Protocols for Secure Communication in Wireless Sensor Networks

3.1. Attack Paths 71
closed environments, but code updating is a common feature and introduces
similar vulnerabilities.
Software for wireless sensor networks is often developed using low-level
programming languages like C. This facilitates the introduction of vulnerabilities
such as buffer overflows [109]. Fortunately, microcontrollers (which are the
basis for sensor nodes) are often based on the Harvard computer architecture,
which physically separates program and data memory. In such an architecture,
buffer overflows usually don’t lead to unwanted program execution, since
most programs don’t write into program memory directly. However, moving
to processors that are based on the von Neumann architecture, or using virtual
machines (such as Maté [114]), exposes sensor networks to the risks of such
vulnerabilities.
The attractiveness (to an attacker) of software-level attacks lies in the fact
that such attacks are “class-type” attacks, which means that once it is known
how an attack can be successfully mounted, this attack can be applied over and
over again with minimal additional cost since all systems of the same class are
vulnerable to it. This means on one hand that if a software vulnerability can
be exploited on one sensor node, all other nodes in the same network are most
likely also subject to this attack. On the other hand, this can mean that if such
an attack can be successfully applied in one sensor network, other networks
that are built from the same underlying platform and system software may also
be affected.
Custom software development can reduce the risk of software-level attacks,
since the exploitation of vulnerabilities in such systems is more costly to an
attacker than in standardized systems. Also, the absence of software lifecycle
management mechanisms allows it to build such restricted interfaces that
further reduce the risk of vulnerabilities. However, both approaches put harsh
restrictions on the flexibility and the cost-effectiveness of such systems. It can
therefore be safely assumed that a more open approach will be usually used in
sensor networks in the future.
A mechanism for code updates is multi-hop over the air programming [172],
where new software versions are distributed to all nodes in a network in a cooperative
manner. A risk in this approach is that code updates are injected by
an attacker who might thereby be able to exploit the inherent update mechanism
of the network for gaining control over all nodes in the network. It must
be noted that even if the update mechanism is protected cryptographically, it
may be possible for an attacker to learn the required keys through out-of-band
mechanisms such as “social engineering” (e.g. blackmail or bribery).
Virtual machines [114] execute programs that are encoded as ordinary data,