Wireless Attacks - CompTIA Security+ SY0-701 - 2.4

Main ideas, concepts, and lessons

• Wireless deauthentication attacks (DoS) can repeatedly disconnect clients

  • A victim device can be dropped from a wireless network with no warning, losing internet connectivity.
  • The victim may reconnect and then be disconnected again repeatedly, and the user may not be able to stop it.

• Key cause: 802.11 management frames lack security in older standards

  • Deauthentication relies on 802.11 management frames exchanged between:
    • the client device
    • the access point (AP)
  • These frames are used to:
    • connect/associate,
    • manage the connection,
    • and later disconnect (deauthenticate/disassociate).
  • In earlier 802.11 versions, these management frames were sent in the clear (not encrypted), allowing an attacker to manipulate them.

• What an attacker needs

  • The attacker must know the MAC (hardware) address of:
    • the victim device to remove from the network.

• Demonstrated workflow: deauthentication attack (step-by-step methodology)

  1. Identify nearby APs and client devices
     • Use a Linux utility mentioned as: airodump-ng
     • Choose the wireless interface in monitor mode (example given: wlan0mon)
     • Capture a list of:
       • nearby access points (BSS ID / ESS ID)
       • connected/communicating devices
     • Locate the target victim’s device by matching its MAC address (example described: an iPhone whose MAC ends with “2 Echo Fox Delta”).
  2. Send deauthentication frames to the target
     • Use a second utility mentioned as: aireplay-ng
     • Configure it to:
       • send deauthentication frames (-0 option)
       • target the victim by specifying:
         • the AP’s hardware/BSSID
         • the victim client’s MAC address
     • While the attack is running:
       • the victim’s network/SSID connectivity disappears for the victim
       • as long as deauth frames continue, the device can’t reconnect

• Mitigation: newer 802.11 standards encrypt more management frames

  • The IEEE 802.11 committee addressed the issue by updating the standard.
  • 802.11ac and newer: some management frames are encrypted by default, including:
    • disassociate
    • deauthenticate
    • channel switch announcements
  • However, even on 802.11ac+ networks, some management frames may still appear unencrypted, because certain frames must be in the clear before encryption is established, such as:
    • beacons
    • probes
    • authentication
    • association frames

• Alternative DoS approach: RF jamming

  • Jamming disrupts communication by affecting the radio spectrum, not just one device.
  • The attacker transmits interfering signals nearby to increase noise:
    • victims “hear” more noise than real data (lower SNR)
    • if the device can’t clearly receive the AP, it can’t send/receive traffic
  • This can be caused by:
    • intentional attackers nearby
    • sometimes benign interference (examples given):
      • microwave ovens (2.4 GHz)
      • fluorescent lights
  • How attackers jam (varied techniques)
    • Send a constant stream of data
    • Send random data
    • Send many legitimate frames
    • Jam at random/reactive times (so troubleshooting is harder): typically becomes obvious only when users try to communicate
  • Key requirement: the jammer must be local to the target access point.
  • Location-hunting (“fox hunt”) method
    • Attackers are searched for using direction finding with:
      • a directional antenna
      • and sometimes an attenuator to reduce signal strength
    • As the operator gets closer, the signal gets louder and direction becomes clearer.
    • By iteratively narrowing options, they can triangulate the jammer location.

Speakers / sources featured

• IEEE 802.11 committee (referenced as the source of standards updates)
• CompTIA Security+ SY0-701 (course context via video title)
• Tools referenced (command-line utilities):
  • airodump-ng
  • aireplay-ng