A survey of Routing Attacks in Mobile Ad Hoc Networks

1
A survey of Routing Attacks in Mobile Ad Hoc
Networks

• Bounpadith Kannhavong, Hidehisa Nakayama,
  Yoshiaki Nemoto, Nei Kato, and Abbas Jamalipour
• Presented by
• Holly Bennett
• 11/8/07

2
Intro

• Mobile Ad Hoc Networks (MANET)
• Group of mobile devices
• No predefined infrastructure
• No centralized administration
• Advantages
• Mobility
• Low cost
• No need for existing infrastructure
• Users
• Disaster relief
• Emergency operations
• Military service
• Maritime communications
• Vehicle networks
• Campus networks
• Robot networks
• Etc

3
Routing Methodologies

• Reactive Routing Protocol
• Ad Hoc On Demand Distance Vector AODV
• S wants to send a packet to D
• S does not have a route to D
• S sends a routing request RREQ to all its
  neighbors
• They either return a fresh path to D or forward
  the RREQ to their neighbors.
• Once the RREQ reaches D it returns a route reply
  RREP

4
Routing Methodologies

• Proactive Routing Protocols
• Optimized Link State Routing OLSR
• Key concept multipoint relay MPR, to reduce
  overall traffic
• Two types of messages
• Hello message to all neighbors, contains the
  nodes address and a list of all its one hop
  neighbors
• The hello message gives each node a complete
  two-hop topology
• Second type of message Topology Control TC
  messages
• Only sent out by MPR nodes and contains the list
  of the senders MPR selector
• Allows each node to learn the partial network
  topology and they can build a route to any node
• MPR Selection
• In OLSR a node selects as its MPR set the set of
  nodes that can reach all its two-hop neighbors.

5
Attacks and Countermeasures

• Flooding Attack
• Objective exhaust network resources, overall
  bandwidth, and individual nodes resources of
  computational and battery power.
• In AODV attacking node A sends out a large number
  of RREQs for a route to a non-existent node.
• Countermeasures
• Calculate rate of neighbors RREQs, block if they
  exceed threshold
• Can not stop flooding below threshold and could
  block valid node if A is spoofing real nodes.
• Use statistical analysis to detect varying rates
  of flooding

6
Attacks and Countermeasures

• Blackhole Attack
• Obj Attacking node A returns fake routing
  information, causing the source node to choice a
  route through A, the attacker can then misuse or
  drop messages as it sees fit.
• Countermeasures
• Introduce route confirmation requests CREQ and
  route confirmations reply CREP
• Intermediate nodes return RREPs and send CREQs to
  the next-hop node in the route to D, that node
  can send a CREP to S if it has a route to D.
• Can not defend against collusion between
  attacking nodes that returns false CREPs that
  validate the false RREPs.
• Proposal for a statistical analysis that compares
  destination sequence numbers to compare RREPs

7
Attacks and Countermeasures

• Link Withholding Attack
• Obj Attacker does not advertise a link to a
  specific node or group of nodes.
• Countermeasures
• Nodes listen for the TC message from the MPR node
  they selected, if they do not hear one that MPR
  node is rated suspicious and additional MPR nodes
  are selected.
• Again the countermeasure can be defeated by
  collusion if A2 drops the TC message created by A1

8
Attacks and Countermeasures

• Link Spoofing Attack
• Obj A attacking link advertises links to
  non-neighbors, by faking links to the two-hop
  neighbors of S, A can become one of its MPR
  nodes, and then manipulate traffic.
• Countermeasures
• Equip nodes with GPS and calculate whether two
  nodes could really have a link.
• Another solution is to include the 2-hop
  neighbors in the Hello message, this gives every
  node a 3-hop topology of the network, less
  expensive then special hardware, but is defeated
  by spoofing outside of 3-hops

9
Attacks and Countermeasures

• Replay Attack
• Obj Attacker records another nodes control
  messages and resends them later. Can be used to
  spoof another node or just disrupt routing.
• Countermeasures
• Add time stamp and asymmetric key to messages
• Reject old messages as suspicious

10
Attacks and Countermeasures

• Wormhole Attack
• Obj Two colluding attackers have a high speed
  link between them. Any RREQs that pass through
  the colluding nodes A1 and A2 will appear to
  cross the shortest path because of the high-speed
  link. This will cause S to send all messages to
  D through the compromised links A1 and A2.
• Countermeasures
• Packet leashes, temporal and geographical.
• These prevent a packet from moving too far too
  fast.

11
Attacks and Countermeasures

• Colluding Misrelay Attacks
• Obj Two colluding attackers modify or drop
  packets
• Countermeasures
• An acknowledgment system could detect this but
  will increase overhead.
• Another solution is to increase transmission
  power twice to detect the colluding attackers.
  However even if we increase the transmission
  power K times, K1 attackers can drop packets.

12
Summary

• The advantages of the MANET are allowing them to
  be deployed much rapidly at low cost in a variety
  of applications.
• Security is often necessary, and the weaknesses
  of a MANET need to be considered. The major
  weaknesses are the constrained bandwidth,
  processing power and battery power.
• The article presented a survey of the various
  attacks currently considered against MANETs and
  summarized defenses that have been developed.