How exactly does the Michael shutdown exploitation (TKIP) work?
I know that cancels all traffic continuously, but how?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
According to MDK3's GitHub page, it uses a "TKIP QoS Exploit".
This is the note from the code:
can shut down APs using TKIP encryption and QoS Extension with 1 sniffed and 2 injected QoS Data Packets.
Looking up the specific exploit, you will run across this paper (one of many) that explains it:
TKIP was introduced in 2003, and amongst other enhancements, included a new per packet hashing algorithm, the Message Integrity Check (MIC). MIC is based on a weak algorithm, designed to be accommodated on legacy WEP hardware. TKIP uses MIC for guaranteeing the integrity of an encrypted frame. If more than two MIC failures are observed in a 60 second window, both the Access Point (AP) and client station shut down for 60 seconds.
When you have a question about how an open source tool does something, take a look at the code. Even if you are not a programmer, you will often find the details you need in the documentation, comments, or in this case, the CHANGELOG.