Abstract:The broadcast nature of wireless media makes WLANs easily attacked by rogue Access Points (APs) . Rogue AP attacks can potentially cause severe privacy leakage and financial loss. Hardware fingerprinting is the state-of-the-art technology to detect rogue APs since an attacker would find it difficult to set up a rogue AP with specific hardware fingerprints. However, existing hardware fingerprints not only depend on the AP but also depend on the client, significantly limiting their application scenarios. In this work, we investigate two novel client-agnostic fingerprints, which can be extracted using commercial off-the-shelf WiFi devices, to detect rogue APs. One is the power amplifier non-linearity fingerprint and the other is the frame interval distribution fingerprint . These two fingerprints remain consistent over time and space for the same AP but vary across different APs even with the same brand, model, and firmware. We use the fingerprint similarity between the candidate AP and the authorized AP for device authentication in typical indoor environments. We have also proposed a threshold-improved authentication scheme to improve the robustness of our system in dynamic environments. Our schemes can be implemented without modifying the infrastructural APs and can work well with new clients without rebuilding the fingerprint database. We evaluate our scheme in both in-lab and field scenarios, by analyzing 18 million WiFi packets. Results show that our scheme achieves an overall 96.55% positive detection rate and a 4.31% false alarm rate. Moreover, the threshold-improved authentication scheme can further reduce the false alarm rate by 13.0%-44.8% for dynamic environments.

Preventing Wi-Fi Privacy Leakage: A User Behavioral Similarity Approach

Detecting Rogue Access Points Using Client-agnostic Wireless Fingerprints.

Smartphone Privacy Leakage of Social Relationships and Demographics from Surrounding Access Points.

An Efficient Privacy-Preserving Scheme for Wireless Link Layer Security

PLAM: A Privacy-Preserving Framework for Local-Area Mobile Social Networks.

WiShield: Privacy Against Wi-Fi Human Tracking

PSP: Proximity-Based Secure Pairing of Mobile Devices Using WiFi Signals

Probing for Passwords -- Privacy Implications of SSIDs in Probe Requests

Smart Home: Keeping Privacy Based on Air-Padding

A Framework for Behavior Privacy Preserving in Radio Frequency Signal

How Can I Guard My Ap? Non-Intrusive User Identification For Mobile Devices Using Wifi Signals

How Can I Guard My AP?

Reduce to the MACs -- Privacy Friendly Generic Probe Requests

Unauthorized and Privacy-Intrusive Human Activity Watching Through Wi-Fi Signals: an Emerging Cybersecurity Threat

Walls Have No Ears: A Non-Intrusive WiFi-Based User Identification System for Mobile Devices

Adversarial WiFi Sensing for Privacy Preservation of Human Behaviors

Privacy Leakage in Mobile Sensing: Your Unlock Passwords Can Be Leaked Through Wireless Hotspot Functionality.

Probe Request Based Device Identification Attack and Defense

Preserving Privacy in WiFi Localization With Plausible Dummy Locations

Tracku: Exploiting User'S Mobility Behavior Via Wifi List

WiFiLeaks: Exposing Stationary Human Presence Through a Wall with Commodity Mobile Devices