12

According to my research, the most common WPA/WPA2 WiFi attack requires a chipset capable of packet injection.

However I am not sure what this is, and what purpose it serves once you have the capability to inject packets.

I thought that all WiFi chipsets could send/receive data, and assumed packet injection would come under the sending protocol(whatever that may be) - but I must be missing something as only certain cards can apparently inject packets.

16

Wireless networks work in predefined modes which have specific functionality but also come with strict functional restrictions. Wireless attacks require a higher control over the lower layers of communication in order to send and receive any kind of data.

When you are in the default mode (Station Infrastructure Mode), you have to follow strict rules imposed by that mode, you can't even directly talk to a different client in default mode. So, for more control, you need Monitor mode to listen to any communication in the air. But Monitor mode (if supported by your hardware, chipset, firmware, driver, driver hack and OS wrapper) doesn't standardly allow you to send data. This is where packet injection comes in.

Packet injection means sending data while in Monitor mode because it's a passive-only mode (Source: wireless.kernel.org).

Sending and receiving management and control frames is necessary for impersonating base stations and clients, and for listening to frames that are meant for specific adapters. The dreadful deauthentication frame, apart from the DoS it can cause, it's the first stage in a multi-stage attack. It can be used to capture the WPA 4-way handshake or to force a user into a malicious AP, or to recover a hidden SSID, and even generate ARP frames for a WEP replay attack.

So, packet injection and monitor mode are two features that provide the much neaded low level control for attacks. And they are missing from some wireless adapters in order to restrict certain layer 2 operations for security reasons, like sniffing and spoofing frames because of poor manufacturer support, lack of open drivers, and people hacking drivers.

  • 6
    I don't think monitor/injection capabilities are omitted for security reasons, rather it's just something they don't bother implementing to reduce costs - after all, 90% of users will only want a Wi-Fi adapter to surf the Internet and don't even know what those modes are, so why spend extra money on them where you can simply put that money into your pocket or lower the price ? – user42178 Dec 29 '14 at 12:56
  • I would agree with Andre. Vendors in general don't have much motivation to increase security, especially the security of someone elses network. As Andre says, it's far more likely they're merely trying to reduce costs. Less features is less code, which is less code to maintain, and (in general) cheaper. – Steve Sether Dec 29 '14 at 15:36
  • I have to admit I made an assumption about those security restrictions based on the restrictions Microsoft imposed on raw sockets for (disputed) security benefits. After doing some reading I realised those assumptions are mostly wrong. WNICs are tricky beasts and functionality depends on many factors ranging from manufacturer, hardware, chipset, firmware, drivers, hacks and also the OS. – Cristian Dobre Dec 30 '14 at 13:15
10

Hardware-wise all cards can send and receive radio packets on Wi-Fi frequencies.

The problem is that the cards have a firmware that controls all the low-level stuff, like frequency-hopping, etc... for example when your computer requests to scan all available networks it doesn't manually tune the card to each frequency, listen on it and repeats the process for each channel; instead it just tells the card to scan and the firmware takes care of the rest.

Some cards have a more permissive firmware (Atheros is probably the best one in this case) that allows to transmit (injection) and listen (monitor) without being associated (connected and authenticated) to a network beforehand, whereas others won't allow you to do such things until you connect to the network you're attacking, which is of course impossible because you don't yet have the key.

6

Answers here have stated what packet injection is and why are there cards which cannot do that, but haven't touched why is it required.

  • First, packet injection is not always explicitly required, but most adapters that can't do packet injection also can't be put in monitor mode either, which is required to receive frames that weren't intended for your adapter, which is essential for nearly any WiFi attack. Purchasing an adapter that is known to be capable of packet injection guarantees a monitor-mode-capable adapter.
  • WEP cracking tools require a large number of captured packets to have a chance of cracking the key. If the network is reasonably busy, this is not a problem. But if it is not, the attacker can inject bogus packets into the network to provoke traffic and collect the required number of packets in a shorter time.
  • Attempts at cracking a WPS PIN can be made via sending a connection request frame and examining the response; I believe this also requires packet injection capability.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.