Exploiting Buffer Overflow Vulnerabilities in Software Defined Radios

As wireless systems are becoming more complex, there is a shift towards implementing these systems completely in software and firmware rather than hardware. Software defined radios allow for quickly prototyping, testing, and deployment of flexible systems that can be upgraded in the field. However,...

Full description

Saved in:
Bibliographic Details
Published in:2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) pp. 1921 - 1927
Main Authors: Hitefield, S. D., Fowler, M., Clancy, T. Charles
Format: Conference Proceeding
Language:English
Published: IEEE 01.07.2018
Subjects:
Communication system security
Communications System Security
Computer Security
Hardware
Security
Signal processing
Software
Software radio
Wireless communication
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:As wireless systems are becoming more complex, there is a shift towards implementing these systems completely in software and firmware rather than hardware. Software defined radios allow for quickly prototyping, testing, and deployment of flexible systems that can be upgraded in the field. However, since these systems are implemented in software, common coding mistakes in the signal processing modules can leave these systems vulnerable to traditional cyber-security attacks. As software radios become more prevalent in the industry, the risk of these vulnerabilities existing and being exploited in production systems increases significantly. In many cases, wireless security research is focused on the security of specific protocols rather than vulnerabilities in the radios themselves. Our research focuses specifically on these vulnerabilities that can exist in an implementation. We present two different examples of buffer overflow vulnerabilities in the link-layer processing blocks of a GNU Radio waveform. Both of these examples are based on poorly designed implementations and incorrect assumptions concerning the maximum possible length of a received message. By exploiting these vulnerabilities, we were able to successfully demonstrate persistent denial-of-service attacks and also the ability to remotely execute malicious code on the target. While a better implementation would solve these specific issues, these are examples of common programming mistakes that leave the system vulnerable to attack and can be easily overlooked during development.
DOI:10.1109/Cybermatics_2018.2018.00318