[Autogenerated] in this final demo, we'll look at attacks against availability.
Attacks against availability can be precise or blunt the
authentication and disassociation attacks.
Target 802.11 management frames and a very precise Their aim is to issue w
land subtype 10 and 12 management frames to specific targets to break the
connection between the client and the access point.
North.
And disassociation attacks are often called jamming attacks,
but they're not even commonly available tools such as Dan Mckinney's,
Wi-Fi jama are actually just North tools.
Wi-Fi jamming differs from Dior and disassociation attacks in that
it's a means to generate lots of noise on all.
Wi-Fi channels making the frequencies unusable in a given distance
from the jammer jammers are normally quite expensive.
They are usually _______ and therefore quite hard to find
unless of course you build your own in wireless networks we
have the possibility of hidden nodes.
So the triple E 802.11 standard defines the request to send our
T S and clear to send or CTS control frames to minimize
collisions when sending longer frames.
But this mechanism can be abused to cause denial of service conditions.
Let's take a look at how in this example,
we have three stations at remote locations.
Station one and station three are out of radio range with each other,
which means that station one doesn't know when STATION three is
transmitting and vice versa if STATION one wants to send a longer frame
to the access point and avoid a possible collision.
It issues a request to send to the access point to reserve a
specified amount of time on that channel.
The access point responds with a clear to send which reserves the
channel for station one for the duration requested.
The clear to send is also sent to the other stations so that they know that
only station one is allowed to transmit during that time.
It's now becoming clear how this can be abused.
An attacker located within range of the station can craft CTS
packets with the long reservation time and transmit them to
each of the stations on the network.
CTS frames are very small and simple.
The first bite specifies the frame control type and subtype.
The 802.11 protocol is little endian.
So four specifies the frame control type as control and c is
12 which specifies the subtype as cts.
The flags in this example are set to zero but they can
be tweaked to fine tune the attack.
The next field specifies the C.
T.
S.
Reservation period.
In microseconds the field is again little-endian so 70 00
hex converts to 32,000 microseconds.
Next we have the address of the target station followed by a
frame control sequence error check which is usually calculated
by hardware before transmission.
32,000 microseconds may not sound very long but it gives
enough time for the attacker to repeatedly transmit packets to
multiple different target stations.
Let's now take a look at how we can use the aircraft suite to launch a
denial of service attack against our Windows 10 victim device to illustrate
the effectiveness of the technique will start with our Windows 10 client and
connect to the wifi lab access point.
Next we'll ping the access point using the dash T option to
specify that ping should continue until we stop it.
This will allow us to monitor the connection between the client and
the access point switching to our Cali machine.
We can launch a road um specifying the B S.
S I D and channel of our access point to focus the information we
capture followed by the W land zero monitoring interface.
Almost immediately we identify the Windows 10 client device connected
to the access point armed with the victim devices,
MAC address we can launch a ddos attack using air replay.
We can specify a default attack with dash dash Dior or with dash zero
followed by the number of packets we want to send here.
We specify zero, which means send packets continuously.
We then used to specify the mac address of the access point followed by dash C.
To specify the MAC address of the target device.
Finally, we specify the W land zero monitoring interface.
As soon as we launch the attack, we see a replay.
Start to transmit packets to the target device.
Let's now switch back to the Windows 10 device to see what's going on there.
And sure enough the Windows 10 devices no longer able to ping the access
point and either times out or receives destination host,
unreachable messages.
If we take a look at the available networks,
we see that we're no longer connected to the Wifi Lab access point,
and if we try to connect, we joined briefly,
but were immediately kicked off.