Home > News & Events > MITRE Publications > The Edge >

With the increased value of information comes the need to approach it in new ways. The rapid expansion of wireless connectivity, the merger of wireless infrastructures worldwide, and the availability of high-capacity networks present new challenges and opportunities for both offensive operations and defensive postures in the world of information warfare (IW).

IW has many elements. To appreciate them, it is important to discuss IW from several perspectives, including information collection, protection, denial, management, and transport. Together, these define options, risks, and opportunities. How an organization chooses to implement and prioritize these elements determines its IW strategy, which in turn affects its competitive position. In the world of wireless communications, several of these areas of IW are used for both defensive and offensive operations. Information denial and information collection continue to be the primary vulnerabilities.

One of the most challenging security issues associated with wireless networks involves the inherent radio frequency (RF) emanations. Radio waves are subject to interception and reconstruction by active, deliberate means (physical trespass and acquisition of the signal) or by passive means (receiving the signal from an external location, e.g., driving by or sitting in a nearby parking lot and eavesdropping). This makes wireles communications subject to an array of vulnerabilities in confidentiality, including eavesdropping, masquerading, traffic analysis, browsing, leakage, and interference.

Denial and Direct Attacks
Information denial includes measures beyond normal protection that specifically target an adversary's collection systems. There are two types of denial: carrying out direct attacks on the adversary's information systems, and providing misinformation to its systems to deceive and induce the adversary to take actions that are not to its advantage. In addition, denial of service (DoS) vulnerabilities include intervention or jamming, resource exhaustion, misuse of privileges, and abuse of services.

 

Example of a wireless system architecture.

For the military, direct attacks include electronic warfare (i.e., jamming) of sensors and radio links. In business, analogous forms of direct attack seek to undermine the integrity or availability of competitors’ systems. The leveraging of commercial-off-the-shelf (COTS) infrastructures, both landline and wireless, transposes the classic IW world of the military into industrial, social, and economic attacks on computers and networks. The Internet now connects all of an organization's networked computers by high-speed links, not only to each other, but also to the systems of every competitor around the world. Standard Internet protocols such as the file transfer protocol allow the entire contents of a computer to be copied or replaced in minutes.

These capabilities enable both forms of direct attack. Integrity attacks include corrupting data or software so that the targeted competitor does not use the information or processes it expects. Availability attacks include many methods of interfering with the normal operation of a competitor's networked systems so that they will not function properly when the competitor needs them. This generic and obvious network vulnerability, when applied to commercial wireless systems, can be leveraged to clone mobile subscribers through acquisition of real-time billing information, collect and record information traffic, deny service through real-time blacklisting, and deny service through selective RF electronic countermeasures.

Mobile subscribers, military or civilian, should understand the vulnerabilities in each element of the COTS wireless infrastructure when they use these systems to provide a measure of information and personnel security. Law enforcement and military operations can leverage these vulnerabilities for offensive operations against criminals and other “undesirables.” Active and passive techniques can be used at each element of the system, including physical and remote tampering with user terminals, RF attacks against air interfaces, and computer and network attacks against network and system operation. Additional access points appear with new designs.

As one example of the vulnerabilities behind each specific point in a cellular infrastructure, an assessment of the air interface at the mobile subscriber point can be described in five basic areas of vulnerability: traffic analysis, message access, DoS, compromise of messages, and unauthorized use of the system.

First-generation cellular protocols were based on narrow-bandwidth analog modulation schemes, which were easily demodulated by conventional RF scanners and test equipment. This created vulnerabilities concerning access to traffic analysis, message content or access, and message modification. The migration to digital modulation schemes and the increased complexities of the signal-in-space waveforms created greater complexities and challenges for the interceptor, requiring attackers to invest in more sophisticated and more costly capabilities and equipment. The widespread use of encryption and heightened security awareness have improved the security of the air interface for today’s worldwide installations of second-generation systems. Denial of service, either by conventional RF jamming or network flooding, remains relatively easy for most generations of cellular services based on known frequency assignments of traffic and management channels, finite information capacity, and limited link margins.

Comparing the air interface assessments with the next point of access in the system infrastructure, an assessment of the network indicates that an attacker requires low sophistication and that access is easy. In early installations, much of the cellular network infrastructure was unprotected in terms of both physical and information security, resulting in broad-scale access to most systems.

Wireless technologies enable communications and access depending on the users’ locations, their relative mobility, and their devices. Current and emerging technologies, such as Bluetooth^TM for personal area networks and Global System for Mobile Communication and General Packet Radio Service for cellular mobile telephony systems, can be combined to provide wireless access solutions across distances from as little as 10 meters to several kilometers.

Although many of these technologies overlap, no single wireless technology satisfies government and commercial requirements for access and security. According to a Gartner Dataquest study, these shortcomings will persist over the development and implementation of third-generation systems.

Developers are aware of the security and IW vulnerabilities associated with these systems, however, and evolving standards—and in some cases implementations—demonstrate solutions that mitigate selected issues.

---

For more information, please contact Jim Howland using the employee directory.

---