Re[2]: Denial of Service Vulnerability in IEEE 802.11 Wireless Devices

[Jason Ostrom]

I wasn't there, but I know the Deauth Flood attack [1] is a very effective
attack that most 802.11b networks are vulnerable to. In security
testing, it is trivial to use a Prism2 based card with the HostAP
drivers and flip your wireless NIC into an AP, spoof the BSSID of the AP
station, and flood the wireless clients with deauth frames -
legitimate traffic never passes as a result. Reyk Floeter's Void11 Penetration testing tools
implement this attack [2].

I saw this attack mentioned in at least one book, but I don't know why
it wasn't released as a vulnerability. It is similar to the released
vulnerability, but involves spoofed frames instead of the physical layer.

[1] Aruba Networks "Thwarting DoS Attacks"
http://www.arubanetworks.com/products/whitepapers/secure-wireless/index.php?pg=3 `
[2] WLSec Projects
http://www.wlsec.net/projects/


Casper Dik> In last year's Usenix security symposium an attack which
Casper Dik> looked very much like one in the first
Casper Dik> paragraph was performed
Casper Dik> agains tthe audience (immediate linkloss was the result of the
Casper Dik> presenter pressing a button on his laptop).

Casper Dik> This was with with plain COTS components, so what is different
Casper Dik> with this attack or is it the same attack rediscovered?
Casper Dik> I don't remember it getting any press.

Casper Dik> Casper

[Niels Bakker]

* jpo@pobox.com (Jason Ostrom) [Mon 17 May 2004, 18:28 CEST]:
> I wasn't there, but I know the Deauth Flood attack is a very effective
> attack that most 802.11b networks are vulnerable to.

Janus Wireless, while not released publicly yet, also supports this:

http://peertech.org/janus/
http://peertech.org/janus/attacks.html

(this was formerly hosted on cubicmetercrystal.com.)

Tools like this should be part of any conference visitor's Unilateral
Quality-of-Service Toolkit, along with the DHCP server pool replenisher
and ICMP Source Quench generator.


> I saw this attack mentioned in at least one book, but I don't know why
> it wasn't released as a vulnerability. It is similar to the released
> vulnerability, but involves spoofed frames instead of the physical layer.

How does this "release as a vulnerability" work? Or are you wondering
why nobody up till now put out a sexed-up press release stating the obvious?


-- Niels.

--
Today's subliminal thought is: