Systems and methods for disseminating location-based reputations for link-layer wireless attacks

The disclosed computer-implemented method for disseminating location-based reputations for link-layer wireless attacks may include (i) receiving, at a server from a first wireless client, a wireless-attack report for a location that includes (a) information that indicates that the first wireless client detected a link-layer wireless attack (e.g., a wireless-access-point spoofing attack or a deauthentication attack) at the location or (b) information that indicates that the first wireless client did not detect any link-layer wireless attacks at the location, (ii) using, at the server, the wireless-attack report to generate a reputation for link-layer wireless attacks for the location, (iii) receiving, at the server from a second wireless client, a request for the reputation of the location, and (iv) responding to the request with the reputation of the location. Various other methods, systems, and computer-readable media are also disclosed.

BACKGROUND

Wireless access points may provide users of internet-enabled devices with efficient and/or widespread access to wired network connections. To facilitate efficient connections to wireless access points, many computing devices may remember the configuration details of a wireless access point after connecting to the wireless access point for the first time. When re-entering the range of the wireless access point, a computing device may request access to the wireless access point and quickly re-connect.

When initially establishing a connection to a wireless access point, a computing device may store information that identifies the wireless access point and/or the network to which the wireless access point provides access. In particular, the computing device may store the Service Set IDentifier (SSID), the Basic Service Set IDentifier (BSSID), or Media Access control (MAC) address of the wireless access point. The computing device may later use this information to attempt to re-connect to the (now known) wireless access point. For example, when not connected to the known wireless access point, the computing device may be configured to automatically and periodically (e.g., every half second, every minute, etc.) transmit a request to connect to the known wireless access point. Specifically, when not connected to the known wireless access point, the computing device may repeatedly transmit probe requests (via an 802.11 protocol) that contain the SSID or BSSID of the known wireless access point. If the known wireless access point receives a probe request directed to it, the wireless access point may respond with a probe response that contains the SSID or BSSID of the known wireless access point. When the computing device receives a probe response from the known wireless access point, the computing device may attempt to re-connect to the known wireless access point.

Unfortunately, traditional technologies for connecting computing devices to wireless access points may have certain security deficiencies that may leave the computing devices vulnerable to various link-layer wireless attacks. For example, conventional network security systems may fail to provide any reliable and/or trusted techniques for computing devices to verify the legitimacy and/or identity of wireless access points. As a result, an attacker may configure a malicious device (e.g., a so-called WIFI PINEAPPLE) to mimic or spoof a wireless access point known to a computing device. For example, the attacker may configure the malicious device to respond to a computing device's probe requests as if the malicious device was a wireless access point known to the computing device. Since the malicious device acts like a known wireless access point, the computing device may connect to the malicious device as if it was the known wireless access point. After the computing device connects to the malicious device, the attacker may view all network traffic sent to and from the computing device. Some computing devices may be capable of detecting link-layer wireless attacks, however, some computing devices (e.g., mobile devices with restricted operating systems) may be less capable or unable to do so. The instant disclosure, therefore, identifies and addresses a need for systems and methods for disseminating location-based reputations for link-layer wireless attacks.

SUMMARY

As will be described in greater detail below, the instant disclosure describes various systems and methods for disseminating location-based reputations for link-layer wireless attacks. In one example, a system for disseminating location-based reputations for link-layer wireless attacks may include several modules stored in memory, including (i) a report-receiving module that receives, at a server from a first wireless client, a wireless-attack report for a location that includes (a) information that indicates that the first wireless client detected a link-layer wireless attack (e.g., a wireless-access-point spoofing attack or a deauthentication attack) at the location or (b) information that indicates that the first wireless client did not detect any link-layer wireless attacks at the location, (ii) a reputation-generating module, stored in memory, that uses, at the server, the wireless-attack report to generate a reputation for link-layer wireless attacks for the location, (iii) a request-receiving module, stored in memory, that receives, at the server from a second wireless client, a request for the reputation of the location, and (iv) a responding module, stored in memory, that responds to the request with the reputation of the location. In some examples, the system may also include at least one physical processor that executes the report-receiving module, the reputation-generating module, the request-receiving module, and the responding module.

In one embodiment, a method for disseminating location-based reputations for link-layer wireless attacks may include (i) receiving, at a server from a first wireless client, a wireless-attack report for a location that includes (a) information that indicates that the first wireless client detected a link-layer wireless attack at the location or (b) information that indicates that the first wireless client did not detect any link-layer wireless attacks at the location, (ii) using, at the server, the wireless-attack report to generate a reputation for link-layer wireless attacks for the location, (iii) receiving, at the server from a second wireless client, a request for the reputation of the location, and (iv) responding to the request with the reputation of the location.

In some examples, the method may further include (i) determining, at the first wireless client, a location of the first wireless client, (ii) detecting, at the first wireless client, the link-layer wireless attack, (iii) generating, at the first wireless client, the wireless-attack report to include (a) information that identifies the location of the first wireless client and (b) information that describes the link-layer wireless attack, and (iv) transmitting, from the first wireless client, the wireless-attack report to the server. In other examples, the method may further include (i) determining, at the first wireless client, a location of the first wireless client, (ii) attempting, at the first wireless client, to detect one or more link-layer wireless attacks at the location of the first wireless client, (iii) determining, at the first wireless client, that no link-layer wireless attacks are occurring at the location of the first wireless client, (iv) generating, at the first wireless client, the wireless-attack report to include (a) information that identifies the location of the first wireless client and (b) information that indicates that no link-layer wireless attacks are occurring at the location of the first wireless client, and (v) transmitting, from the first wireless client, the wireless-attack report to the server.

In some examples, the method may further include (i) determining, at the second wireless client, the location of the second wireless client, (ii) querying, at the second wireless client before connecting to a wireless access point at the location of the second wireless client, the server for a reputation for link-layer wireless attacks for the location of the second wireless client, and (iii) performing, at the second wireless client, a security action in response to receiving a poor reputation for the location of the second wireless client. In one example, the step of performing the security action may include (i) warning a user of the second wireless client of a risk of connecting to the wireless access point, (ii) preventing the second wireless client from auto connecting to the wireless access point, and/or (iii) preventing the second wireless client from connecting to the wireless access point.

In at least one example, the method may further include (i) determining, at the second wireless client, the location of the second wireless client, (ii) querying, at the second wireless client before connecting to a wireless access point at the location of the second wireless client, the server for a reputation for link-layer wireless attacks for the location of the second wireless client, and (iii) connecting, at the second wireless client, to the wireless access point in response to receiving a good reputation for the location of the second wireless client.

In some examples, the method may further include receiving, at the server from one or more additional wireless clients, one or more additional wireless-attack reports for the location, and the step of using the wireless-attack report to generate the reputation for the location may include using, at the server, the one or more additional wireless-attack reports to generate the reputation for the location. In another example, the method may further include maintaining, at the server, a reputation for making false reports for the first wireless client, and the wireless-attack report may be used to generate the reputation for link-layer wireless attacks for the location based at least in part on the reputation of the first wireless client indicating that the first wireless client does not make false reports.

In some examples, the above-described method may be encoded as computer-readable instructions on a non-transitory computer-readable medium. For example, a computer-readable medium may include one or more computer-executable instructions that, when executed by at least one processor of a computing device, may cause the computing device to (i) receive, at a server from a first wireless client, a wireless-attack report for a location that includes (a) information that indicates that the first wireless client detected a link-layer wireless attack at the location or (b) information that indicates that the first wireless client did not detect any link-layer wireless attacks at the location, (ii) use, at the server, the wireless-attack report to generate a reputation for link-layer wireless attacks for the location, (iii) receive, at the server from a second wireless client, a request for the reputation of the location, and (iv) respond to the request with the reputation of the location.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

The present disclosure is generally directed to systems and methods for disseminating location-based reputations for link-layer wireless attacks. As will be explained in greater detail below, by maintaining a location-based reputation for link-layer wireless attacks for a location based on whether one or more wireless clients have or have not detected link-layer wireless attacks at the location, the systems and methods described herein may disseminate the location-based reputations to additional wireless clients that find themselves at the location and that are unsure of the safety of connecting to wireless access points at the location. Furthermore, in some examples, by disseminating a location-based reputation to a wireless client that finds itself at a particular location and needing to connect to a wireless access point, these systems and methods may enable the wireless client to judge whether it is safe to do so.

