ARREGLOS INSTITUCIONALES

Using the simulation procedure just outlined, the behaviors of synthetic epidemics in the seven urban areas were studied. The urban areas considered were quite diverse, in that they range from a relatively small college town (West Lafayette, Indiana) to big metropolises (New York City and Chicago). In each urban area, the study focused on the giant component of the network obtained with a given Rint.

The study reported results for a typical epidemic spreading scenario in which the time scales of the processes were chosen according to their average estimates. The best- and worst-case scenarios were also obtained by considering the combination of parameters that maximized and minimized the rate of success of each attack process, respectively. The giant components that were built and used were obtained from the network in the intermediate interaction range of Rint = 45 m.

The four snapshots of Figure 5.8 and Figure 5.9 provide an illustration of the evolution of a synthetic epidemic in the Chicago area. Shown in black are the routers that were progressively infected by malware. The striking observation is that the malware rapidly propagated on the WiFi network in the first few hours, taking control of about 37% of the routers after two weeks from the infection of the first five routers.

Figure 5.8. The spread of a wireless worm through Chicago after 1 and 6 hours. In this series, the result is based on randomly perturbing the location of each router to remove wardriving data

The quantitative evidence of the potential impact of the epidemic is reported in Figure 5.10, where the average profile of the density of infected routers is reported for all the urban areas considered in the numerical

experiment. While it is possible to notice a considerable difference among the various urban areas, in each urban area a sharp rise of the epidemic was observed within the first couple of days and then a slower increase. After two weeks, the epidemic left 10% to 55% of the routers in the giant component controlled by malware, depending on the urban area and its encryption rates. The similar time scale in the rise of the epidemic in different urban areas is not surprising, as it was mainly determined by the time scale of the specific attacks considered in the malware propagation model.

Figure 5.10. Attack rate versus time for the giant component. (a) The average attack rate versus time for the seven urban areas, keeping Rint = 45 m in all cases. The attack rates are averaged over

100 simulations. (b) The average and 90% confidence interval for three prototypical cases: New York, Chicago, and San Francisco Bay Area. Note that (b) uses the same city markers as (a).

In general, the sharp rise of the epidemic in its early stages was due to the non-encrypted routers, which were infected in a very short time. The slower progression at later stages was, instead, due to the progressive infection of WEP routers, whose attack time scale is about one order of magnitude longer.

opposed to results averaged over several simulations, which are presented in Figure 5.10 and Figure 5.12. It clearly shows the effect of the interplay of different time scales involved in the spreading phenomenon. Specifically, we see sharp increases in infection rates in time periods after 48 hours, where WEP encryption schemes are broken on routers, making them vulnerable to attack. In addition, Figure 5.12 reports the average attack rate obtained in the best- and worst-case scenarios, together with the average scenario accompanied by its fluctuations. The best and worst cases are both within the 90% confidence interval of the average case, showing that a change in the parameter values of the infection processes considered did not affect the results obtained with the average estimated parameter values.

Figure 5.11. Three individual (nonaveraged) results for simulations of the epidemic in the Chicago area (giant component, Rint = 45 m). Each line represents the plot of the attack rate versus time that

results from a single simulation of the epidemic. Because the results are for single simulations, as opposed to an average of multiple simulations (as in Figure 5.10), the variations from breaking WEP

and passwords on different routers are visible.

Figure 5.12. Best- and worst-case epidemic spread compared with the average case and 90% confidence interval.

A more complicated issue is understanding the different infection rates that the epidemic attained in different urban area networks—that is, of the routers in a given giant component on which an epidemic spread, which fraction of them at a given time became infected. This percentage of infected routers in a component at a given time is termed the attack rate. The pervasiveness of the epidemic can be seen as a percolation effect on the WiFi network [153]. The WPA-encrypted routers and those with unbreakable passwords represent obstacles to the percolation process and define an effective percolation probability that has to be compared with the intrinsic percolation threshold of the network. Indeed, percolation refers to the emergence of a connected subgraph of infected routers spanning the whole network. This phenomenon is possible only if the probability that an infected router can find susceptible routers to be infected is larger than a threshold value (the percolation threshold). The larger the probability of finding susceptible routers with respect to the threshold, the larger the final density of infected routers will be.

The percolation thresholds of the networks were not easily estimated because they are embedded in the particular geometries of the cities' geographies. In addition, the cities have different fractions of encrypted routers. While these fractions are not extremely dissimilar, it is clear that given the nonlinear effect close to the percolation threshold, small differences could lead to a large difference in the final attack rate. For instance, San Francisco, with the largest fraction of encrypted routers, corresponding to about 40% of the population,

exhibited the smallest attack rate among all the urban areas considered.

Other network features, such as the geometric constraints imposed by the urban area geography, might also have a large impact on the percolation threshold, which can be rather sensitive to the local graph topology. For instance, network layouts with one-dimensional bottlenecks or locally very sparse connectivity may consistently lower the attack rate by sealing part of the network, thereby protecting it from the epidemic. Indeed, a few WPA routers at key bottlenecks could make entire subnetworks of the giant component impenetrable to the malware. This point is discussed further in Section 5.2.7.

The present results offer general quantitative conclusions on the impact and threat offered by the WiFi malware spreading in different areas given current router deployment habits.