How exactly does the Michael shutdown exploitation (TKIP) work?

I know that cancels all traffic continuously, but how?


According to MDK3's GitHub page, it uses a "TKIP QoS Exploit".

This is the note from the code:

can shut down APs using TKIP encryption and QoS Extension with 1 sniffed and 2 injected QoS Data Packets.

Looking up the specific exploit, you will run across this paper (one of many) that explains it:

TKIP was introduced in 2003, and amongst other enhancements, included a new per packet hashing algorithm, the Message Integrity Check (MIC). MIC is based on a weak algorithm, designed to be accommodated on legacy WEP hardware. TKIP uses MIC for guaranteeing the integrity of an encrypted frame. If more than two MIC failures are observed in a 60 second window, both the Access Point (AP) and client station shut down for 60 seconds.

When you have a question about how an open source tool does something, take a look at the code. Even if you are not a programmer, you will often find the details you need in the documentation, comments, or in this case, the CHANGELOG.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.