152

Is it possible that someone made an attack (DoS or something else) to my Wi-Fi router (without knowing of the password) and make my router's signal unavailable?

1) How it can be done?

2) What are remedies?

Improve this question
7
  • 22
    Start doing arc welding right next door. I've lost two good RC planes due to this (modern RC equipment also run on 2.4GHz like Wifi but obviously with different protocols since RC only need around 3kbps of data transfer to function)
    – slebetman
    Nov 28, 2016 at 9:29
  • 4
    superuser.com/questions/637594/… or it could be a faulty microwave
    – Journeyman Geek
    Nov 28, 2016 at 14:20
  • 2
    There is an Android application (play.google.com/store/apps/details?id=com.wifikill.techbrain) that claims to maliciously disconnect other wifi deviced by sending a killer packet, as described in the accepted answer. I have tried it personally but did not manage to get accurate results
    – usr-local-ΕΨΗΕΛΩΝ
    Nov 28, 2016 at 16:50
  • 3
    fairly possible using kali linux kansara744.blogspot.in/2015/05/…
    – GorvGoyl
    Nov 30, 2016 at 8:54
  • 4
    I had a 2.4GHz phone that would always knock my devices off the network when it was in use.
    – rtaft
    Nov 30, 2016 at 17:18

7 Answers 7

Reset to default
284

There's a lot of ways you can attack a WiFi without knowing any passwords:

  • Physical layer attacks: Simply jam the frequency spectrum with your own signal. That signal might just be noise, but it might also be a WiFi of your own under heavy load, with the nodes in that WiFi being configured not to play nice with others. (depending on the WiFi chipset, that can be extremely easy) Spectrum can only be used once!
    Tool: noise source (e.g. Gunn Diode, SDR device), or normal AP
  • Electromagnetic sledgehammer: EMI gun. Take microwave oven oscillator, attach directive antenna, pray you don't cook someone's (your) brain, and point in the rough direction of the access point. Poof! Microwave ovens operate in the 2.4 GHz band, and thus, antennas of Access Points are picking up exactly that energy.
    Tool: Microwave oven, some sheet metal, lack of regard for other people's property and own health, or extended RF knowledge
  • MAC and Network layer attacks: Especially for networks using WEP (noone should be using this anymore, but sadly...) it's easy to forge what is called deauthentication packets – and thus, to throw out stations from your WiFi.
    Tool: Aircrack-NG's aireplay
  • Targetted jamming: As opposed to simply occupying the channel with noise or your own WiFi, you can also build a device that listens for typical WiFi packet's beginnings (preambles), and then, just shortly, interferes. Or just sends fake preambles periodically, or especially when it's silent. That way, you can corrupt selected packets, or fake channel occupancy.
    Tool: Commodity off-the shelf SDR
  • authentication attacks: at some point, even "proper" clients for your WiFi need to register with the WiFi. That mechanism can of course be forced to its knees by simply sending hundreds of authentication requests every second, from randomly generated MAC addresses, or even from MAC addresses of clients you know (by observation) exist. There's no solution to the problem for the AP – either it succumbs to the overload of auth packets, or it starts blocking out legitimate users.
    Tool: your network card, 10 lines of bash scripting
  • Man-in-the-Middling / access point spoofing: With anything short of WPA(2)-Enterprise, nothing proves that the access point calling itself "Toduas AP" is actually your Access Point. Simply operating a slightly higher-powered access point with the same ID string and, if necessary at all, a faked AP MAC address (trivial, since just a setting), will "pull" clients away from your access point. Of course, if the spoofing Access Point doesn't know the password, users might quickly notice (or they don't); however, noticing things don't work is nice, but doesn't help them.
    Tool: a random normal access point

You have to realize that it's a privilege, not a right, to have your WiFi use a channel. WiFi happens in the so-called ISM bands (Industrial, Scientific, Medical usage), where operators of transmitters don't have to have an explicit license. That means it's OK for everyone to use that spectrum, as long as they don't intentionally harm other devices and are not easily damaged by interference.

So, it's absolutely legal for someone to operate a high-definition digital camera stream that occupies the whole WiFi channel. That will effectively shut down your WiFi.

If you need something that no-one can mess with, wireless is, by definition, not the way to go.

Improve this answer
32
  • 43
    Another physical layer attack: Pull the plug or throw the breaker. Most WiFi routers don't have an UPS :-)
    – Bergi
    Nov 26, 2016 at 17:35
  • 8
    Cisco wireless LAN controllers have a "contain" function that also does the deauthentication packets, but it uses its array of skinny APs to bombard the "malicious rogue SSID" systematically. The legitimate use is to stop a malicious AP being used in a corporate environment. Ruckus and HP wireless controllers definitely have this too.
    – Criggie
    Nov 26, 2016 at 20:36
  • 12
    It doesn't even need to be intentional. A cheap microwave with barely-adequate shielding can jam wifi entirely by accident.
    – Mark
    Nov 27, 2016 at 3:48
  • 31
    @Bakuriu Obligatory: xkcd.com/654
    – chrylis -cautiouslyoptimistic-
    Nov 28, 2016 at 3:11
  • 6
    Another physical layer attack: smash the access point with a hammer until it's not an access point anymore (or just up and steal it from wherever it is).
    – Zach Lipton
    Nov 28, 2016 at 23:08
19

There are devices that you can buy that will 'jam' a Wi-Fi signal and make it unusable.

