LOCATING A WIRELESS COMMUNICATION ATTACK

• US 20150371038A1
• Filed: 06/24/2014
• Published: 12/24/2015
• Est. Priority Date: 06/24/2014
• Status: Active Grant

• Current Assignee: Symbol Technologies, LLC (Zebra Technologies Corporation)
• Original Assignee: Symbol Technologies, Inc. (Zebra Technologies Corporation)
• Inventors: Batta, Puneet, Miranda, Trevor, Thomas, Jacob, Harris, Jason T.
• Granted Patent: US 10,055,581 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04N 7/183 for receiving images from a single remote source
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/79 Radio fingerprint

Abstract

A technique for locating a wireless communication attack includes monitoring of Bluetooth® communications activity by a Bluetooth® capable communication device. Any monitored communication activity is analyzed against parameters that are predefined to detect a communication attempt by a suspected criminal device to an illicit device. If the communication attempt by the suspected criminal device is detected by the analysis, a communication to the criminal device is controlled so as to delay completion of the communication to the criminal device in order to provide time to locate the criminal device.

Claims

1. An apparatus for locating a wireless communication attack, comprising:

at least one communications monitor operable to monitor communications activity;

a processor communicatively coupled with the communications monitor and operable to analyze any monitored communication activity against parameters that are predefined to detect a communication attempt by a suspected criminal device to an illicit device, wherein if the communication attempt by the suspected criminal device is detected by the processor, the processor is further operable to control a communication to the criminal device so as to delay completion of the communication to the criminal device; and

an interface communicatively coupled with the processor and operable to generate assistance for a system administrator to locate the criminal device.

2. The apparatus of claim 1, wherein the at least one communications monitor is operable to monitor Bluetooth®

communications activity.

3. The apparatus of claim 1, wherein the processor controls the communication by emulating the illicit device being addressed by the communication attempt of the criminal device in order to communicate with the criminal device, and subsequently periodically breaking a connection of the communication.

4. The apparatus of claim 1, wherein the processor controls the communication by interrupting the communication between the criminal device and the illicit device addressed in the communication attempt by forcing a collision of data in the communication to break a connection of the communication periodically.

5. The apparatus of claim 1, wherein the processor controls the communication by providing a set of false data of a greater size than would normally be expected on the illicit device.

6. The apparatus of claim 1, wherein there are multiple communications monitors operable to monitor the communications activity, and wherein the processor is operable to identify the communication attempt from the criminal device, and the multiple communications monitors are operable to supply signal strength measurements of the identified communication attempt, such that the processor can use a trilateration/triangulation technique using the supplied signal strengths to locate the criminal device.

7. The apparatus of claim 1, wherein the interface is coupled to a security camera placed to observe a vicinity near the illicit device, the security camera to record people within the vicinity of the illicit device.

8. The apparatus of claim 1, wherein one of the predefined parameters associates a criminal device as a device having a Media Access Control address that is within +/−

1 of a Media Access Control address of the illicit device.

9. The apparatus of claim 1, wherein one communications monitor is operable to monitor Bluetooth®

communications activity and another communications monitor is operable to monitor IEEE 802.11 communications activity, and wherein one of the predefined parameters associates a criminal device as a device having a Media Access Control address in a communication used in the IEEE 802.11 system that is within +/−

1 of a Media Access Control address within the communication attempt used in the Bluetooth®

system.

10. A method for locating a wireless communication attack, comprising:

monitoring of communications activity by at least one communications monitoring device;

analyzing any monitored communication activity against parameters that are predefined to detect a communication attempt by a suspected criminal device to an illicit device;

if the communication attempt by the suspected criminal device is detected by the analysis, controlling a communication to the criminal device so as to delay completion of the communication to the criminal device; and

generating assistance to locate the criminal device.

11. The method of claim 10, wherein the at least one communications monitor is operable to monitor Bluetooth®

communications activity.

12. The method of claim 10, wherein controlling the communication includes emulating the illicit device being addressed by the communication attempt of the criminal device in order to communicate with the criminal device, and subsequently periodically breaking a connection of the communication.

13. The method of claim 10, wherein controlling the communication includes interrupting the communication between the criminal device and the illicit device addressed in the communication attempt by forcing a collision of data in the communication to break a connection of the communication periodically.

14. The method of claim 10, wherein controlling the communication includes providing a set of false data of a greater size than would normally be expected on the illicit device.

15. The method of claim 10, wherein monitoring includes multiple communications monitors monitoring the communications activity, analyzing includes identifying the communication attempt from the criminal device, and generating includes the multiple communications monitors supplying signal strength measurements of the identified communication attempt to locate the criminal device using a trilateration/triangulation technique using the supplied signal strengths.

16. The method of claim 10, wherein generating includes an interface being coupled to a security camera observing a vicinity near the illicit device and recording people within the vicinity of the illicit device.

17. The method of claim 10, wherein analyzing includes one of the predefined parameters associating a criminal device as a device having a Media Access Control address that is within +/−

1 of a Media Access Control address of the illicit device.

18. The method of claim 10, wherein monitoring includes one communications monitor operable to monitor Bluetooth®

communications activity and another communications monitor operable to monitor IEEE 802.11 communications activity, and wherein analyzing includes one of the predefined parameters associating a criminal device as a device having a Media Access Control address in a communication used in the IEEE 802.11 system that is within +/−

1 of a Media Access Control address within the communication attempt used in the Bluetooth®

system.

19. The method of claim 10, wherein the communication is continuous to present an indefinite delay of the completion of the communication.