In addition, the systems and methods described herein may improve the functioning of a computing device by enabling the computing device to determine the likelihood of experiencing a link-layer wireless attack at a particular location thus reducing the computing device's likelihood of experiencing link-layer wireless attacks. These systems and methods may also improve the field of wireless security by reducing the likelihood that wireless clients will connect to illegitimate wireless access points. Embodiments of the instant disclosure may also provide various other advantages and features, as discussed in greater detail below.

The following will provide, with reference toFIGS. 1-2, detailed descriptions of example systems for disseminating location-based reputations for link-layer wireless attacks. Detailed descriptions of corresponding computer-implemented methods will also be provided in connection withFIG. 3-5. Finally, detailed descriptions of an exemplary computing system and network architecture capable of implementing one or more of the embodiments described herein will be provided in connection withFIGS. 6 and 7, respectively.

FIG. 1is a block diagram of an example system100for disseminating location-based reputations for link-layer wireless attacks. As illustrated in this figure, example system100may include one or more modules102for performing one or more tasks. As will be explained in greater detail below, modules102may include a report-receiving module104, a reputation-generating module106, a request-receiving module108, a responding module110, an attack-detecting module112, and a security module114. Although illustrated as separate elements, one or more of modules102inFIG. 1may represent portions of a single module or application.

As illustrated inFIG. 1, example system100may also include one or more wireless-attack reports, location reputations, and client reputations. Wireless-attack reports120and122generally represent any type or form of information that is sent from a wireless client device to a reputation server and that indicates that the wireless client device either detected or did not detect a link-layer wireless attack at a particular location. In one example, wireless-attack report120and/or wireless-attack report122may include information that identifies a location that was scanned for link-layer wireless attacks (e.g., Global Positioning System (GPS) coordinates of the location), information that indicates the types of link-layer wireless attacks that were scanned for, and/or information that indicates whether any link-layer wireless attacks were detected.

Location reputation124generally represents any type or form of information that represents a location's reputation for link-layer wireless attacks and/or a likelihood that a link-layer wireless attack will occur at a location. The phrase “reputation for link-layer wireless attacks,” as used herein, generally refers to any type or kind of rating that indicates likelihood that a link-layer wireless attack will occur at an associated location and/or that indicates how safe it is to connect to wireless access points at an associated location. In some examples, the systems described herein may represent a reputation for link-layer wireless attacks using a number (e.g., a number of attacks), a phrase, or keyword, a heat map (i.e., a graphical representation of data where values are represented as colors or other markings), any kind of map or geographical representation used to describe the reputation of one or more locations, any kind of symbol or imagery used to indicate the reputation of a location, or any other representation used to depict, categorize, and/or indicate the link-layer wireless attacks at a location. Client reputation126generally represents any type of form of information that represents a wireless client's reputation for making false reports of link-layer wireless attacks and/or a likelihood that a wireless-attack report that is received from a wireless client is accurate.

Example system100inFIG. 1may be implemented in a variety of ways. For example, all or a portion of example system100may represent portions of example system200inFIG. 2. As shown inFIG. 2, system200may include a computing device202, a computing device203, and a server206in communication via a network204. In one example, all or a portion of the functionality of modules102may be performed by computing device202, computing device203, server206, and/or any other suitable computing system. As will be described in greater detail below, one or more of modules102fromFIG. 1may, when executed by at least one processor of computing device202, computing device203, and/or server206, enable computing device202, computing device203, and/or server206to disseminate location-based reputations for link-layer wireless attacks.

