Abstract:Link Layer Discovery Protocol (LLDP), which is widely used by the controller in Software-Defined Networking to discover the network topology, has been demonstrated to be unable to guarantee the integrity of its messages. Attackers could exploit this vulnerability to fabricate LLDP packets to declare a false link connecting two distant switches to the controller. By doing so, the controller would be misled to route flows to the false links, which leads to further DoS, eavesdropping and even hijacking attacks. This attack seems very similar to the well-known Worm-Hole Attack in wireless sensor networking (WSN). Nevertheless, in WSN, attackers are assumed to leverage an out-of-band wired channel to achieve the true packet transmission between the two cheating sensor nodes. Unfortunately, in SDN, there usually does not exist any out-of-band channels between the distant cheating switches. Flows misguided to the fake link will cause 100% packet loss, and thus be detected soon. In this article, we address this problem and propose the first True worm-hole attack in SDN, which could achieve packet transmission over the forged link without using any out-of-band channels. Instead, it introduces a relay host in the networks to build a completely in-band covert channel between the two cheating switches. Unlike the existing studies, a relay host is not required to be directly linked to them. Moreover, attackers are only assumed to poss the remote read and write privileges of the flow tables of the both cheating switches and do not have to alter any of their software or hardware. Our extensive experiments demonstrate the high feasibility of this attack. Both the increases of transmission delays and packet loss rates are within a reasonable range. We finally present and evaluate the countermeasures against the proposed attack.

S0-No-More: A Z-Wave NonceGet Denial of Service Attack utilizing included but offline NodeIDs

Crushing the Wave -- new Z-Wave vulnerabilities exposed

Jamming Sensor Networks: Attack and Defense Strategies

SND: Secure Neighbor Discovery for 60 GHz Network with Directional Antenna

Vulnerabilities and Attacks of Inter-device Coordination in Programmable Networks.

LQG Control under Denial-of-Service Attacks: an Experimental Study

Ghost-in-ZigBee: Energy Depletion Attack on ZigBee-Based Wireless Networks

Defending Wireless Networks from Radio Interference Attacks

A Wormhole Attack Resistant Neighbor Discovery Scheme With RDMA Protocol for 60 GHz Directional Network

Determining sink location through Zeroing-In attackers in wireless sensor networks

Are Home Security Systems Reliable?

Input-Based Event-Triggering Consensus of Multiagent Systems under Denial-of-Service Attacks

Denial-of-Service Attacks on C-V2X Networks

Event-Triggered Finite-Time Formation Control for Networked Nonholonomic Mobile Robots under Denial-of-Service Attacks

Quantized Synchronization of Master-Slave Systems under Event-Triggered Control against DoS Attacks

Flow Misleading: Worm-Hole Attack in Software-Defined Networking Via Building In-Band Covert Channel

DoS Attacks and Countermeasures on Network Devices

Denial of Service Attacks Detection in Software-Defined Wireless Sensor Networks

NIS01-6: Stasis Trap: Cross-Layer Stealthy Attacks in Wireless Ad Hoc Networks

Optimal Joint Control and Triggering Strategies Against Denial of Service Attacks: A Zero-Sum Game

ZSBT: A Novel Algorithm for Tracing DoS Attackers in MANETs