See Like a Bat: Using Echo-Analysis to Detect Man-in-the-Middle Attacks in LANs
summary
Vesper is a plug-and-play detector that sends MLS-modulated ICMP bursts between hosts, records round‑trip times and jitter, deconvolves an impulse response and reduces each probe to three features: energy / average RTT of the large packets / jitter-probability. It flags ARP poisoning, inline bridges and swapped switches (even identical models in many cases) after about a minute of 1 Hz probing and a ~15 s averaging window. Implemented in Python with a C++ probe core for nanosecond timing, code is on GitHub.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:20Why do we care about MAN
- 2:01Types of MAN attacks
- 3:35See like a bat
- 4:10Impulse response
- 5:36Application to a LAN
- 7:38ManintheMiddle Attacks
- 8:30Vesper
- 10:03Outliers
- 11:02Evaluation
- 13:01Multiple Intermediaries
- 13:20Long Haul
- 13:50How an adversary can mess with us
- 15:32Why not just one feature
- 15:53Results
- 16:37Vesper tool
- 18:21Vesper deployment
- 19:08Summary
related talks
32mActive Fault Finding in Networks
49mSpooky Action at a Distance: Generating Waves over the Wire for Novel C2
32mHey Attacker! I Can See You!
39mImproving OT Network and Host Baselines to Secure Critical Infrastructure
45mAutomatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing
29mNetwork Fault Finding System: Packet Loss Triangulation
22mDetecting Asymmetric Application-layer Denial-of-Service Attacks In-Flight with Finelame
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware