doc.: IEEE /2913r0 Submission November 2007 Kapil Sood, Intel CorporationSlide 1 Protecting Associations Attacks – Some Considerations Date: Authors:

doc.: IEEE /2913r0 Submission November 2007 Kapil Sood, Intel CorporationSlide 2 Abstract Analysis and considerations for design proposed in w-sa-teardown-protection.ppt and w-sa-teardown-protection-text Security Design/Implementation Deployment And, some plausible alternatives

doc.: IEEE /2913r0 Submission November 2007 Kapil Sood, Intel CorporationSlide w D3.0 11w protects deauths/disassoc which Eliminates a sub-class of DoS attacks Removes mechanism for clients to recover from inadvertent disconnects Still leaves the window open for masqueraded Association DoS attacks –Problem is that the protection of deauth/disassoc does not allow clients to recover

doc.: IEEE /2913r0 Submission November 2007 Kapil Sood, Intel CorporationSlide 4 Proposal from Legitimate Case Non-AP STA sends (Re)association AP rejects association, but starts ping AP pings the STA Only failure drops the SA and disables encryption STA tries again Non-AP STAAP Response Timeout Ping Request SA Terminated Association Request Association Response Reject: Try Again Later EAPOL Pings Ignored Association Request Association Response

doc.: IEEE /2913r0 Submission November 2007 Kapil Sood, Intel CorporationSlide 5 Proposal from Attacker Case Attacker sends (Re)association AP pings the STA AP stops processing the Association AP and STA continue using old association and SA Non-AP STAAP Response Timeout Ping Request Ping Response Association Request Attacker Association Response Reject: Try Again Later

doc.: IEEE /2913r0 Submission November 2007 Kapil Sood, Intel CorporationSlide 6 Security Considerations Cascade “Ping” floods –Each message by the attacker causes at least 3 messages in the WLAN –Even legitimate Associations cause multiple messages in the WLAN Changes the effects of the Association attack –From Client lockout to a flooding attack A new, more lethal attack –Attacker just needs to modify his script to masquerade all valid STAs on WLAN and send create unstoppable “ping” floods –What does it do to (Enterprise) WLAN radio environment?

doc.: IEEE /2913r0 Submission November 2007 Kapil Sood, Intel CorporationSlide 7 Security Considerations “Power Drain” Attacks –On STAs in Power Save Mode –STAs in Power-Save mode now need to be awoken to respond to these “pings” Attacker not only creates floods, but also drains battery

doc.: IEEE /2913r0 Submission November 2007 Kapil Sood, Intel CorporationSlide 8 Design/Implementation Considerations How will “Comeback Later” value be set? –Too long => Legitimate users suffer –Too short => Serves no useful purpose, as ping will immediately follow Design Complexity –Association state machine changes leads to multitude of new client behaviors –STA may start a re-Scan –AP Selection: Drop AP in “prohibited” AP-list –Power Save algorithms Complexity increases implementation costs

doc.: IEEE /2913r0 Submission November 2007 Kapil Sood, Intel CorporationSlide 9 Deployment Considerations Enterprises need Stable Client environment –Introduction of 11w will immediately cause unknown and different client behaviors –Serious problem for large enterprises with Multiple vendor products Co-existing voice/video/data WLANs “Can I turn-off Association Mitigation feature?” –Not without turning off entire 11w!

doc.: IEEE /2913r0 Submission November 2007 Kapil Sood, Intel CorporationSlide 10 Deployment Considerations What is the operational impact –Enterprise Study or Simulations of the proposal is needed –How do extra high priority messages (“ping floods”) impact voice and data WLANs? What is User experience due to association delays Immediate Enterprise problem: –Control erratic client behavior – Client Manageability –This proposal causes immediate churn Where attacks happen – Home/Operator –Is 11w a home/operator feature? –Are some parts of 11w more pertinent to home?

doc.: IEEE /2913r0 Submission November 2007 Kapil Sood, Intel CorporationSlide 11 Suggestions Add Capability Bit to allow 11w deployment flexibility –Bit 0: TGw mandatory protects Unicast Action Frames and BIP –Bit 1: Protects unicast disassociate/deauthenticate/associate –Capability bit allows enterprises to roll-out 11w without drastic client association behavior Allow basic Client recovery procedures using “ping” –No enforcement of the “Ping Procedure”

doc.: IEEE /2913r0 Submission November 2007 Kapil Sood, Intel CorporationSlide 12 Other Alternatives An adequate solution for containing such attacks is a difficult proposition. Here are preliminary other ideas: AP to support multiple simultaneous EAP Authentications Change the 11i Association handshake procedure –Authenticate before Associate

doc.: IEEE /2913r0 Submission November 2007 Kapil Sood, Intel CorporationSlide 13 Summary The current proposal ( / ) has significant unmeasured impact –Security, Design, Deployment, User Complexity and Costs may deter implementation and deployments Mandatory proposed solution may out-weigh the perceived benefits of 11w –For broad adoption: 11w should be incremental, not radical