Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Wireless security (Wikipedia) describes security issues due to the fact that wi-fi deauthentication packets are unencrypted:

Weak PSK passphrases can be broken using off-line dictionary attacks by capturing the messages in the four-way exchange when the client reconnects after being deauthenticated.

Why is it not possible to protect against wlan deauthentication flooding. I understand that unencrypted managment frames are part of the standard, but why the hack is this necessary??? Especially for something as critical as a deauthentication packet? I asume there are some crytographic reasons for this, but I have no concrete idea, which is why I am asking. It would be great if anyone would know an answer.

share|improve this question
add comment

migrated from stackoverflow.com May 31 '11 at 14:17

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 3 down vote accepted

Authentication and de-authentication is written into the protocol at a lower level than the encryption. It is the same regardless of whether you use WEP, WPA, or nothing at all.

The risk here is denial of service. A lot of de-auths can mean a lot of re-auths and that can chew things up. Properly implemented and using a good key, the encryption should not be at risk regardless of how many times the encryption is setup.

De-authing is a convenience for the attacker, but it is reasonable to assume that in a 24 hour period somebody will authenticate. If your attacker is interested in something beyond easy internet access, they'll get it.

This isn't the only case you'll find like this. SSL on TCP/IP has the same vulnerability -- the TCP flags, including the RST flag, are plaintext. How else do you tell somebody to end a connection if your system gets out of sync with their system?

share|improve this answer
    
thanks for this answer, it was very informative... –  ftiaronsem Jun 9 '11 at 21:07
add comment

Like many vulnerabilities in history this one might too be caused by some sort of uncreativity. The designers did not imagine an attack from this side.

Unfortunately the damage is done and you can't upgrade the handling of those packets without breaking compatibility with old clients. Older clients simply would not be able to issue a disconnect any more.

share|improve this answer
add comment

It is because the management frames are required in the preauth state. And these are the same management frames used when a network is opened (no auth needed). So basicaly you should think of the whole authentication thing level higher making encrypted connection with authentication.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.