Wifi Management Frameleri

Giriş
Management Frame'ler şöyle.
1.Authentication frame
2.Association request frame
3.Association response frame
4.Beacon frame
5.Deauthentication frame
6.Disassociation frame
7.Probe request frame
8.Probe response frame
9.Reassociation request frame
10.Reassociation response frame

Şifreleme
Açıklaması şöyle.

In early IEEE 802.11 specifications (prior to 2009), management frames (which are responsible to authenticate, maintain, and discontinue communication) are not protected from underlying encryption mechanism.

1. Authentication Frame
Bu frame Network Access Control başlığı altına giren Network Admission Control (Cisco. Artık kullanılmıyor) ve Network Access Protection (Microsoft) uygulamaları ile bir şekilde alakalı.

Replay Saldırısı
Açıklaması şöyle

This is not how it works, on many levels. The password is never sent over the air, and it's a more complicated protocol, with multiple back and forth-messages - commonly referred to as a four way handshake.

It uses a nonce to ensure that the packets are not equal. The nonce is basically a random number added by either party to explicitly avoid replay attacks, by forcing the content to differ. The access point gives the client a nonce, and the client uses that nonce in further calculations. An attacker replaying the data would be betrayed by the fact that the AP can tell that it's not using the nonce supplied by the AP to the attacker.

Şeklen şöyle

4. Beacon Frame
802.11 standardında bir access point'i bulmak için iki yöntem tanımlı. 802.11 Layer 2'ye kadar tanımlı olduğu için access point'in IP adresini bulmak mümkün değil.

İlki beacon frame paketinin dinlenmesi. Bu paket Access Point tarafından her 100 milisaniyede bir gönderilir. SSDI, kripto yöntemi, veri hızı, timestamp gibi bilgileri içerir. 11 kanal varsa ve her kanal için beacon frame dinlenirse tüm erişim noktalarını bulmak biraz vakit alabilir.

Beacon içindeki timestamp alanı sayesinden dinleyen taraf bir sonraki beacon'ın ne zaman geleceğini bilir.

Eğer SSID değişirse bağlantı kopar. Açıklaması şöyle

... they will disconnect as soon as they miss enough beacon/management frames from the access point. This behavior will be the same across all 802.11 capable devices. It's not that the AP has disappeared when you change the SSID, but it's identifying information has changed from the client view. (BSSID + SSID combination) and their perceived signal strength to the access point will be zero, as there are no longer beacon/management frames being received from the client, this means no RSSI (i.e out of range).

5. Deauthentication Frame
Wifi kapanırken, kendisini dinleyenlere bunu bildirmek için deauth paketleri gönderir. Wireshark ile şöyle yaparız

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 12)

Açıklaması şöyle.

(wlan.fc.type==0): Filter 802.11 management frames 
(wlan.fc.type_subtype==12): Filter 'de-authenticate' frames (subtype 12)

Saldırı Örneği
Açıklaması şöyle

If an attacker can replay these de-auth frames continuously to a router or client station, it will fail to establish successful authentication. This vulnerability has already been fixed in the IEEE 802.11 protocol for protected access points back in 2009. But as Wi-Fi access points need to be backward compatible with old IEEE 802.11 specifications, this vulnerability still remains intact in all most all commercial routers.

Saldırı Örneği
Bu frame'i göndererek Evil Twin saldırı yapılabilir. Bu saldırının açıklaması şöyle

Basically the attacker creates a network that mimics yours so you (or your machine all by itself) connect to that instead. He achieves that by sending de-auth packets to your router so you have to reconnect. By changing the MAC-Address of his own router to the one of yours, your computer automatically connects to the attackers network instead (given that its signal is stronger). This allows the attacker to further harm you by Man-In-The-Middle Attacks or a fake DNS that redirects common websites to phishing sites.

6. Disassociation Frame

Açıklaması şöyle.

It's absoloutely possible to Jam a wifi connection such as triggering deassociation from the AP.

7. Probe Request Frame
İkinci yöntem ise probe request gönderilerek, access point'in sorgulanması. Yani telefonumuz bir mesajı gönderir. Probe isteği boş ("Hey, is anybody out there?") veya isteğinde daha önce bağlanılmış SSID isimleri ("Hey, is Bob out there?") olabilir.

8. Probe Response Frame
Telefon tarafından gönderilen Probe Request Frame mesajına karşılık olarak Access Point tarafından gönderilir.

9. Reassociation Request Frame
Açıklaması şöyle.

Re-associations by existing devices (e.g.: coming out of hibernation, roaming from other APs etc) would appear identical to a new device joining.

10. Reassociation Response Frame
Association ve reassociation response frame'leri wireshark'ta görmek için şöyle yaparız.

wlan.fc.type_subtype == 0x01 || wlan.fc.type_subtype == 0x03