Computing device202and computing device203generally represent any type or form of computing device capable of reading computer-executable instructions. In some examples, computing device202may represent a wireless device that is capable of detecting link-layer wireless attacks, and computing device203may represent a wireless device that is less capable of detecting or unable to detect link-layer wireless attacks. Examples of computing device202and computing device203include, without limitation, laptops, tablets, desktops, servers, cellular phones, Personal Digital Assistants (PDAs), multimedia players, embedded systems, wearable devices (e.g., smart watches, smart glasses, etc.), gaming consoles, variations or combinations of one or more of the same, and/or any other suitable computing device.

As shown inFIG. 2, computing devices202and203may be or may have been at a location212. Location212generally represents a geographic location. The terms “location” and “geographic location,” as used herein, generally refer to any type or form of physical place, area, or region in which a computing device and/or network device may be temporarily or permanently located. Examples of geographic locations include, without limitation, GPS coordinates, boundaries defined by a set of GPS coordinates, street addresses, particular buildings, neighborhoods, cities, states, countries, territories, provinces, counties, area codes, and/or zip codes.

Server206generally represents any type or form of computing device that is capable of reading computer-executable instructions. In some examples, server206may represent a reputation server that maintains location-based reputations for link-layer wireless attacks and/or services reputation lookups. Additional examples of server206include, without limitation, security servers, application servers, web servers, storage servers, and/or database servers configured to run certain software applications and/or provide various security, web, storage, and/or database services. Although illustrated as a single entity inFIG. 2, server206may include and/or represent a plurality of servers that work and/or operate in conjunction with one another. As shown, server206may include a request218that was received from computing device203. Request218generally represents any type or form of request for a reputation of link-layer wireless attacks for a particular specified location. In this example, request218includes location information220(e.g., GPS coordinates) that specifies the location whose reputation is being requested.

Wireless access point210generally represents any type or form of physical or virtual wireless access point. The term “wireless access point,” as used herein, generally refers to any device and/or portion of executable code that enables a computing device to wirelessly connect to a wired network. In some examples, a wireless access point may receive a request from a computing device to access the wireless access point and/or a network to which the wireless access point provides access. The wireless access point may then facilitate the process of connecting the computing device to the network. In some embodiments, a wireless access point may reside within a router, switch, or other network device. In other embodiments, a wireless access point may represent a separate physical device. In at least one example, the term “wireless access point” may refer to any device (e.g., a Bluetooth-enabled device) that enables another device to connect to it wirelessly.

Malicious wireless device208generally represents a malicious network device (e.g., a WiFi Pineapple device) that may emulate or replicate a legitimate or benign wireless access point (e.g., wireless access point210). In some examples, in response to transmitting a request to connect to wireless access point210, computing devices at location212may receive a communication from malicious wireless device208in which malicious wireless device208alleges to be wireless access point210. Malicious wireless device208may “allege” to be a particular wireless access point by claiming to be, resembling, or otherwise displaying the characteristics of the particular wireless access point. In some examples, malicious wireless access point208may illegitimately or falsely allege to be another wireless access point by providing information (e.g., a SSID) that identifies the other wireless access point.

As illustrated inFIG. 3, at step302one or more of the systems described herein may receive, at a server from a first wireless client, a wireless-attack report for a location. For example, report-receiving module104may, as part of server206inFIG. 2, receive wireless-attack report120for location212from computing device202.

The systems described herein may receive wireless-attack reports in any suitable manner. In one example, report-receiving module104may receive, as part of a centralized reputation service, wireless-attack reports from one or more wireless clients that are capable of scanning for, detecting, and reporting link-layer wireless attacks. As used herein, the term “link-layer wireless attack” generally refers to any malicious attack that is completely or partially perpetrated using the data link layer of a wireless protocol (e.g., a WiFi or Bluetooth protocol). Examples of link-layer wireless attacks include, without limitation, WiFi access point spoofing attacks, Karma attacks, Pineapple attacks, evil twin attacks, SSID spoofing attacks, MITM (Man In The Middle) attacks, deauthentication attacks, wireless stack exploits (e.g., buffer overflows), and/or any wireless attack that occurs before or as part of establishing a connection between a wireless client and a wireless access point.