Also Wi-Fi has different 'channels' that they can be set to run on. If your Wi-Fi is running on a channel that is saturated due to lots of other Wi-Fi devices around you using the same channel then the performance of your connection will degrade the further you are from the device.

Improve this answer
6
  • 3
    Competing APs is the most likely answer.
    – schroeder ♦
    Nov 26, 2016 at 8:52
  • 6
    @schroeder AFAIK the frequencies are not even reserved for WiFi, so there could be equipment communicating over the same channel with protocols that do not resemble WiFi. There could even be analogue communication on the same frequency.
    – kasperd
    Nov 26, 2016 at 11:30
  • 2
    @kasperd you're right. This is just the ISM band. Anyone is allowed to use it, without a license. The example from my answer actually stems from the experience, that up until relatively recently, a lot of analog video cameras basically did PAL (I'm in Europe :) ) at 2.4something GHz, instead of the usual TV channels. And let me tell you, cheap video transmitters aren't especially nice to the spectrum.
    – Marcus Müller
    Nov 26, 2016 at 12:19
  • 1
    @kasperd - Yup. In my house the microwave oven does it every time. If he's got a nearby neighbor using the microwave (or perhaps even someone in his own house) this could be happening unwittingly.
    – T.E.D.
    Dec 1, 2016 at 1:23
  • @T.E.D. highly unlikely. A microwave shouldn't be traveling through 4-7 feet of walls and siding to completely block the wi-fi to the point that it is 100% unusable.
    – user64742
    Dec 3, 2016 at 21:54
9

I have used cloning of ESSID and BSSID to do this (set BSSID with ifconfig wlanX hw ether xx:xx:xx:xx:xx:xx. Even if you don't output more power to the clients than their own AP, it will cause problems. Eventually they will notice that there's an AP with the same name of course.

Aireplay-ng deauth is more useful. If you are not interested in using too much time on this, use mdk or wifite which automate it. Mdk has whitelist/blacklist functionality for client link layer addresses.

Edit: The deauth attack is clearly visible with tcpdump's '-y foo' - unfortunately I don't remember the flag off-hand. You may need to set RFMON first (with e.g. airmon-ng check kill ; airmon-ng start wlanX $channel).

On OpenBSD it is '-Y IEEE802_11', on Linux it is similar.

Improve this answer
8

Duration attack.

You set the duration field in frames to the maximal value and possibly use low data rate (duration is expressed as data units, not time), this forces the AP and other clients to honor your transmission time, do that often enough and the network will be badly impacted.

There is no simple defence against this kind of attack/misbehaviour.

The first generations of apple mobile products used to do that by mistake (aka a bug)

Improve this answer
3
  • That only works for clients already logged in.
    – Marcus Müller
    Dec 4, 2016 at 13:48
  • I am a bit rusty, but afaik stations must honor other station's NAV authenticated or not, see: sysnet.ucsd.edu/~bellardo/pubs/usenix-sec03-80211dos-html/… "it is worth noting that RTS, CTS and ACK frames are not authenticated in any current or upcoming 802.11 standard"
    – Rsf
    Dec 5, 2016 at 11:38
  • ah! yeah, that kinda makes sense for a well-behaved station.
    – Marcus Müller
    Dec 5, 2016 at 11:41
3

As Sane already mentioned, you can interrupt the certain frequency on which the router and the devices are listening. Every channel has its own frequency, but depending on the quality of the router and the WLAN standard there is something called crosstalking.

This makes it really hard to focus one specific device. Cheap jammers will work more like a machine gun in the hands of an ape instead of a precise sniper rifle used by Simo Häyhä. So be careful what you're doing due to legal consequences...

Improve this answer
3

There are really only 3 channels of interest on 2.4GHz band - 1, 6, 11. If you have highpower APs ( can be done with USB wifi cards at 1 watt ) and saturate them with traffic ( pingflood broadcast address, looped endless transfers of random data w e.g. netcat ) other APs in the vicinity will be disrupted, or perform very poorly. This is not illegal. The 5GHz band which is used in 802.11n etc. doesn't have the range or wall-punching power to prevent this.

Improve this answer
2
  • 2
    It's actually likely to be illegal in many places. Intent does matter. I am guessing that's the reason why another answer mentions a high-res camera feed, which could at least provide some plausible deniability.
    – Relaxed
    Feb 6, 2017 at 16:51
  • It is not illegal to run 3 wifi networks which are completely saturated. It is not possible to determine if these networks are legitimate or not. Attaching directional antennas to them and pointing these away from your property, or exceeding legal wattage, maybe, sure, respectively. I do not particularly condone such baboonery, but proving intent is impossible. It is more likely that someone may ask you to dampen your emissions somewhat, but you cannot be forced to comply with a request to stop legal use of radio spectrum.
    – user400344
    Feb 6, 2017 at 16:59
0

Yes. Using aireplay-ng someone could send deauth packets to all of the clients connected to an AP, these deauth packets trick devices into thinking they come from the router. This causes clients to be disconnected from the router, although devices tend to connect back automatically, if the attacker keeps on sending these packets they could “jam” your WiFi AKA keep on causing devices to disconnect.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .