blackhat 2010 International Security Conference.
Video Presentation
