Greedy hackers can hog Wi-Fi bandwidth (New Scientist) [LWN.net]

The New Scientist has discovered that free software systems can make certain types of wireless bandwidth policies harder to enforce. "This type of hack became possible when a new generation of Wi-Fi access cards hit the market in 2003. The cards run the MAC protocol in software, rather than hardware. This makes it easy to change when using a Linux computer, on which all the code is openly available. For example, one line of the MAC protocol randomly assigns each hotspot user a rate for data transfer. The rates are constantly re-assigned so that on average each user receives data at the same rate. But by changing that line of the MAC protocol, a hacker can fix his rate at a high value, and siphon off most or all of the bandwidth."

(Log in to post comments)

Greedy hackers can hog Wi-Fi bandwidth (New Scientist)

Posted Jun 9, 2004 15:24 UTC (Wed) by Baylink (subscriber, #755) [Link]

Two additional thoughts:

> For example, one line of the MAC protocol randomly assigns each hotspot user a rate for data
transfer. The rates are constantly re-assigned so that on average each user receives data at
the same rate. But by changing that line of the MAC protocol, a hacker can fix his rate at a
high value, and siphon off most or all of the bandwidth.

One line of the MAC protocol code *WHERE*? It sounds very like the author is quoting someone
who means "on the WAP", where, clearly, the notional user can't *be* modifying code.

And secondly, this is very much akin to what happened to Quake -- you just can't *do* some
kinds of control client-side, since you can't guarantee you'll always be able to trust the
client. Architects *WILL* learn this lesson, probably as slowly and painfully as possible.

Greedy hackers can hog Wi-Fi bandwidth (New Scientist)

Posted Jun 9, 2004 23:04 UTC (Wed) by NCunningham (subscriber, #6457) [Link]

Doesn't it really show that such a scheme for assigning bandwidth is faulty in the first place?

After all, someone could presumably make the same changes to closed source software. It's just harder to do and less obviously possible.

The fault is not with open source software but with the initial design.

Nigel

Greedy hackers can hog Wi-Fi bandwidth (New Scientist)

Posted Jun 10, 2004 7:49 UTC (Thu) by beejaybee (guest, #1581) [Link]

Yup. The difference with closed source is that megacorporations thought they might be able to control us plebs that way. Once again open source shows its benefits for the vast majority of us.

The solution is to FIX THE PROTOCOL, which is BROKEN. Given the rate at which other problems with wireless protocols get fixed - e.g. the dire "security" offered by WAP, which obviously benefits agencies with an interest in reading encrypted signals as easily as possible - also the way in which China's attempt to get a superior standard were stamped on, the whole thing looks like a megacorporation / government agency plot. Surprise, surprise.

Greedy hackers can hog Wi-Fi bandwidth (New Scientist)

Posted Jun 11, 2004 14:50 UTC (Fri) by ekj (subscriber, #1524) [Link]

Well. In the absence of central management you don't have much choise other than cooperative when it comes to sharing a resource.

It's sorta like the specifications for ethernet says that you should use exponential backoff if you get collisions. That is, on detecting a collision, an implementation is expected to wait a random time between 0 and X before trying again, and if that collides too, to wait a random time between 0 and 2*X, and if that crashes, wait randomly 0 to 4X and so on.

Sooner or later the backoffs are enough that somebody will manage to transmit enough before the others that the other detect the line as busy, and refrain from sending.

Now, if you're on such a congested lan, obviously you can improve *your* troughput, at the cost of everyone elses, including the return-packets to you by the way, by the simple epediment of *always* waiting 0-X, never increasing your wait at all.

Aslong as all the others "play by the rules" you've successfully increased your part of the shared resource.

With ethernet this is now a non-issue thanks to buffering switches, but that is for obvious reasons not a solution that'll work for wireless.

For wireless, there's no way to "solve" this problem, other than either using some sort of central managing of transmit-time.

I suspect the real problem is quite small though, because of the fact that using this trick to increase your part of the transmit-slots will hurt everyone else including the return-packets to you. It *migth* help you a bit with uploading, but it'll help you precisely not at all if what you want to do is download.

Also, this has got precisely *nothing* to do with Linux, but is a general issue with cooperative sharing of a resource.

Greedy hackers can hog Wi-Fi bandwidth (New Scientist)

Posted Jun 10, 2004 6:50 UTC (Thu) by mathieu_lacage (subscriber, #3967) [Link]

A few comments on the New Scientist article: it contains a few factual errors such as the line cited in the headline. There is no clear relationship between a higher rate for a user and declining bandwidth available for the other users. There can be a relationship under certain conditions but, generally, I don't expect these to be fullfiled.

A draft of the cited paper is available online which precisely describes some problems of the underlying CSMA-CA protocol and some problems common to all wireless networks: it makes no mention of such rate/throughput relationships. Furhtermore, neither the original paper nor the similar article on the register refering to the same paper refer to specific open source problems related to this kind of attack.

Also, it should be noted that it is a mistake to simply dismiss the underlying CSMA-CA protocol as badly designed without taking into account the fact that 802.11 devices have to work on a broadcast medium which, by its very nature, cannot protect anyone from rogue users if they really don't want to be nice. Most ethernet networks until a few years ago were based on similar ideas when they used simplex cables with hubs and thus had to use CSMA-CD. Few people would claim ethernet was badly designed.

I personally don't see how this paper deserves a mention on the register or other mainstream news sites. It merely outlines well known problems with all wireless networks, that is, the fact that they deal with a broadcast transmission medium. Some of the attacks described in the paper could be conducted over GSM networks...