Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
While dealing with wireless set I came across the term Hole 196. Got to know that preventions too. But can it still bypass Client isolation and standard preventive approach if packets are crafted at raw level or by exploiting gtk renewable procedure?
Are non RSN and TSN networks too vulnerable?
The hole 196 flaw consists basically in take advantage of what page 196 of the standard says... it says that messages sent with group keys, ie keys intended for broadcast communications, do not have protection against spoofing. Thus, an attacker can send a message with a GTK key with the IP that he wants.
The point of the attack is to send a message with a GTK key but directed to a target MAC instead of a broadcasting MAC address. By doing this, only the victim will process that broadcast packet and, therefore, unless the ARP table has static resolution for the MAC of the gateway, IP poisoning will occur which will allow the router to be supplanted.
Since that moment on, when the victim communicates with the Gateway, the PTK keys associated with that IP will be used, which the attacker will kindly deliver to make the MITM. Simple but functional.
It doesn't care if is a Robust Secure Network using WPA2 and AES. It can be performed anyway but with client isolation you can avoid the problem. Anyway, performance will be compromised.
