Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Wireless security (Wikipedia) describes security issues due to the fact that wi-fi deauthentication packets are unencrypted:

Weak PSK passphrases can be broken using off-line dictionary attacks by capturing the messages in the four-way exchange when the client reconnects after being deauthenticated.

Why is it not possible to protect against wlan deauthentication flooding. I understand that unencrypted managment frames are part of the standard, but why the hack is this necessary??? Especially for something as critical as a deauthentication packet? I asume there are some crytographic reasons for this, but I have no concrete idea, which is why I am asking. It would be great if anyone would know an answer.

share|improve this question

migrated from May 31 '11 at 14:17

This question came from our site for professional and enthusiast programmers.

This was later fixed with Protected Management Frames also known as 802.11w though with enough interference a client will think it's disconnected and try and reconnect so this is only a partial solution. Some security fixes are reactive to weaknesses in the original system, I suppose this was one. – Matthew1471 Apr 20 at 19:33
up vote 3 down vote accepted

Authentication and de-authentication is written into the protocol at a lower level than the encryption. It is the same regardless of whether you use WEP, WPA, or nothing at all.

The risk here is denial of service. A lot of de-auths can mean a lot of re-auths and that can chew things up. Properly implemented and using a good key, the encryption should not be at risk regardless of how many times the encryption is setup.

De-authing is a convenience for the attacker, but it is reasonable to assume that in a 24 hour period somebody will authenticate. If your attacker is interested in something beyond easy internet access, they'll get it.

This isn't the only case you'll find like this. SSL on TCP/IP has the same vulnerability -- the TCP flags, including the RST flag, are plaintext. How else do you tell somebody to end a connection if your system gets out of sync with their system?

share|improve this answer
thanks for this answer, it was very informative... – ftiaronsem Jun 9 '11 at 21:07

Like many vulnerabilities in history this one might too be caused by some sort of uncreativity. The designers did not imagine an attack from this side.

Unfortunately the damage is done and you can't upgrade the handling of those packets without breaking compatibility with old clients. Older clients simply would not be able to issue a disconnect any more.

share|improve this answer

It is because the management frames are required in the preauth state. And these are the same management frames used when a network is opened (no auth needed). So basicaly you should think of the whole authentication thing level higher making encrypted connection with authentication.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.