2.4 Wireless Network Attacks: Deauthentication and RF Jamming

Question 1

What is the primary characteristic of a wireless deauthentication attack from a user’s perspective?

Answer 1

Sudden and repeated disconnections from the wireless network without warning messages

Users lose internet access and may struggle to maintain a connection, experiencing drops repeatedly.

Question 2

What specific vulnerability in earlier 802.11 specifications allowed deauthentication attacks to be so effective?

Answer 2

Lack of security for management frames

Management frames were sent across the network ‘in the clear’, meaning they were unencrypted.

Question 3

Why are management frames sent in the clear in older 802.11 standards a significant security risk?

Answer 3

Anyone close to the access point can view the information and manipulate unencrypted frames

Attackers can send malicious commands, such as deauthentication requests, to connected devices.

Question 4

Briefly describe the practical steps an attacker would take to perform a deauthentication attack.

Answer 4

Use airodump-ng to discover BSSID and victim’s MAC address, then use aireplay-ng with a -0 flag to send deauthentication frames

This specifies both the access point and the victim’s MAC address.

Question 5

How did the IEEE 802.11 committee address the deauthentication vulnerability in newer standards?

Answer 5

Incorporated updates in 802.11ac and newer versions that encrypted several management frames

Frames such as disassociate, authenticate, and channel switch announcements are now protected.

Question 6

Are all management frames encrypted in 802.11ac and newer standards? Explain why or why not.

Answer 6

No, not all management frames are encrypted

Important frames like beacons and probes must remain unencrypted for initial connection processes.

Question 7

How does an RF jamming attack differ from a deauthentication attack in terms of its target and impact?

Answer 7

RF jamming affects everyone trying to communicate over specific frequencies, while deauthentication targets a single device

Deauthentication manipulates management frames; RF jamming disrupts communication broadly.

Question 8

What is the main goal of an RF jamming attack, and how does it achieve this?

Answer 8

To decrease the signal-to-noise ratio, making it difficult for devices to distinguish real data

This prevents devices from sending or receiving traffic.

Question 9

Provide two common, non-malicious examples of devices that can cause RF jamming.

Answer 9

• Microwave ovens
• Fluorescent lights

These can emit signals that disrupt wireless frequencies.

Question 10

What technique can be used to locate the source of an RF jamming signal?

Answer 10

Fox hunting

This involves using a directional antenna and an attenuator to pinpoint the jammer’s location.

Question 11

What is the definition of a Deauthentication Attack?

Answer 11

A type of Denial-of-Service attack that disconnects a legitimate user from a wireless network by sending spoofed deauthentication frames

It makes it appear as if the access point requested the disconnection.

Question 12

What is the purpose of an Attenuator in RF hunting?

Answer 12

To reduce the power or amplitude of a signal without significantly distorting its waveform

This helps locate strong signals by managing signal strength.

Question 13

What is the function of Airodump-ng?

Answer 13

To capture raw 802.11 frames for monitoring wireless traffic and identifying connected devices

It is also useful for cracking WEP/WPA keys.

Question 14

What does BSSID stand for and what does it represent?

Answer 14

Basic Service Set Identifier; it is the MAC address of the wireless access point’s radio interface

It uniquely identifies an access point.

Question 15

What does the acronym ESSID stand for?

Answer 15

Extended Service Set Identifier

It is the user-friendly name of a wireless network, commonly referred to as the Wi-Fi network name.

Question 16

Define Radio Frequency (RF) Jamming.

Answer 16

A type of Denial-of-Service attack that prevents communication over wireless frequencies by transmitting interfering signals

It aims to decrease the signal-to-noise ratio.

Question 17

What is the significance of Management Frames in 802.11 wireless networks?

Answer 17

They are used for maintaining communication between a client and an access point

Examples include authentication, association, and deauthentication frames.

Question 18

What is the role of a Directional Antenna in RF hunting?

Answer 18

To radiate or receive electromagnetic waves more effectively in some directions than others

It helps pinpoint the direction of a signal.

Question 19

What is the definition of Denial of Service (DoS)?

Answer 19

An attack intended to make a machine or network resource unavailable to its intended users

Typically by temporarily or indefinitely disrupting services of a host connected to the Internet.

Question 20

What is Signal-to-Noise Ratio (SNR)?

Answer 20

A measure that compares the level of a desired signal to the level of background noise

A high SNR indicates a clear signal, while a low SNR indicates more noise relative to the signal.

Question 21

What does WLAN0mon represent?

Answer 21

A common naming convention for a wireless network interface set into monitor mode

This allows it to capture all wireless traffic in its vicinity.

Question 22

What is the main function of Aireplay-ng?

Answer 22

To inject or replay frames into a wireless network

It is commonly used for deauthentication attacks and other wireless security testing.