Passive data link layer 802.11 wireless device driver fingerprinting

TLDR

The technique is valuable for attackers who wish to conduct reconnaissance and launch driver‑specific exploits. The authors develop a passive fingerprinting method that accurately and efficiently identifies the wireless device driver on an IEEE 802.11 device without requiring device modification or cooperation, and they discuss countermeasures to improve security. The method passively fingerprints the driver on an IEEE 802.11 device, accurately and efficiently, without needing device modification or cooperation. Evaluation shows the technique quickly and accurately fingerprints wireless device drivers under real‑world network conditions.

Abstract

Motivated by the proliferation of wireless-enabled devices and the suspect nature of device driver code, we develop a passive fingerprinting technique that identifies the wireless device driver running on an IEEE 802.11 compliant device. This technique is valuable to an attacker wishing to conduct reconnaissance against a potential target so that he may launch a driver-specific exploit. In particular, we develop a unique fingerprinting technique that accurately and efficiently identifies the wireless driver without modification to or cooperation from a wireless device. We perform an evaluation of this fingerprinting technique that shows it both quickly and accurately fingerprints wireless device drivers in real world wireless network conditions. Finally, we discuss ways to prevent fingerprinting that will aid in improving the security of wireless communication for devices that employ 802.11 networking.