Wireless Attacks - CompTIA Security+ SY0-701 - 2.4

Wireless Network Vulnerabilities and Deauthentication Attacks

Understanding Wireless Disconnections

• Users may experience sudden disconnections from a wireless network without warning, leading to loss of internet access.

• This issue can recur frequently, affecting anyone on the same wireless network due to vulnerabilities like deauthentication attacks.

The Mechanics of Deauthentication Attacks

• The primary vulnerability lies in management frames exchanged between devices and access points, which are typically invisible to users.

• Earlier versions of the 802.11 specification lacked security for these management frames, allowing attackers to manipulate them easily.

Packet Capture Insights

• A packet capture reveals that management frames are transmitted unencrypted, making them visible to nearby attackers.

• An example shows an 802.11 radio information frame containing critical details such as receiver and transmitter addresses.

Executing an Authentication Attack

• To perform an attack, the attacker needs the MAC address of the target device; in this case, an iPhone with a specific MAC address is targeted.

• Using tools like airodump-ng, attackers can identify all devices connected to a specific access point before launching their attack.

Sending De-authentication Frames

• After identifying target devices and access points, attackers use aireplay-ng to send de-authentication frames.

• Continuous sending of these frames prevents the targeted device from reconnecting until the attack ceases.

Security Improvements in Newer Standards

• The IEEE 802.11 committee addressed these vulnerabilities by updating specifications in newer standards (e.g., 802.11ac), encrypting many management frames.

• Despite improvements, some essential management frames remain unencrypted during initial connections or associations.

Other Denial of Service Methods: RF Jamming

• Besides exploiting protocol vulnerabilities, RF jamming is another method used for denial-of-service attacks affecting all nearby devices.

Wireless Network Jamming: Understanding the Threat

Types of Wireless Jamming Attacks

• If there are no issues with devices like ovens or lights, interference on a wireless network may be due to an attacker sending additional signals.

• Attackers can create noise by transmitting constant information, random data, or a high volume of legitimate frames, complicating communication with the access point.

• Reactive jamming occurs when an attacker increases their signal strength only when someone attempts to communicate, effectively blocking all communication during that time.

• Similar to de-authentication attacks, jammers must be physically close to the access point; thus, locating them involves tracking down the source of the jam signal.

Locating and Mitigating Jamming Signals