Search

802.11 device fingerprinting is the action of characterizing a target device through its wireless traffic. This results in a signature that may be used for identification, network monitoring or intrusion detection. The fingerprinting method can be active by sending traffic to the target device, or passive by just observing the traffic sent by the target device. Many passive fingerprinting methods rely on the observation of one particular network feature, such as the rate switching behavior or the transmission pattern of probe requests. In this work, we evaluate a set of global wireless network parameters with respect to their ability to identify 802.11 devices. We restrict ourselves to parameters that can be observed passively using a standard wireless card. We evaluate these parameters for two different tests: i) the identification test that returns one single result being the closest match for the target device, and ii) the similarity test that returns a set of devices that are close to the target devices. We find that the network parameters transmission time and frame inter-arrival time perform best in comparison to the other network parameters considered. Finally, we focus on inter-arrival times, the most promising parameter for device identification, and show its dependency from several device characteristics such as the wireless card and driver but also running applications., Comment: Proceedings of 32nd International Conference on Distributed Computing Systems Workshops (ICDCSW 2012), Workshop on Network Forensics, Security and Privacy (NFSP'12)

Trusted timestamping consists in proving that certain data existed at a particular point in time. Existing timestamping methods require either a centralized and dedicated trusted service or the collaboration of other participants using the timestamping service. We propose a novel trusted timestamping scheme, called DNStamp, that does not require a dedicated service nor collaboration between participants. DNStamp produces shortlived timestamps with a validity period of several days. The generation and verification involves a large number of Domain Name System cache resolvers, thus removing any single point of failure and any single point of trust. Any host with Internet access may request or verify a timestamp, with no need to register to any timestamping service. We provide a full description and analysis of DNStamp. We analyze the security against various adversaries and show resistance to forward-dating, back-dating and erasure attacks. Experiments with our implementation of DNStamp show that one can set and then reliably verify timestamps even under continuous attack conditions., The extended version of this work is to appear in Elsevier Computer Networks 64 (2014) pp. 208-224

International audience; More and more mobile devices feature wireless communica- tion capabilities. They can self-organize in a mobile ad hoc network in order to communicate and maintain connectivity without any infrastruc- ture component. In this context, some devices may benefit from established trust relations in order to communicate private data. Various solutions already exist for establishing and detecting such trust relations. But is it still possible to detect a trust relation in an unobservable manner? That is, in a way that an attacker cannot understand whether devices share a trust relation or not. We exhibit a solution to this problem. Our solution guaranties the anony- mity and the unobservability of participants against passive and active attackers. The security properties of the solution are machine checked with the AVISPA framework [2] and the SPAN tool [5]. The main applications could be found in mobile ad hoc networks and in vehicular networks [6, 7] where anonymity and unobservability contribute to a better privacy.

This paper relates the collaboration between industrial and academic teams for the design and the verification of a security protocol. The protocol is about trust establishment in large communities of devices where infrastructure components are not always reachable. The collaboration covers the writing of formal specifications up to their verification, using both manual and automated verification methods embedded in the AVISPA [1] and SPAN [7] tools. At each stage, the use of the visualization and protocol animation facilities of SPAN is key to the mutual understanding of working teams. As a result, we obtain much more confidence in the security of the final protocol. We also demonstrate the usefulness of some embedded countermeasures.

Geosocial networks, social networks integrating their users' location, meet an undeniable success. While traditional social networks are already subject to privacy breaches, the addition of location make such breaches to pile up. However, a not obvious question is : does this combination create a new type breaches which were not previously conceivable by the sole use of social networks or location information? We address this matter in two experiments. A first one which takes geosocial network users' profiles and classify them depending on whether their friends live globally close to or far from them. We find that 70 % of users in our Foursquare dataset have their friends living relatively close to them. The second experiment that we led use the check-ins of Gowalla and Brightkite users to discover their social graphs. The check-ins model the users' movements then we assume that users whose modellings are sufficiently similar are friends. This assumption comes from the fact that one often makes new friends in the places that he likes and where he spends a long time. Our partial findings seems to indicate that we are able to discover a half of a user'ssocial graph in average. Thus, we attempt a beginning of answer saying that geosocial networks actually allow new types of attacks against their users' privacy.

802.11 networks are largely adopted, thus the identification of wireless devices becomes a major issue in network security. This study takes place in the scope of a defensive scenario, and can be used to detect Medium Access Control (MAC) address spoofing. We develop an approach to improve the identification of unique devices while keeping existing 802.11 fingerprinting methods. We evaluate our approach on two state-of-the-art methods and successfully improve the identification of identical devices on one method.