man-in-the-middle attack, rtls, vulnerability, wifi

Security researchers have uncovered multiple vulnerabilities impacting UWB (ultra-wideband) RTLS (real-time locating systems), enabling threat actors to conduct man-in-the-middle attacks and manipulate tag geo-location data.

RTLS technology is widely used in industrial environments, mass transit, healthcare, and smart city applications. Its primary role is to assist in safety by defining geofencing zones using tracking tags, signal reception anchors, and a central processing system.

man-in-the-middle attack, rtls, vulnerability, wifi

General architecture of RTLS systems (Nozomi)

Tampering with the limits of hazard zones or the position of people in these environments can have dire consequences for their health and safety.

Researchers at Nozomi Networks revealed the previously undocumented security flaws during Black Hat 2022, while the full technical details were published in a white paper yesterday.

Non-encrypted communications

Nozomi analysts focused on the Sewio Indoor Tracking RTLS UWB Wi-Fi kit and Avalue Renity Artemis Enterprise kit, two widely used RTLS solutions that support the safety functionalities described above.

The tracking tags communicate with the anchor via UWB signals, while the anchors use Ethernet or Wi-Fi to transmit or receive data from the central computer.

If Wi-Fi is selected, both devices use a custom binary network protocol for communications. However, since there’s no encryption in the data, Wireshark captures of the network packets make reverse engineering possible.

man-in-the-middle attack, rtls, vulnerability, wifi

Captured Avalue network packet (Nozomi)

The prerequisite for capturing those packets is to break into the Wi-Fi network, which is WPA2-PSK-protected. However, both vendors use a weak default password that may not be re-configured during installation, so many deployments are easy to breach.

If a remote attacker manages to compute the position of the anchors to derive the relative position of the tracking tags, they would be able to send arbitrary values to the central computer by forging sync and positioning packets.

Nozomi says the key information of anchor positioning can be derived through the transmitted power levels and timestamps, which indicate tag distances from the anchor points. However, physical access to the target area would simplify this process.

man-in-the-middle attack, rtls, vulnerability, wifi

Transmission power levels in the packet (Nozomi)

Apart from data manipulation, an attacker may eavesdrop to track assets and people positions, either for stalking and reconnaissance or for locating a valuable item.

man-in-the-middle attack, rtls, vulnerability, wifi

Obtaining the position of a target tag (Nozomi)

Movement patterns can be recorded and replayed during attacks to imitate realistic tag movement, like a guard on patrol, for example.

Tampering with geofencing

An attacker with access to the RTLS system can alter the position of a tag as needed to allow entrance to a restricted area or to raise false alarms and disrupt production line operations.

man-in-the-middle attack, rtls, vulnerability, wifi

Placing a tag inside a protected zone at will (Nozomi)

Additionally, personnel could be put at physical harm risk by making them appear outside the proximity of machine safety zones, which would continue operating as if nobody was around.

man-in-the-middle attack, rtls, vulnerability, wifi

Altering the position of a target tag (Nozomi)

If the threat actor aims to steal a valuable item tracked by a tag, they could manipulate its position to make it appear stable inside a protected zone while physically removing it from the monitored area without raising any alarms.

Nozomi suggests that admins of RTLS systems should use firewalls to restrict access, add intrusion detection systems in the network, and use SSH tunneling with packet synchronization counter-values for data encryption.

TECH NEWS RELATED

China's Tech Industry and Education Is Far Behind, Says Education Agency Exec; Now It Affects the Future of Local Semiconductor Field

As the United States policy limits China’s access to advanced chip technology, the Chinese government has expressed an interest in developing the country’s capacity for self-sufficient chip manufacturing. However, the country lacks qualified workers as education is outdated. Moreover, South China Morning Post reported that students are not interested in the ...

View more: China's Tech Industry and Education Is Far Behind, Says Education Agency Exec; Now It Affects the Future of Local Semiconductor Field

New cleaning technique boosts electronic and photonic prospects of aluminum nitride

Cross-sectional microscopy images of molecular beam epitaxy-grown aluminum nitride on aluminum nitride templates. The black squares in (A) and (E) mark the regions where the corresponding magnified images (B to D and F to H) are taken. The white notches in (A) and (E) indicate the growth interfaces. The ...

View more: New cleaning technique boosts electronic and photonic prospects of aluminum nitride

Utilizing chemo-mechanical oscillations to mimic protocell behavior in manufactured microcapsules

Credit: Oleg E. Shklyaev et al, Matter (2022). DOI: 10.1016/j.matt.2022.06.063 The complexity of life on Earth was derived from simplicity: From the first protocells to the growth of any organism, individual cells aggregate into basic clumps and then form more complex structures. The earliest cells lacked complicated biochemical machinery; ...

View more: Utilizing chemo-mechanical oscillations to mimic protocell behavior in manufactured microcapsules

Research team develops a cleaner, more cost-effective way to make useful industrial chemicals

Credit: Tony Jin et al, Angewandte Chemie International Edition (2022). DOI: 10.1002/anie.202207206 Two renewable resources—cellulose from wood pulp and chitin from the shells of crabs, lobsters and other crustaceans—are known to industrial chemists for their potential for creating highly versatile nanocrystals, useful for making pharmaceuticals, cosmetics, industrial additives and ...

View more: Research team develops a cleaner, more cost-effective way to make useful industrial chemicals

3M hopes its new powder can help unlock green hydrogen production

3M senior research scientist Andy Steinbach held a catalyst powder that promises to unlock lower-cost green hydrogen production. Credit: 3M A material 3M has been working on for decades could be key to unlocking cost-effective production of green hydrogen, a promising but expensive renewable fuel source. The product—3M nanostructured-supported ...

View more: 3M hopes its new powder can help unlock green hydrogen production

Europe can rapidly eliminate imports of Russian natural gas, say researchers

Credit: Pixabay/CC0 Public Domain Using a new power sector model, a team of researchers, including faculty at Binghamton University, State University of New York, has proposed a method for Europe to eliminate natural gas imports from Russia. The team’s commentary article, “Europe’s way out: Tools to rapidly eliminate imports ...

View more: Europe can rapidly eliminate imports of Russian natural gas, say researchers

Judge says Twitter-Musk trial still on track

Neither Twitter nor Elon Musk have asked the court to put the case on hold, so the judge ruled she would ‘continue to press on toward our trial’ The judge presiding over Twitter’s legal battle to hold Elon Musk to his $44-billion buyout deal said Wednesday the case was ...

View more: Judge says Twitter-Musk trial still on track

Climate change made summer drought 20 times more likely

Credit: Pixabay/CC0 Public Domain Drought that stretched across three continents this summer—drying out large parts of Europe, the United States and China—was made 20 times more likely by climate change, according to a new study. Drought dried up major rivers, destroyed crops, sparked wildfire, threatened aquatic species and led ...

View more: Climate change made summer drought 20 times more likely

Study: Removing GRE requirement does not undermine student success

Earth System Grid Federation launches effort to upgrade climate projection data system

Some everyday materials have memories, and now they can be erased

Logging down the value chain raises future forest sustainability concerns

Researchers develop new tool for targeted cell control

Twitter Now Lets You Combine Images, Videos and GIFs in One Tweet

VPN Demand Surges in Iran as Protests Continue, Researchers Say

Russia Blocks Access to Crypto Exchange OKX

Spider-Man 4 might not bring back Peter’s best friend

One woman’s Apple Watch told her she was pregnant before anything else

Nintendo Launches Its Own Animation Studio

BlackByte ransomware abuses legit driver to disable security products

OTHER TECH NEWS

Top Car News Car News