Sponsor:

1
Northwestern Lab for Internet and Security
Technology (LIST) Prasad Narayana, Sagar
Vemuri, Yanmei Zhang, Yao Zhao, Nikos Liveris,
Yan Chen, Hai Zhou, Judy Fup-narayana,
s-vemuri, yanmei-zhang, jingo, n-liveris2, ychen,
haizhou_at_northwestern.edu, judy.fu_at_motorola.comht
tp//list.cs.northwestern.edu/
Vulnerability Analysis of WiMAX Network Protocols
1.
2.
Motivation
Related Work

• IEEE 802.16 technology, popularly called as
  WiMAX, with enormous backing from the industry is
  set to lead the broadband wireless space
• Security, as always, is key for its functioning
  and growth

• Security Analysis of Mobile IP and IEEE 802.16
  protocols largely confined to manual analysis
• Fast evolution of the 802.16 standard resulted in
  many incomplete (and sometimes even incorrect!)
  analysis

3.
Our Approach
Manual Analysis
TLA Modeling
Logic-based Analysis
Identification of Security Loopholes, e.g., unprotected messages. Classification of vulnerability levels of Mobile IP and various IEEE 802.16e Protocol Processes
Formal Specification of the Protocol and Potential capabilities of the Attacker using TLA (Temporal Logic of Actions)
Complete vulnerability search using TLC Model-Checker
4.
Model of the adversary used in our analysis
Work Done
The Attacker can Eavesdrop on and store messages Replay old / Inject spoofed messages Corrupt messages on the channel by causing collisions

• Completed the outsider threat analysis of IEEE
  802.16e and Mobile IP protocols
• Found a vulnerability in the Return Routability
  of Mobile IPv6
• Powerful attack to cause a service disruption for
  a large number of machines in foreign networks at
  a small cost
• No need to change the MAC layer
• Implemented and tested in our lab testbed

• Automatic Vulnerability Checking of IEEE 802.16
  WiMAX Protocols through TLA, in Proc. of the
  Second Workshop on Secure Network Protocols
  (NPSec), 2006.

5.
Work in Progress

• Analyze the EAP protocols thoroughly, especially
  EAP-SIM for GSM networks and EAP-AKA for 3G,
  CDMA2000.
• Focus on insider attacks to check protocol
  vulnerabilities after the authentication step

To Summarize our work, manual analysis has
yielded insightful scenarios whereas TLA modeling
has proved very useful due to the exhaustive
nature of its search method

• Sponsor

MIPv6 Return Routability Attack in action