Channel switch and quiet attack: New DoS attacks exploiting the 802.11 standard

Abstract

Abstract-Network communication using unprotected air as a medium leads to unique challenges ensuring confidentiality, integrity and availability. While newer amendments of IEEE 802.11 provide acceptable confidentiality and integrity, availability is still questionable despite broad usage of Wi-Fi technologies for tasks where availability is critical. We will present new security weaknesses that we have identified in the 802.11 standard and especially the 802.11h amendment. Our results are underlined by an extensive analysis of attacks addressing the quiet information element and channel switch announcement in management frames. For some stations a complete DoS effect can be achieved with a single packet for more than one minute. This shows that the newly identified attacks are more efficient than earlier approaches like a deauthentication attack. Tests were performed with a large variety of network interface cards, mobile devices, and operating systems.

Enhancement of Passive MAC Spoofing Detection Techniques

“…To assist empirical analysis, eight experiment scenarios per attack were designed to study the effectiveness of the RSSDT and the RTTDT in the presence of an attacker, who launches three different new attacks against a legitimate station (STA); TKIP Cryptographic DoS attack [9,18], Channel Switch DoS attack [14], and Quite DoS attack [14].…”

“…In this scenario three different experiments were carried out; in the first one, the attacker launched a TKIP DoS Attack [9,18], in the second experiment he launched a Channel Switch DoS attack [14], while in the third experiment the attacker launched a Quite DoS attack [14]. For each experiment, traffic was captured using Wireshark 2 , after that the captured traffic was examined using the IDS Sensor which is based on the correlation engine, which resulted in two alarms.…”

Denial of Service Attacks Against the 4-Way Wi-Fi Handshake

“…Finally, Konings et al found several DoS vulnerabilities in the physical and MAC layer of 802.11 [19]. Some of these make the network unusable for one minute, while others only do so for a brief amount of time.…”

The modeling and comparison of wireless network denial of service attacks

“…Vulnerable protocols are used in 802.11 wireless local area networks (WLANs) [1,2,11,3], 802.16 broadband networks [4], and GSM and UMTS mobile networks [10]. Due to functionality, performance or cost requirements, certain signaling messages used by these protocols are not integrity protected.…”

“…The research effort on semantic DoS attack detection and prevention has been of a more informal nature. A multitude of semantic DoS attacks have been discovered in existing wireless protocols, practical attacks have been demonstrated, and ad hoc countermeasures have been proposed [1, 2,11,3]. The fact that new semantic vulnerabilities are routinely being discovered in proposed and operative protocols indicates that it is difficult to avoid protocol vulnerabilities.…”