Masters Thesis Presentation - Bogdan Bruma

Title: Investigating the Security Implications of using MeshCore for Disaster Relief Communications

Abstract: Decentralized mesh networks offer a range of practical advantages, including ease of deployment, low setup overhead, and, owing to their ad-hoc nature, straightforward network joining. These characteristics make such networks particularly attractive for disaster relief communications, where infrastructure may be damaged or unavailable. This makes understanding their security implications an important and timely concern. One protocol that has gained significant traction in this space is MeshCore, a LoRa-based mesh networking protocol. With over a thousand active users across the Netherlands and a network spanning the entire country, MeshCore's maturity and real-world adoption make it a compelling case study for analyzing the security of LoRa-based disaster relief communication protocols.

This thesis begins by establishing a high-level abstraction of a MeshCore-based disaster relief communication system. Building on this model, a systematic threat modeling process is conducted using a STRIDE-inspired methodology to identify potential attack vectors. The identified threats are then scored using the Common Weakness Scoring System (CWSS), and these scores are aggregated to provide a quantitative overview of MeshCore's overall security posture. To complete this view of MeshCore under the disaster relief use case and to validate the findings, a subset of the identified attacks is implemented and documented as practical experiments. Finally, drawing on the insights gained throughout this analysis, the thesis offers concrete recommendations and mitigations to inform future development of MeshCore and similar protocols.

Supervisors: Fadi Mohsen, Reza Zare Hassanpour, Jeroen Lammers