Users Guide

Detecting a Hotspotter Attack
The Hotspotter attack is an evil-twin attack which attempts to lure a client to a malicious AP. Many enterprise
employees use their laptop in Wi-Fi area hotspots at airports, cafes, malls etc. They have SSIDs of their hotspot
service providers configured on their laptops. The SSIDs used by different hotspot service providers are well
known. This enables the attackers to set up APs with hotspot SSIDs in close proximity of the enterprise
premises. When the enterprise laptop Client probes for hotspot SSIDs, these malicious APs respond and invite
the client to connect to them. When the client connects to a malicious AP, a number of security attacks can be
launched on the client. Airsnarf is a popular hacking tool used to launch these attacks.
Detecting a Meiners Power Save DoS Attack
To save on power, wireless clients will "sleep" periodically, during which they cannot transmit or receive. A client
indicates its intention to sleep by sending frames to the AP with the Power Management bit ON. The AP then
begins buffering traffic bound for that client until it indicates that it is awake. An intruder could exploit this
mechanism by sending (spoofed) frames to the AP on behalf of the client to trick the AP into believing the
client is asleep. This will cause the AP to buffer most, if not all, frames destined for the client.
Detecting an Omerta Attack
Omerta is an 802.11 DoS tool that sends disassociation frames to all stations on a channel in response to data
frames. The Omerta attack is characterized by disassociation frames with a reason code of 0x01. This reason
code is “unspecified” and is not used under normal circumstances.
Detecting Rate Anomalies
Many DoS attacks flood an AP or multiple APs with 802.11 management frames. These can include
authenticate/associate frames, which are designed to fill up the association table of an AP. Other management
frame floods, such as probe request floods, can consume excess processing power on the AP.
Detecting a TKIP Replay Attack
TKIP is vulnerable to replay (via WMM/QoS) and plaintext discovery (via ChopChop). This affects all WPA-TKIP
usage. By replaying a captured TKIP data frame on other QoS queues, an attacker can manipulate the RC4 data
and checksum to derive the plaintext at a rate of one byte per minute.
By targeting an ARP frame and guessing the known payload, an attacker can extract the complete plaintext and
MIC checksum. With the extracted MIC checksum, an attacker can reverse the MIC AP to Station key and sign
future messages as MIC compliant, opening the door for more advanced attacks.
Detecting Unencrypted Valid Clients
An authorized (valid) client that is passing traffic in unencrypted mode is a security risk. An intruder can sniff
unencrypted traffic (also known as packet capture) with software tools known as sniffers. These packets are
then reassembled to produce the original message.
Detecting a Valid Client Misassociation
This feature does not detect attacks, but rather it monitors authorized (valid) wireless clients and their
association within the network. Valid client misassociation is potentially dangerous to network security. The
four types of misassociation that we monitor are:
l Authorized Client associated to Rogue: A valid client that is associated to a rogue AP.
l Authorized Client associated to External AP: An external AP, in this context, is any AP that is not valid
and not a rogue.
l Authorized Client associated to Honeypot AP: A honeypot is an AP that is not valid but is using an
SSID that has been designated as valid/protected.
l Authorized Client in ad hoc connection mode: A valid client that has joined an ad hoc network.
Dell Networking W-Series ArubaOS 6.5.x | User Guide Wireless Intrusion Prevention | 491