In some examples, attack-detecting module112may, as part of one or more wireless clients (e.g., computing device202), scan for, detect, and report link-layer wireless attacks, and request-receiving module108may receive any wireless-attack reports generated by attack-detecting module112.FIG. 4is a flow diagram of an example computer-implemented method400for reporting link-layer wireless attacks. The steps shown inFIG. 4may be performed by any suitable computer-executable code and/or computing system, including system100inFIG. 1, system200inFIG. 2, and/or variations or combinations of one or more of the same. In one example, each of the steps shown inFIG. 4may represent an algorithm whose structure includes and/or is represented by multiple sub-steps, examples of which will be provided in greater detail below.

At step402, one or more of the systems described herein may determine, at a wireless client, a location of the wireless client. For example, attack-detecting module112may, as part of computing device202inFIG. 2, determine location212.

Attack-detecting module112may identify the location of a wireless client in a variety of ways. In one example, attack-detecting module112may identify the geographic location of the wireless client by querying a GPS device within the wireless client. Additionally or alternatively, attack-detecting module112may analyze cellular-connection location information and/or utilize IP address geolocation based on the WAN internet protocol address of the wireless client. In some examples, attack-detecting module112may be unable to directly identify the location of the wireless client. For example, the wireless client may not be equipped with a GPS device or internet protocol geolocation system. In such embodiments, attack-detecting module112may identify the geographic location of the wireless client by identifying any or all networks within a range of the wireless client. In some examples, the systems described herein may used the identities of these networks to triangulate the location of the wireless client.

At step404, one or more of the systems described herein may attempt, at the wireless client, to detect one or more link-layer wireless attacks at the location of the wireless client. For example, attack-detecting module112may, as part of computing device202inFIG. 2, attempt to detect one or more link-layer wireless attacks at location212. The systems described herein may perform step404in any suitable manner. In one example, attack-detecting module112may scan link-layer communications for one or more types of link-layer wireless attacks. In some examples, attack-detecting module112may periodically or continually scan link-layer communications for one or more types of link-layer wireless attacks.

From step404, method400may proceed to decision block405. At decision block405, one or more of the systems described herein may determine whether any link-layer wireless attacks have been detected at the location. For example, attack-detecting module112may, as part of computing device202inFIG. 2, determine whether a link-layer wireless attack has been detected at location212. If the systems described herein determine that a link-layer wireless attack has been detected, method400may proceed to step406. Alternatively, if the systems described herein determine that a link-layer wireless attack has not been detected, processing of method400may proceed to step408.

At step406, one or more of the systems described herein may generate, at the wireless client, a wireless-attack report that may include information that identifies the location of the wireless client and information that describes the link-layer wireless attack. For example, attack-detecting module112may, as part of computing device202inFIG. 2, generate wireless-attack report120to include location information214that identifies the location of computing device202(e.g., location212) and attack information216that describes a link-layer wireless attack that was detected at location212.

The systems described herein may perform step406in any suitable manner. In some examples, attack-detecting module112may include within a wireless-attack report any information that may be helpful in generating a reputation for a location and/or any information that may be helpful to another wireless computing device to protect itself from link-layer wireless attacks at the location. Examples of information that may be included in a wireless-attack report include, without limitation, the GPS coordinates of a link-layer wireless attack, the time at which the link-layer wireless attack was detected, and/or a type of the link-layer wireless attack.

At step408, one or more of the systems described herein may generate, at the wireless client, a wireless-attack report that may include information that identifies the location of the wireless client and information that indicates that no link-layer wireless attacks are occurring at the location of the wireless client. For example, attack-detecting module112may, as part of computing device202inFIG. 2, generate wireless-attack report120to include location information214that identifies the location of computing device202(e.g., location212) and attack information216that describes one or more types of link-layer wireless attacks that were scanned for but not detected at location212.

