On the Robustness of Wi-Fi Deauthentication Countermeasures

Abstract

With the introduction of WPA3 and Wi-Fi 6, an increased usage of Wi-Fi Management Frame Protection (MFP) is expected. defined in IEEE 802.11w, protects robust management frames by providing data confidentiality, integrity, origin authenticity, and replay protection. One of its key goals is to prevent deauthentication attacks in which an adversary forcibly disconnects a client from the network. In this paper, we inspect the standard and its implementations for their robustness and protection against deauthentication attacks. In our standard analysis, we inspect the rules for processing robust management frames on their completeness, consistency, and security, leading to the discovery of unspecified cases, contradictory rules, and revealed insecure rules that lead to new denial-of-service vulnerabilities. We then inspect implementations and identify vulnerabilities in clients and access points running on the latest versions of the Linux kernel, hostap, IWD, Apple (i.e., macOS, iOS, iPadOS), Windows, and Android. Altogether, these vulnerabilities allow an adversary to disconnect any client from personal and enterprise networks despite the usage of MFP. Our work highlights that management frame protection is insufficient to prevent deauthentication attacks, and therefore more care is needed to mitigate attacks of this kind. In order to address the identified shortcomings, we worked with industry partners to propose updates to the IEEE 802.11 standard. CCS CONCEPTS• Networks → Wireless access points, base stations and infrastructure; Mobile and wireless security; Denial-of-service attacks.

Preventing Attacks on Wireless Networks Using SDN Controlled OODA Loops and Cyber Kill Chains

“…However, to reduce the risk of false negatives, two false deauthentication frames or three total deauthentication frames received within 2 s are required to complete the state transitions and trigger an attack state. The 2-s-window was chosen as it is the deauthentication timeout value [ 35 ] set by hostapd , a commonly used control and authentication daemon on Linux based WAPs. This approach also compensates for any poor device identification results, an example of which can be seen in Table 4 with the Realtek and MacBook Air combination.…”

Pick Quality Over Quantity: Expert Feature Selection and Data Preprocessing for 802.11 Intrusion Detection Systems

“…• Given that AWID3 has much more samples, and it was created with the PMF always active, a logical assumption (which is further validated in section VI) is that this dataset will produce somewhat better classification results compared to those of AWID2. Recall that PMF protects against deauthentication and disassociation attacks, therefore, as detailed in § 5 of [21] and in [22], an attacker would need to persistently spray with unencrypted Deauthentication and Disassociation frames in an attempt to achieve DoS or choose other avenues, say, PMF protected deauthentication frames that exploit a zero-day vulnerability as given in § 6 of [19]. Based on the previous assumption, following a trial-and-error approach, we first examined the shallow classification of AWID2.…”

On the Security of the Wireless Electric Vehicle Charging Communication

“…In the context of WPT, this could cause the charging session to abort. With the introduction of IEEE 802.11w, these deauthentication messages must be authenticated, limiting the broadcast to the legitimate station [38]. By default, IEEE 802.11 networks that use WPA3 need to follow the IEEE 802.11w standard [38], [43].…”

“…With the introduction of IEEE 802.11w, these deauthentication messages must be authenticated, limiting the broadcast to the legitimate station [38]. By default, IEEE 802.11 networks that use WPA3 need to follow the IEEE 802.11w standard [38], [43]. However, as recent research by [38] has shown, even networks that use WPA3 can be vulnerable to deauthentication attacks.…”

“…By default, IEEE 802.11 networks that use WPA3 need to follow the IEEE 802.11w standard [38], [43]. However, as recent research by [38] has shown, even networks that use WPA3 can be vulnerable to deauthentication attacks.…”