Testing and Improving the Correctness of Wi-Fi Frame Injection

Abstract

Investigating the security of Wi-Fi devices often requires writing scripts that send unexpected or malformed frames, to subsequently monitor how the devices respond. Such tests generally use Linux and off-the-self Wi-Fi dongles. Typically, the dongle is put into monitor mode to get access to the raw content of received Wi-Fi frames and to inject, i.e., transmit, customized frames.In this paper, we demonstrate that monitor mode on Linux may, unbeknownst to the user, mistakenly inject Wi-Fi frames or even drop selected frames instead of sending them. We discuss cases where this causes security testing tools to misbehave, making users believe that a device under test is secure while in reality it is vulnerable to an attack. To remedy this problem, we create a script to test raw frame injection, and we extend the Radiotap standard to gain more control over frame injection. Our extension is now part of the Radiotap standard and has been implemented in Linux. We tested it using commercial Wi-Fi dongles and using openwifi, which is an open implementation of Wi-Fi on top of software-defined radios. With our improved setup, we reproduced tests for the KRACK and FragAttack vulnerabilities, and discovered previously unknown vulnerabilities in three smartphones. CCS CONCEPTS• Security and privacy → Mobile and wireless security; • Networks → Protocol testing and verification.

A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks

“…In addition, the attacker can transmit CSAs by forging a CSA information element inside beacon frames, probe response frames, or action frames. Some prominent examples of MC-MitM-IV attacks, including KRACK, DoS, and the latest FragAttacks, have appeared in the literature [7], [9], [12], [30]. In Section III of our previous paper [13], we thoroughly explained the technical setup, inner workings, and extensive evaluation of various MC-MitM attacks that manipulate victim's data frames, resulting in frame decryption and potential extraction of sensitive data.…”

“…Regarding the MC-MitM improved variants, the most significant attacks include FragAttacks and some extended versions of KRACK attacks. The FragAttack is the latest non-vendor-specific attack using the MC-MitM position (discovered by Vanhoef in May 2021 [9]). It exploits a set of authentication weaknesses in the fragmentation and aggregation features of IEEE 802.11 standards allowing the attackers to inject packets into encrypted Wi-Fi networks and obtain sensitive client data.…”