A framework to test and fuzz wi-fi devices

Abstract

Over the years, numerous weaknesses have been identified in the IEEE 802.11 standard and its implementations. In order to present a proof-of-concept or demonstrate their impact in practice, researchers are often required to implement entire procedures or complex features from scratch (e.g., injecting encrypted frames with customized header flags). In this paper, we present a framework that allows researchers to more easily test and fuzz any device (i.e., access points and clients). This framework enables one to, for example, test hypothesis on new weaknesses, implement proofof-concepts, create testing suites, and automate experiments. Our framework is implemented on top of the hostap user space daemon, and includes a language in which complex test cases can be defined (e.g., instructions to inject a sequence of user-modified frames into the network). Notably, a test case can make use of the hostap control interface, providing access to built-in features (e.g., authentication procedures, retrieval of encryption keys) and allows users to create customized hostap extensions. CCS CONCEPTS• Networks → Wireless access points, base stations and infrastructure; Mobile and wireless security.

On the Robustness of Wi-Fi Deauthentication Countermeasures

“…In Table 2, a dash indicates the respective technique does not apply to the evaluated system. Furthermore, for each of the deauthentication attacks, we write a test case (i.e., proof-of-concept) within the Wi-Fi Framework [30]. The attacks are straightforward to execute against any new system (e.g., Linux, Windows, Apple, Android).…”

“…Prior research evaluated the MFP standard and identified denial-of-service attacks against the SA Query procedure in earlier drafts of the standard [1,13] as well as its default timeout intervals in commercial systems [8], deadlock vulnerabilities [5,14], and the 4-way handshake [40]. Furthermore, researchers evaluated the resilience against deauthentication and association flooding attacks [8], and implementation vulnerabilities in the hostap daemon allowed an adversary to trick the access point in deauthenticating all clients by transmitting association frames from invalid source addresses [30]. In this paper, we performed the first study of the standard, investigating how stations are expected to handle deauthentication and disassociation frames in the context of MFP.…”

Testing and Improving the Correctness of Wi-Fi Frame Injection

“…When set, the network card actively acknowledges incoming unicast frames if they match the configured MAC address. However, at the time of writing, few network cards on Linux support this flag, and recent works instead used virtual interface to assure that incoming frames are acknowledged [15,18] (see also Section 3.2).…”

“…This is done using virtual interfaces: one virtual interface implements the client or AP behavior, while a second virtual interface can be used to monitor and inject frames. Recent works used this ability to quickly prototype proof-of-concepts [15,18].…”

A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-The-Middle Attacks Against Protected Wi-Fi Networks

“…Although a testing framework [45] exists for detecting fragmentation and aggregation vulnerabilities in Wi-Fi devices, no specific defense mechanisms are available for FragAttacks.…”