The systems described herein may perform step408in any suitable manner. In some examples, attack-detecting module112may include within a wireless-attack report any information that may be helpful in generating a location's reputation for not having link-layer wireless attacks and/or any information that may be helpful to another wireless computing device to convey the safety of connecting to wireless access points at the location. Examples of information that may be included in a wireless-attack report include, without limitation, the GPS coordinates of a location at which link-layer wireless attacks were scanned for but not detected, the time at which a scan for link-layer wireless attacks was performed, and/or the types of link-layer wireless attacks for which attack-detecting module112scanned.

At step410, one or more of the systems described herein may transmit, from the wireless client, the wireless-attack report to a reputation server. For example, attack-detecting module112may, as part of computing device202inFIG. 2, transmit wireless-attack report120to server206. Upon completion of step410, exemplary method400inFIG. 4may terminate.

Returning toFIG. 3, in some situations an attacker may attempt to make false wireless-attack reports. For example, an attacker may attempt to report that no link-layer wireless attacks are occurring at a location while simultaneously perpetrating a link-layer wireless attack at the location. Alternatively, an attacker may attempt to report link-layer wireless attacks at a location when no link-layer wireless attacks have actually occurred or been detected at the location. To combat false reporting, the systems described herein may maintain a reputation for making false reports for each wireless client from which a wireless-attack report is received. In some examples, report-receiving module104may assign a bad reputation to a wireless client if wireless-attack reports received from the wireless client to not match or are not corroborated by other wireless clients (e.g., other wireless clients with better reputations). Alternatively, report-receiving module104may assign a good reputation to a wireless client if wireless-attack reports received from the wireless client match or are corroborated by other wireless clients.

At step304, one or more of the systems described herein may use, at the server, the wireless-attack report to generate a reputation for link-layer wireless attacks for the location. For example, reputation-generating module106may, as part of server206inFIG. 2, use wireless-attack report120to generate location reputation124for location212.

Reputation-generating module106may perform step304in any suitable manner. For example, reputation-generating module106may generate a reputation for link-layer wireless attacks for a location based on the number of link-layer wireless attacks that have been reported as having occurred at the location. For example, reputation-generating module106may assign a good, safe, or relatively safe reputation to a location if the number of link-layer wireless attacks that have been reported at the location is below a predetermined threshold (e.g.,0). Alternatively, reputation-generating module106may assign a bad, unsafe, or relatively unsafe reputation to a location if the number of link-layer wireless attacks that have been reported at the location is above a predetermined threshold.

In some examples, reputation-generating module106may generate a time-based reputation for link-layer wireless attacks for a location based on the number of link-layer wireless attacks that have been reported as having occurred at the location during a specific time period (e.g., a prior day, a prior week, a prior month, etc.). For example, reputation-generating module106may assign a good, safe, or relatively safe reputation to a location for the last 7 days if the number of link-layer wireless attacks that have been reported at the location during the last 7 days is below a predetermined threshold (e.g., 0). Similarly, reputation-generating module106may assign a bad, unsafe, or relatively unsafe reputation to a location for the last 24 hours if the number of link-layer wireless attacks that have been reported at the location during the last 24 hours is above a predetermined threshold.

In some examples, reputation-generating module106may generate one or more type-based reputations for a location based on the number of link-layer wireless attacks of one or more types that have been reported as having occurred at the location. For example, reputation-generating module106may generate a spoofing-attack reputation for a location based on the number of spoofing attacks that have been reported as having occurred at the location. Additionally or alternatively, reputation-generating module106may generate a deauthentication-attack reputation for a location based on the number of deauthentication attacks that have been reported as having occurred at the location.

