1. 802.11 Exploits Data Communications Benjamin W. Siegel VCU Information Systems

2. Overview Information Systems 802.11 Exploits 2/24

3. Beaconing I am online!! online!! I am online!! 802.11 Exploits 3/24

4. Probe Requests and Responses Are you my Access Point? 802.11 Exploits 4/24

5. Probe Requests and Responses Yes 802.11 Exploits 5/24

6. Wireless Authentication Here is my authentication 802.11 Exploits 6/24

7. Wireless Authentication That Checks out 802.11 Exploits 7/24

8. Wireless Authentication Can we connect 802.11 Exploits 8/24

9. Wireless Authentication Yes here is your ID 802.11 Exploits 9/24

10. Wireless Authentication ~DATA~ 802.11 Exploits 10/24

11. Probe and Authentication Summary Probe Request “ SSID” Probe Response “ SSID” Authentication Request Authentication Success Association Request Association Response Data 802.11 Exploits 11/24

12. Deauthentication Attack What is does? Denial of Service Attack “Jams” all 802.11 Traffic in range How it works unencryptedUtilizes unencrypted management frames against an access point to kick clients off- line Why first stageUsually the first stage of a man in the middle attack Will redirect traffic to the attackers machine 802.11 Exploits 12/24

13. Deauthentication Attack Association Request Data Association Response Deauthenticate Deauthenication Management Frame 802.11 Exploits 13/24

14. Deauthentication Management Frame 802.11 Exploits 14/24

15. Live example Yes Always! 802.11 Exploits 15/24

16. Application Layer Vulnerability ‘remembers’Operating system ‘remembers’ your home or last access point Convenience ‘remembered’Accepts any affirming probe requests with a ‘remembered’ BSSID Connects to the strongest signal Vulnerability 802.11 Exploits 16/24

17. Evil Access Point and Application Layer Vulnerability 802.11 Exploits 17/24 Evil Access Point ServicesWhat they do

18. Are you my access point? probe request I am online!! online!! Point? Are you my Access Point? Access Point? 802.11 Exploits 18/24 Evil Access Point

19. Yes, I am. response Yes Yes, I am your AP 802.11 Exploits 19/24 Evil Access Point

20. Application Layer Vulnerability Yes Here is my authentication 802.11 Exploits 20/24 Evil Access Point

21. Application Layer Vulnerability Yes Cool, I don’t care 802.11 Exploits 21/24 Evil Access Point

22. Application Layer Vulnerability Yes Can we connect? 802.11 Exploits 22/24 Evil Access Point

23. Probe Requests and Responses Yes Always! 802.11 Exploits 23/24 Evil Access Point

24. Application Layer Vulnerability Yes Always! ~Data~ 802.11 Exploits 24/24 Evil Access Point

25. Questions? VCU Information Systems