Home page logo

bugtraq logo Bugtraq mailing list archives

802.11b DoS exploit
From: Mark Osborne <mark () loud-fat-bloke co uk>
Date: 11 Mar 2003 22:26:32 -0000

While working to develop code for WIDZ that is equivalent to a standard 
Intrusion Detection system’s RESET or SHUN functionality, an effective 
802.11b disruption of service attack has been discovered.  I haven’t 
spotted any other postings so here we go….

FATA-jack - a modified version of the Wlan-jack, Fata-jack sends an 
Authentication-Failed packets (with a reason code of previous 
authentication failed) to a Wireless client PC.  The source and 
destination macs have been spoofed so as to appear to come from the Access-
point.  The original Wlan-jack code rate of transmission has been 
significantly reduced to a meagre rate of 1 every 2.5 seconds, so as to 
avoid any flood effect.

In limited tests on multiple operating systems including Windows98, 
Windows ME and Linux, FATA-jack effectively tears down any active session 
and in many cases causing the client driver or client software to fail 
requiring a reboot.

Apart from being an extremely lethal DoS attack, FATA-jack is significant 
for a number of reasons:

-As the transmission rate is very low, it is easy to see how a low-spec PC 
and a standard 802.11 card could  disable a large wireless network.

-As the malevolent packet are sent directly to the client these will not 
picked-up by logging functionality on the AP (if you have any) – this 
highlights the need for Wireless IDS.

-As the malevolent packets are spoofed AND sent directly to client MAC 
protection or WEP protection will not prevent it.  

-Some workmates have suggested that it could be used to cause IVs/WEP keys 
to be cycled.  This would significantly reduce the time for a WEP cracking 
exercise. This is yet to be verified.

  By Date           By Thread  

Current thread:
  • 802.11b DoS exploit Mark Osborne (Mar 11)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]