As mentioned above, the systems described herein may maintain a reputation for making false reports for each wireless client from which a wireless-attack report is received. In these examples, reputation-generating module106may generate a reputation for link-layer wireless attacks for a location based only or mostly on wireless-attack reports that were received from wireless clients with good reputations for reporting attacks accurately (e.g., by assigning a greater weight to these wireless-attack reports). Additionally or alternatively, reputation-generating module106may generate a reputation for link-layer wireless attacks for a location in a way that ignores or mostly ignores wireless-attack reports that were received from wireless clients with bad reputations for making false reports (e.g., by assigning a lesser weight to these wireless-attack reports). In at least one example, if a wireless client has made more than a predetermined number of false reports, reputation-generating module106may disregard any wireless-attack reports that are received from the wireless client.

In some examples, reputation-generating module106may update a location's reputation as new wireless-attack reports for the location are received by updating the location's reputation to reflect the new wireless-attack reports. For example, if a location previously had a reputation for having link-layer wireless attacks but new wireless-attack reports indicate that no link-layer wireless attacks have occurred for a certain predetermined amount of time, reputation-generating module106may update the location's reputation to a reputation for not having link-layer wireless attacks. Additionally or alternatively, reputation-generating module106may update a location's reputation by phasing out wireless-attack reports for the location that are older than a predetermined age. For example, if a location previously had a reputation for having link-layer wireless attacks as a result of many wireless-attack reports indicating link-layer wireless attacks at the location but few if any new wireless-attack reports indicate link-layer wireless attacks at the location, reputation-generating module106may update the location's reputation to a reputation for not having or having a small number of link-layer wireless attacks.

At step306, one or more of the systems described herein may receive, at the server from a second wireless client, a request for the reputation of the location. For example, request-receiving module108may, as part of server206inFIG. 2, receive, from computing device203, request218for location reputation124of location212. At step308, one or more of the systems described herein may respond to the request with the reputation of the location. For example, responding module110may, as part of server206inFIG. 2, respond to request218with location reputation124. Upon completion of step308, exemplary method300inFIG. 3may terminate.

Wireless clients may react to reputations for link-layer wireless attacks in various ways.FIG. 5is a flow diagram of an example computer-implemented method500for receiving and reacting to reputations for link-layer wireless attacks. The steps shown inFIG. 5may be performed by any suitable computer-executable code and/or computing system, including system100inFIG. 1, system200inFIG. 2, and/or variations or combinations of one or more of the same. In one example, each of the steps shown inFIG. 5may represent an algorithm whose structure includes and/or is represented by multiple sub-steps, examples of which will be provided in greater detail below.

At step502, one or more of the systems described herein may determine, at a wireless client, the location of the wireless client. For example, security module114may, as part of computing device203inFIG. 2, determine location212. Step502is similar to step402inFIG. 4. Therefore, the previous discussions of step402may also apply to step502.

At step504, one or more of the systems described herein may query, at the wireless client before connecting to a wireless access point at the location of the wireless client, a reputation server for a reputation for link-layer wireless attacks for the location of the wireless client. For example, security module114may, as part of computing device203inFIG. 2, query server206for a reputation for link-layer wireless attacks for location212before connecting to wireless access point210.

At step506, one or more of the systems described herein may perform, at the wireless client, a security action in response to receiving the reputation for link-layer wireless attacks for the location of the wireless client. For example, security module114may, as part of computing device203inFIG. 2, perform a security action in response to receiving location reputation124.

The systems described herein may perform step506in any suitable manner. For example, if security module114is installed on a wireless client that receives a bad or unsafe reputation for a location that indicates that link-layer wireless attacks are likely at the location, security module114may (i) warn a user of the wireless client of a higher risk of connecting to wireless access points at the location, (ii) provide the user with information that describes the link-layer wireless attacks that are likely to be encountered at the location, (iii) prevent the wireless client from auto connecting to wireless access points at the location, and/or (iv) prevent the wireless client from connecting to any wireless access points at the location. Alternatively, if security module114is installed on a wireless client that receives a good or safe reputation for a location that indicates that link-layer wireless attacks are not likely at the location, security module114may allow the wireless client to connect to a wireless access point at the location.

