2

I have found online multiple references to sniffing attacks on point-to-point microwave links, either by sitting in the side lobes or on a rooftop within the line-of-sight path. However, my search on man-in-the-middle attacks on these networks has returned nothing other than occasional mentions on product pages.

Does anyone know of an injection attack on a point-to-point microwave link?

The closest I have found is a company's white paper extoling their product's encryption with a cartoon drawing of a man-in-the-middle attack (Fig.1).

Improve this question
2
  • I think this highly depends on the specific equipments used and their error tolerance and correction mechanisms. Attacks are usually easy to detect (e.g. change in RTT) and easy to protect against (using encryption, apart from denial of service attacks).
    – billc.cn
    Commented Nov 16, 2015 at 16:24
  • I'm not aware of a specific data injection attack, (Alain's points are valid here.) There are certainly many examples of RF jamming, which are denial of service injection attacks.
    – John Deters
    Commented Nov 16, 2015 at 20:48

1 Answer 1

Reset to default
2

Microwave is not secure physically, but then again no Layer 1 network is secure (modulo physical security like burying, hardened cables, thick walls, and armed guards). Wireless, particularly through public airspace makes physical security a non-starter, so we have to move up the stack instead.

You enable security on top by using IPSec for Layer 3 (Network), TLS with AEAD for Layer 4 (Transport). Other options are possible.

I would treat the microwave network like the Internet in that is untrusted and anything you put on it is assumed to be readable as sent. This is pretty much what the white paper is advising as well.

For example you can achieve message integrity and confidentiality on an untrusted physical network by using TLS with AEAD cipher suites like TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 or TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (or many others).

Improve this answer
4
  • 1
    (also, encryption doesn't protect against MITM, packet authentication does.)
    – Adam Shostack
    Commented Nov 16, 2015 at 20:47
  • 2
    My question is really for documentation of an injection or MITM attack to make the case that it is a plausible attack vector. My concern is more message integrity than confidentiality. There is much literature out there regarding 802.11 attacks, but I can find nothing specific to point-to-point microwave, making me think it's a different beast. I assume that point-to-point microwave radios always transmit, forcing an attacker to have to interrupt or overpower the transmitter.
    – Stephen Craven
    Commented Nov 17, 2015 at 11:46
  • @StephenCraven okay interesting. I misinterpreted that. You can achieve integrity on an untrusted physical network by using TLS with AEAD cipher suites like TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 or TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (and many others). I don't know how physical MitM would be effective with that. I think DoS might be a greater concern, but physical DoS on microwave would be obvious, easily located, and clearly illegal.
    – Alain O'Dea
    Commented Nov 17, 2015 at 11:54
  • @AdamShostack good point. I totally missed that. Without AEAD, TLS wouldn't be effective. Encryption by itself certainly isn't. Noted :)
    – Alain O'Dea
    Commented Nov 17, 2015 at 11:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .