Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am helpless against some kiddy with backtrack who repeatedly uses aireplay-ng to deauthenticate legitimate users on my Wifi work network.

I captured and analyzed the network traffic on my Wifi work network, and I noticed a remarkable amount of 802.11 deauth packets. I realize it may not be possible to catch him, or even know where the attack came from. I just want to know: Is there any way to prevent such an attack?

share|improve this question
    
Like @gowenfawr stated, there is no practical technical means to stop such an attack. Your best bet would be to report to local law enforcement and let the law try to deter him. –  Terry Chia Sep 15 '12 at 2:47

4 Answers 4

up vote 9 down vote accepted

Realistically, you cannot stop a bad guy from sending deauthentication packets.

Instead, you should focus on ensuring you are resilient to a deauth attack. Make sure your network is configured in a way that the deauth attack doesn't enable an attacker to compromise your network.

To do that, you need to make sure you are using WPA2. If you are using a pre-shared key (a passphrase), make sure the passphrase is very long and strong. If it is not already, change it immediately! If you are not using WPA2, fix that immediately!

The primary reason why bad guys send deauth packets is that this helps them execute a dictionary attack against your passphrase. If a bad guy captures a copy of the initial handshake, they can try out various guesses at your passphrase and test whether they are correct. Sending a deauth packet forces the targeted device to disconnect and reconnect, allowing an eavesdropper to capture a copy of the initial handshake. Therefore, standard practice of many attackers who might try to attack your wireless network is to send deauth packets. If you are seeing many deauth packets, that is a sign that someone may be trying to attack your wireless network and guess your passphrase.

Once the attacker has sent a deauth packet and intercepted the initial handshake, there are tools and online services that automate the task of trying to recover the passphrase, by guessing many possibilities. (See, e.g., CloudCracker for a representative example.)

The defense against this kind of attack is to ensure your passphrase is so long and strong that it cannot possibly be guessed. If it's not already long and strong, you need to change it right away, because someone is probably trying to guess it as we speak.

(The other reason a bad guy might send deauth packets is as an annoyance. However, as most users probably won't even notice, it's not a very effective annoyance.)

To learn more, see these resources:

share|improve this answer
    
You indicated it's not a very effective annoyance, but this GitHub repo indicates it can effectively knock everyone off the Wifi network when scripted: github.com/DanMcInerney/wifijammer -- Call me crazy, but that sounds mighty annoying. Am I missing something? –  Dan Esparza Apr 18 at 13:37
    
@DanEsparza, you might be right. I had the impression clients would automatically re-connect, but I could be wrong: I haven't tested it. If you found documentation that says it kicks clients off the network and they staff off, I believe you. –  D.W. Apr 18 at 15:50
    
Actually -- I don't know it's that they stay off the network automatically, it's just that the attack can be scripted in such a way that clients are too busy 'constantly re-authenticating' to do anything useful. –  Dan Esparza Apr 18 at 18:21

The only way to prevent such an attack is to block the attacker's ability to send wireless transmissions that will reach your legitimate users. That's not a practical solution for several reasons (but extra points if you can convince your workers to sit in a Faraday Cage).

This blog page here quotes some of the relevant WiFi standard, most pointedly:

Deauthentication is not a request; it is a notification. Deauthentication shall not be refused by either party.

So, no, there's no real way to prevent such an attack.

share|improve this answer
1  
+1 for the (Faraday Cage), really like it ;) –  sarepta Sep 14 '12 at 22:25

Steps.

Counter attack to the attacker.

Required tools. - Aircrack - wireshark - and your wifi adapter.

1 - Shutdown your WIFI transmission. 2. - Analyze each traffic packets using wireshark.

3 - Lunch your attack against the attacker using aircrack.

Warning - Attacker knows how to used macchanger.

Regards Anonymous :)

share|improve this answer

If possible, get everyone to connect to a wired network for a week, and shut off your wifi. After a week, turn it back on and hopefully the attacker will have given up by then. I would also try to whitelist everyone on your network so only those IPs can connect. If you suspect they are going to continue attacking you regardless of the effort it will cause them, then I agree with Terry, contact the local law enforcement and let them handle it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.