JUST as the body鈥檚 immune system sometimes mistakenly attacks its own cells, so the security software intended to protect network users can be fooled into attacking them. This could make attacks by hackers even harder to detect and prevent.
Security software typically prevents unauthorised access by encrypting most of the data transmitted across a network, preventing hackers from exploiting it to cause trouble. However, the administrative commands used to authorise or exclude users are usually sent 鈥渋n the clear鈥�, for simplicity鈥檚 sake.
That means hackers can use fake commands to disconnect users, in so-called denial-of-service (DoS) attacks. To try to prevent this, security software is designed to check that messages are valid before they鈥檙e relayed to users and acted upon.
Advertisement
But at next week鈥檚 Defcon 16 security conference in Las Vegas, researchers from AirTight Networks in Pune, India, will demonstrate how this validity check can itself be used to dupe the software into sending malicious DoS commands. 鈥淭his would very easily fool current protection systems,鈥� says team leader Pravin Bhagwat.
鈥淭he validity check can itself be used to fool software into launching an attack鈥�
So far the team has exploited this vulnerability to compromise eight systems commonly used to protect home and business Wi-Fi networks. In one instance, the team set up a computer to use a network鈥檚 broadcast address as a fake ID. This address relays messages to all network users in one go. When the computer tried to connect to the network, the security software recognised that it wasn鈥檛 using a valid ID and declined access. But because the fake ID was the broadcast address, when the software sent a message denying the rogue computer access, it also sent the message to everyone else on the network, so every user was disconnected.
Such 鈥渁utoimmune鈥� attacks suggest that encryption alone is no longer enough to safeguard networks. The next-generation Wi-Fi standard specifies that admin commands should be encrypted. But a couple of unencrypted messages must still be sent to establish a connection in the first place 鈥� which the AirTight team successfully exploited in another attack.
鈥淪ince the attack occurs before encryption, it will be very difficult to counter,鈥� says Guy Bunker, chief scientist at security company Symantec. AirTight team member Mohamed Sohail Ahmad suggests that security software will have to rigorously validate where data packets come from before disconnecting users. 鈥淏ut that鈥檚 a hard task,鈥� he says.
Computer Viruses 鈥� Learn more about the threats to your PC in our comprehensive .