In some examples, if security module114is installed on a wireless client that receives a bad or unsafe reputation for a location that indicates that a particular type of link-layer wireless attack is likely to occur at the location, security module114may perform an appropriate security action to protect the wireless client from the particular type of link-layer wireless attack. For example, if security module114is installed on a wireless client that receives a bad or unsafe reputation for a location that indicates that a deauthentication attack is likely to occur at the location, security module114may cause the wireless client to ignore some or all of the deauthentication frames that it receives. Upon completion of step506, exemplary method500inFIG. 5may terminate.

As explained above, by maintaining a location-based reputation for link-layer wireless attacks for a location based on whether one or more wireless clients have or have not detected link-layer wireless attacks at the location, the systems and methods described herein may disseminate the location-based reputations to additional wireless clients that find themselves at the location and that are unsure of the safety of connecting to wireless access points at the location. Furthermore, in some examples, by disseminating a location-based reputation to a wireless client that finds itself at a particular location and needing to connect to a wireless access point, these systems and methods may enable the wireless client to judge whether it is safe to do so.

In some examples, system memory616may store and/or load an operating system624for execution by processor614. In one example, operating system624may include and/or represent software that manages computer hardware and software resources and/or provides common services to computer programs and/or applications on computing system610. Examples of operating system624include, without limitation, LINUX, MICROSOFT WINDOWS, WINDOWS MOBILE, MAC OS, APPLE'S10S, UNIX, GOOGLE CHROME OS, GOOGLE'S ANDROID, SOLARIS, variations of one or more of the same, and/or any other suitable operating system.

As illustrated inFIG. 6, example computing system610may also include at least one input device628coupled to I/O controller620via an input interface630. Input device628generally represents any type or form of input device capable of providing input, either computer or human generated, to example computing system610. Examples of input device628include, without limitation, a keyboard, a pointing device, a speech recognition device, variations or combinations of one or more of the same, and/or any other input device.

Additionally or alternatively, example computing system610may include additional I/O devices. For example, example computing system610may include I/O device636. In this example, I/O device636may include and/or represent a user interface that facilitates human interaction with computing system610. Examples of I/O device636include, without limitation, a computer mouse, a keyboard, a monitor, a printer, a modem, a camera, a scanner, a microphone, a touchscreen device, variations or combinations of one or more of the same, and/or any other I/O device.

In some examples, system memory616may store and/or load a network communication program638for execution by processor614. In one example, network communication program638may include and/or represent software that enables computing system610to establish a network connection642with another computing system (not illustrated inFIG. 6) and/or communicate with the other computing system by way of communication interface622. In this example, network communication program638may direct the flow of outgoing traffic that is sent to the other computing system via network connection642. Additionally or alternatively, network communication program638may direct the processing of incoming traffic that is received from the other computing system via network connection642in connection with processor614.

Although not illustrated in this way inFIG. 6, network communication program638may alternatively be stored and/or loaded in communication interface622. For example, network communication program638may include and/or represent at least a portion of software and/or firmware that is executed by a processor and/or Application Specific Integrated Circuit (ASIC) incorporated in communication interface622.

As detailed above, computing system610and/or one or more components of network architecture700may perform and/or be a means for performing, either alone or in combination with other elements, one or more steps of an example method for disseminating location-based reputations for link-layer wireless attacks.

In addition, one or more of the modules described herein may transform data, physical devices, and/or representations of physical devices from one form to another. For example, one or more of the modules recited herein may receive one or more wireless-attack reports for a location, transform the one or more wireless-attack reports into a reputation for the location, output a result of the transformation to a wireless client, use the result of the transformation to determine whether it is safe to connect to wireless access points at the location, and store the result of the transformation to a reputation storage system. Additionally or alternatively, one or more of the modules recited herein may transform a processor, volatile memory, non-volatile memory, and/or any other portion of a physical computing device from one form to another by executing on the computing device, storing data on the computing device, and/or otherwise interacting with the computing device.