A survey of Routing Attacks in Mobile Ad Hoc Networks

1. A survey of Routing Attacks in Mobile Ad Hoc Networks Bounpadith Kannhavong, Hidehisa Nakayama, Yoshiaki Nemoto, Nei Kato, and Abbas Jamalipour Presented by: Holly Bennett 11/8/07

2. Intro • Mobile Ad Hoc Networks (MANET) • Group of mobile devices • No predefined infrastructure • No centralized administration • Advantages: • Mobility • Low cost • No need for existing infrastructure • Users: • Disaster relief • Emergency operations • Military service • Maritime communications • Vehicle networks • Campus networks • Robot networks • Etc

3. Routing Methodologies • Reactive Routing Protocol • Ad Hoc On Demand Distance Vector AODV • S wants to send a packet to D • S does not have a route to D • S sends a routing request RREQ to all its neighbors • They either return a fresh path to D or forward the RREQ to their neighbors. • Once the RREQ reaches D it returns a route reply RREP

4. Routing Methodologies • Proactive Routing Protocols • Optimized Link State Routing OLSR • Key concept: multipoint relay MPR, to reduce overall traffic • Two types of messages: • Hello message to all neighbors, contains the nodes address and a list of all its one hop neighbors • The hello message gives each node a complete two-hop topology • Second type of message Topology Control TC messages • Only sent out by MPR nodes and contains the list of the senders MPR selector • Allows each node to learn the partial network topology and they can build a route to any node • MPR Selection • In OLSR a node selects as its MPR set the set of nodes that can reach all its two-hop neighbors.

5. Attacks and Countermeasures • Flooding Attack • Objective: exhaust network resources, overall bandwidth, and individual nodes resources of computational and battery power. • In AODV attacking node A sends out a large number of RREQs for a route to a non-existent node. • Countermeasures • Calculate rate of neighbors RREQs, block if they exceed threshold • Can not stop flooding below threshold and could block valid node if A is spoofing real nodes. • Use statistical analysis to detect varying rates of flooding

6. Attacks and Countermeasures • Blackhole Attack • Obj: Attacking node A returns fake routing information, causing the source node to choice a route through A, the attacker can then misuse or drop messages as it sees fit. • Countermeasures • Introduce route confirmation requests CREQ and route confirmations reply CREP • Intermediate nodes return RREPs and send CREQs to the next-hop node in the route to D, that node can send a CREP to S if it has a route to D. • Can not defend against collusion between attacking nodes that returns false CREPs that validate the false RREPs. • Proposal for a statistical analysis that compares destination sequence numbers to compare RREPs

7. Attacks and Countermeasures • Link Withholding Attack • Obj: Attacker does not advertise a link to a specific node or group of nodes. • Countermeasures: • Nodes listen for the TC message from the MPR node they selected, if they do not hear one that MPR node is rated suspicious and additional MPR nodes are selected. • Again the countermeasure can be defeated by collusion if A2 drops the TC message created by A1

8. Attacks and Countermeasures • Link Spoofing Attack • Obj: A attacking link advertises links to non-neighbors, by faking links to the two-hop neighbors of S, A can become one of its MPR nodes, and then manipulate traffic. • Countermeasures: • Equip nodes with GPS and calculate whether two nodes could really have a link. • Another solution is to include the 2-hop neighbors in the Hello message, this gives every node a 3-hop topology of the network, less expensive then special hardware, but is defeated by spoofing outside of 3-hops

9. Attacks and Countermeasures • Replay Attack • Obj: Attacker records another nodes control messages and resends them later. Can be used to spoof another node or just disrupt routing. • Countermeasures: • Add time stamp and asymmetric key to messages • Reject old messages as suspicious

10. Attacks and Countermeasures • Wormhole Attack • Obj: Two colluding attackers have a high speed link between them. Any RREQs that pass through the colluding nodes A1 and A2 will appear to cross the shortest path because of the high-speed link. This will cause S to send all messages to D through the compromised links A1 and A2. • Countermeasures: • Packet leashes, temporal and geographical. • These prevent a packet from moving too far too fast.

11. Attacks and Countermeasures • Colluding Misrelay Attacks • Obj: Two colluding attackers modify or drop packets • Countermeasures: • An acknowledgment system could detect this but will increase overhead. • Another solution is to increase transmission power twice to detect the colluding attackers. However even if we increase the transmission power K times, K+1 attackers can drop packets.

12. Summary • The advantages of the MANET are allowing them to be deployed much rapidly at low cost in a variety of applications. • Security is often necessary, and the weaknesses of a MANET need to be considered. The major weaknesses are the constrained bandwidth, processing power and battery power. • The article presented a survey of the various attacks currently considered against MANETs and summarized defenses that have been developed.