Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones Simon Birnbach, Richard Baker, Ivan Martinovic

Transcription

1 Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones Simon Birnbach, Richard Baker, Ivan Martinovic 2017 NDSS

2 Let s Talk About Drones Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 2

3 Let s Talk About Drones Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 2

4 Let s Talk About Drones Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 2

5 Let s Talk About Drones Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 2

6 Let s Talk About Drones $399 Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 2

7 Why Should We Care? Ignore physical access restrictions High-quality camera equipment Spy tools in the hands of everybody Privacy invasions by drones get more common Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 3

8 Privacy invasion attacks Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 4

9 How to Detect? Various approaches Optical sensors Acoustic cameras High-frequency radar Expensive hardware needed Goal: Design cheap detection system Radio Frequency $3768 $$$ Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 5

10 Adversary Model Unmodified consumer drone Controlled over WiFi Streams live video Objective: Capture video through window Line-of-Sight (LOS) to window needed No direct access to premises d s d l Inside Outside d l : Launch distance d s : Surveillance distance Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 6

11 General Idea Off-the-shelf WiFi receiver Placement in window Guarantees LOS Access restrictions Drone starts further away Forces attacker to fly higher d s d l Challenges Received signal strength (RSS)! noisy data Unknown flight behavior Early detection Inside Outside d l : Launch distance d s : Surveillance distance Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 7

12 System Overview Pre-processing Statistical tests Presence! Drone nearby Attack analysis Attack phases! Approach! Surveillance! Escape Proximity! Closeness to window Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 8

13 Pre-Processing Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 9

14 Statistical Tests Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 10

15 Statistical Tests Attacker has to: overcome physical access restrictions! Drone is flying high above ground establish LOS to the window! changes of multipath effects! we expect far less multipath effects due to strong LOS component (compared with ground-based transmitters) Receiver Drone Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 11

16 Statistical Tests Attacker has to: overcome physical access restrictions! Drone is flying high above ground establish LOS to the window! changes of multipath effects! we expect far less multipath effects due to strong LOS component (compared with ground-based transmitters) Receiver Ground-based transmitter Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 11

17 Statistical Tests Attacker has to: overcome physical access restrictions! Drone is flying high above ground establish LOS to the window! changes of multipath effects! we expect far less multipath effects due to strong LOS component (compared with ground-based transmitters) move towards the window! RSS increases as drone approaches Detection method based on statistical tests: Testing for flying: Closer to free-space propagation than non-flying transmitters Testing for approaching & movement: significant RSS changes as distance to receiver varies Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 12

18 Statistical Tests Free-space propagation (FSP) RSS depends on distance and receiver noise Only noise varies in short time frame w s (<0.1s) Movement More distance variation than noise in longer interval w l (>1s) Compute standard deviation of RSS measurements Noise threshold t Derived from background noise Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 13

19 Statistical Tests Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 14

20 Statistical Tests Noise threshold Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 14

21 Statistical Tests FSP test Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 14

22 Statistical Tests Movement test Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 14

23 Attack Analysis Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 15

24 Attack Analysis Approach detection Increase in RSS difference shows drone is approaching Proximity alert User gets warned if RSS difference exceeds threshold Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 16

25 System Output Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 17

26 Experiment Setup Executed in secluded farmhouse Drones: DJI Phantom 3 Standard, Parrot Bebop Receiver: Raspberry Pi with WiPi stick mounted in window Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 18

27 Experiment Setup Executed in secluded farmhouse Drones: DJI Phantom 3 Standard, Parrot Bebop Receiver: Raspberry Pi with WiPi stick mounted in window $40 Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 18

28 System Challenges Normal behavior Erratic approach Not constantly approaching Establishes LOS very late Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 19

29 System Challenges Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 19

30 Straight Approach Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 20

31 Straight Approach Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 20

32 Straight Approach Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 20

33 Straight Approach FSP test Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 20

34 Straight Approach Movement test Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 20

35 Straight Approach Noise threshold Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 20

36 Straight Approach Launch Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 20

37 Straight Approach Approach Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 20

38 Straight Approach Surveillance Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 20

39 Straight Approach Escape Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 20

40 Detection Distances Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 21

41 Conclusion Developed method to detect drone privacy invasions Implemented on cheap hardware Real-world experiment with variety of approach patterns shows feasibility Good performance, minimal detection distance 48m Thank you for your attention! Questions? Simon Birnbach, Wi-Fly?: Detecting Privacy Invasion Attacks by Consumer Drones, 2017 NDSS 22