As the domains of pervasive computing and sensor networking are expanding, a new era is about to emerge, enabling the design and proliferation of intelligent sensor-based applications. At the same time, sensor network security is a very important research area whose goal is to maintain a high degree of confidentiality, integrity and availability of both information and network resources. However, a common threat that is often overlooked in the design of secure sensor network applications is the existence of spyware programs. As most works try to defend against adversaries who plan to physically compromise sensor nodes and disrupt network functionality, the risk of spyware programs and their potential for damage and information leakage is bound to increase in the years to come.
This work demonstrates Spy-Sense, a spyware tool that allows the injection of stealthy exploits in the nodes of a sensor network. Spy-Sense is undetectable, hard to recognize and get rid of, and once activated, it runs discretely in the background without interfering or disrupting normal network operation. It provides the ability of executing a stealthy exploit sequence that can be used to achieve the intruder's goals while reliably evading detection. To the best of our knowledge, this is the first instance of a spyware program that is able to crack the confidentiality and functionality of a sensor network. By exposing the vulnerabilities of sensor networks to spyware attacks, we hope to instigate iscussion on these critical issues because sensor networks will never succeed without adequate provisions on security and privacy.
Thanassis Giannetsos received his BSc degree in computer and telecommunication engineering from the Technical University of Thessaly, Greece in 2006; and MSc degree in information networking from the Carnegie Mellon University, Pittsburgh, Pennsylvania, in 2008. Since 2008, he has been working with Algorithms and Security group in Athens Information Technology (AIT), Greece, as a research engineer. Since 2008, he has been also pursuing his PhD on sensor networks security at the University of Aalborg, Denmark, under the supervision of Prof. Dr. Neeli R. Prassad (CTiF) and Prof. Dr. Tassos Dimitriou. His research interests include wireless security and privacy, design of intrusion detection and routing protocols of sensor networks, embedded systems and distributed computing.