3

I learned from ethical hacking tutorial and tested following command about DOS on Wifi.

aireplay-ng -0 0 -a [Wifi-MAC here]

It works fine, but my question is how can we avoid such attacks?

7
  • 5
    There is nothing you can do because those wireless signals are public. To protect yourself, use wired solutions instead of wifi.
    – schroeder
    Jun 20, 2017 at 13:21
  • Nothing we can do about it. Even with those expensive routers?
    – user158
    Jun 20, 2017 at 13:33
  • 5
    A malfunctioning microwave can knock out a wifi access point. You rely on the signal between your device and the access point. If something interferes, then there is nothing you can do.
    – schroeder
    Jun 20, 2017 at 13:41
  • got it, loud and clear.
    – user158
    Jun 20, 2017 at 13:58
  • Modern routers are now have Wifi Intrusion Prevention System. It discards deauth frames from clients.
    – defalt
    Jun 20, 2017 at 16:07

1 Answer 1

2

As schroeder eludes to in the original comment, the only real protection for most of us is to use wired solutions. There are a few options that are expensive or system intensive, and therefore are beyond the means of many users.

Let's dissect why 'the wired solution' is the answer in most cases.

The physics of radio emissions means that the only way to protect from the data being received in whatever format (encrypted or plaintext) is to physically block transmission. Read these for some background on how that problem has been addressed in some areas:

Faraday Cage

TEMPEST specification

Now, consider what the de-authentication attack you describe is doing...

  1. The -0 means "send a de-authentication frame", and the following 0 means "send this type of frame continuously".
  2. The -a [MAC] means "send these frames so they appear to come from the Access Point identified as [MAC]"
  3. The lack of a -c [MAC] parameter means aireplay-ng will send the de-authentication frame to every station connected to the access point. If you had specified a single MAC, you would just be DOSing that station off of the wifi network.

That's fine and grand, and works as expected ... as you have seen. It basically sends a command to each connected station saying "disconnect now" and they obey, because the protocol is written that way.

This problem comes from, if I understand the details correctly, the inability of a station to validate the de-authentication frame. This is because the original standards did not require a mechanism for this. Any radio capable of broadcasting in the right frequency can send the data, and the original protocol did not require the stations to validate the source of the signal...it may not have even existed in the protocol, I am not certain.

As defalt mentions, some higher end SOHO and enterprise grade wifi solutions have Wireless-IPS capabilities. These are built upon systems that analyze traffic patterns and signatures, and make decisions about which signals to act upon.

More recent standards have improved on these issues; I am unaware of how widespread the adoption of the updated standards/protocols has gone, but from recent testing I can tell you a lot of my equipment is still vulnerable to this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.