Here, there, and everywhere: security analysis of wi-fi fine timing measurement
Here, there, and everywhere: security analysis of wi-fi fine timing measurement
复制标题
DOI：
10.1145/3448300.3467828
复制
发表时间：
2021-06
期刊：
影响因子：
--
通讯作者：
Domien Schepers;Mridula Singh;Aanjhan Ranganathan
中科院分区：
文献类型：
--
作者：
Domien Schepers;Mridula Singh;Aanjhan Ranganathan
如今，越来越多的应用程序依赖于位置和邻近信息来提供服务。随着IEEE 802.11-2016标准中Wi-Fi精细定时测量（FTM）的引入，Wi-Fi衍生的位置和邻近信息将在许多安全和安全关键型应用中发挥关键作用。例如，Wi-Fi FTM在Wi-Fi Aware中被采用，其中它实现地理围栏和移动的识别。在本文中，我们对Wi-Fi FTM进行了首次安全分析，并分析了其在逻辑和物理层上的安全保证。我们发现了各种弱点，使攻击者能够引入距离减少和扩大任何任意攻击者选择的值，只需要商品硬件。我们使用商业接入点、智能手机和现成的Wi-Fi卡进行了评估，并表明攻击者可以以米级的精度操纵距离。此外，我们强调的距离操纵攻击是独立于任何更高层的加密保护，暴露出基本的限制，以实现安全的距离测量在当前的标准。最后，我们为Wi-Fi FTM和下一代定位协议的设计和实施提出了安全建议。
Today, an increasing number of applications rely on location and proximity information to deliver services. With the introduction of Wi-Fi Fine Timing Measurement (FTM) in the IEEE 802.11-2016 standard, Wi-Fi derived location and proximity information will play a key role in many safety- and security-critical applications. For example, Wi-Fi FTM is adopted in Wi-Fi Aware where it enables geo-fencing and mobile identification. In this paper, we perform the first security analysis of Wi-Fi FTM and analyze its security guarantees across the logical and physical layers. We find various weaknesses that enable an attacker to introduce distance reductions and enlargements to any arbitrary attacker-chosen value, requiring commodity hardware only. We perform an evaluation using commercial access points, smartphones, and off-the-shelf Wi-Fi cards, and show that an attacker can manipulate distances with meter-level precision. Furthermore, we highlight the distance manipulation attacks which are independent of any higher-layer cryptographic protection, exposing fundamental limitations to achieving secure distance measurements in the current standard. Finally, we present security recommendations for the design and implementation of Wi-Fi FTM and next-generation positioning protocols.