Ad-hoc Network

Infrastructure Network

Internet
Access Point
Wired Network

Wired LAN

Traffic encrypted with client 1s

key

Wi-Fi Client 1

Traffic encrypted with client 2s

key

Wi-Fi Client 2

Two Types Keys in WPA/WPA2

1) Pairwise
2) Group

Transient Key (PTK)

Temporal Key (GTK)

Distribution of Keys in WPA/WPA2

Access Point

Client 1

Client 2

Client 3

PTK = PTK1

PTK = PTK2

PTK = PTK3

Group Key = GTK1

Group Key = GTK1

Group Key = GTK1

Stealth ARP Poisoning

Wired LAN

Victims data encrypted

with attackers PTK

Victims data encrypted with

victims PTK

1
Attacker

I am the Gateway
(Encrypted with GTK)

Victim

Stealth Man-in-the-Middle Attack

Wired LAN

Attacker forwards the 4

victims data to original
gateway

2 Victims data encrypted with

victims PTK

3 Victims data encrypted

with attackers PTK
1
Attacker

I am the Gateway
(Encrypted with GTK)

Victim

Wireless DoS Attack

Attacker

PN=610

PN=610

Victim

GTK E
ncrypt
ed da
ta fra
PN = 9
me
999
PN = 6
1

Victim updates PN
New PN=9999

PN = 6
12

New PN <local PN
611<9999

PN = 6
13

Packets are dropped

until PN reaches 9999

Advanced Stealth Man-in-the-Middle Attack

Wired LAN

1.

2. Victims data encrypted with

victims PTK

3. Victims data encrypted with

attackers PTK

4.

Attacker forwards the victims

data to original gateway

5.

The victim will discard the

frames having PN less than
that used by the attacker

1
Attacker

Attacker Send forged ARP

Request message with very
high PN.

I am the Gateway
(Encrypted with GTK)

Victim

Circular Shift Vulnerability

To DS
Flag

Address 1

Duration

APs MAC
Address

Receiver

Address 2
Clients MAC
Address

Transmitter

Address 3
FF:FF:FF:FF:FF:FF

Seq.
No.

Final Destination

From DS
Flag

Duration

FF:FF:FF:FF:FF:
FF

Receiver

APs MAC
Address

Transmitter

Clients MAC
Address

Original Sender

Seq.
No.

Stealth Man-in-the-Middle Attack

Wired LAN

Attacker forwards victims

4
data to gateway
3

1
Attacker

I am the Gateway
(Encrypted with GTK)

Victim