Annual Computer Security Applications Conference (ACSAC), Date: 2014/12/08 - 2014/12/12, Location: New Orleans, Louisiana, USA
Proceedings of the 30th Annual Computer Security Applications Conference (ACSAC 2014)
Author:
Keywords:
wpa, tkip, wifi, security, 802.11, broadcast, jammer, selective, reactive, continuous, constant, comodity
Abstract:
We show that low-layer attacks against WiFi can be implemented using user-modifiable firmware. Hence cheap off-the-shelf WiFi dongles can be used carry out advanced attacks. We demonstrate this by implementing five low-layer attacks using open source Atheros firmware. The first attack consists of unfair channel usage, giving the user a higher throughput while reducing that of others. The second attack defeats countermeasures designed to prevent unfair channel usage. The third attack performs continuous jamming, making the channel unusable for other devices. For the fourth attack we implemented a selective jammer, allowing one to jam specific frames already in the air. The fifth is a novel channel-based Man-in-the-Middle (MitM) attack, enabling reliable manipulation of encrypted traffic. These low-layer attacks facilitate novel attacks against higher-layer protocols. To demonstrate this we show how our MitM attack facilitates attacks against the Temporal Key Integrity Protocol (TKIP) when used as a group cipher. Since a substantial number of networks still use TKIP as their group cipher, this shows that weaknesses in TKIP have a higher impact than previously thought.