A Survey of Attack Mechanisms on Infrastructure-Mode 802.11 Wireless Networks and Their Detection

A Survey of Attack Mechanisms on Infrastructure-Mode 802.11 Wireless Networks and Their Detection

Juan Manuel Madrid (Universidad Icesi, Colombia)
Copyright: © 2015 |Pages: 14
DOI: 10.4018/978-1-4666-5888-2.ch413

Chapter Preview



This section presents an overview of the security mechanisms implemented in 802.11 wireless networks.

WEP (Wired Equivalent Privacy)

WEP was the first encryption scheme used in the 802.11 wireless networks (IEEE, 2012). Figure 1 shows how WEP encrypts each data packet.

Figure 1.

Overview of the WEP algorithm


WEP’s most salient flaws are: (Borisov et al., 2001):

  • The access point (AP) authenticates clients during initial handshake, but clients don’t authenticate the AP at all. This means clients may be tricked into connecting to a rogue AP.

  • WEP’s key scheduling algorithm is not well designed (Fluhrer et al., 2001). Some IVs, known as weak IVs, reveal details about the WEP key. If enough packets with weak IVs are captured, their information makes it possible to guess the WEP key. Stubblefield et al. (2004) conceived the first practical attack exploiting this vulnerability, and Klein (2006) perfected the attack, allowing to perform it with less data.

  • Since the ICV (integrity check value) is a linear function over the packet (CRC-32), an attacker can modify an encrypted packet, by using a bit mask that alters selected bits, and then patching the ICV using the bit mask’s CRC-32.

  • WEP does not protect against replay attacks.

WPA (Wi-Fi Protected Access)

WPA addressed the vulnerabilities of WEP (IEEE, 2012). Its main feature is TKIP (Temporary Key Integrity Protocol), a cipher suite designed to supplement WEP as follows:

  • Per-frame key computation depends upon three factors: Transmitter’s MAC address, a frame counter and a temporary key. In WEP, only the 24-bit IV was changed between frames. The counter protects against replay attacks.

  • Each frame contains a message integrity code (MIC), which protects against address spoofing and frame modification. Encryption keys are renegotiated whenever these attacks are detected.

  • WPA also implements mutual authentication between AP and client.

When operating in pre-shared key (PSK) mode, clients and AP share a passphrase. The devices then compute a 256-bit shared key using the PBKDF2 function (RFC2898, 2000). The ESSID is included in the shared key calculation, to protect against spoofing attacks.

Figure 2 shows the operation of the TKIP algorithm.

Figure 2.

Overview of the TKIP algorithm


WPA2 was introduced in 2004. WPA2 replaces TKIP and mandates the usage of CCMP (Counter Cipher Mode with Block Chaining Message Authentication Code Protocol). CCMP provides confidentiality (using AES encryption), authentication and integrity.

During the initial handshake, wireless client and AP negotiate a pairwise temporary key (PTK), used for unicast traffic, and a group temporary key (GTK), used to process broadcast / multicast traffic.

Key Terms in this Chapter

Wireless Local Area Network (WLAN): A local area network using radio waves instead of physical cabling. The most widely deployed WLANs comply with the IEEE 802.11 standard.

Initialization Vector (IV): A random value, which is an input to a cryptographic algorithm. By using the IV, two encryptions of the same information will never be the same, thus avoiding known ciphertext attacks.

Extended Service Set Identifier (ESSID): The alphanumeric identification string for a wireless AP.

Stream Cipher: A cipher that works by generating a pseudo-random bit stream, with the same length of the information to be ciphered. The pseudo-random bit stream and the information are combined, typically by means of the XOR operation, generating the ciphertext.

Denial of Service (DoS): A type of attack, which makes the network resources unavailable to its legitimate users.

Basic Service Set Identifier (BSSID): The 48-bit MAC (hardware) address of a wireless AP.

Network Flood: An attack which generates frames at a very high speed, with intent of causing congestion and/or network equipment failure.

Complete Chapter List

Search this Book: