Understand Protected Management Frames as a Defense

Introduction

Deauthentication attacks are a common type of denial-of-service attack against Wi-Fi networks. An attacker can send spoofed "deauthentication" frames to a wireless client, causing it to disconnect from the network. This is possible because standard management frames, which control the connection, are not encrypted.

The IEEE 802.11w amendment, also known as Protected Management Frames (PMF), was introduced to solve this vulnerability. PMF ensures the integrity and authenticity of critical management frames, protecting wireless connections from being maliciously torn down.

In this lab, you will learn the concept of PMF and how it works as a defense. Due to the limitations of a virtual environment which lacks physical Wi-Fi hardware, this lab will be a conceptual exercise. You will learn the principles and the tools involved, rather than performing a live attack.

Research 802.11w PMF Technology

In this step, we will discuss the theory behind Protected Management Frames.

Wi-Fi networks rely on various types of 802.11 frames to function. These are broadly categorized into Management, Control, and Data frames. Management frames are used to establish and maintain connections. Some key management frames include:

• Beacon: Announced by the Access Point (AP) to signal its presence.
• Probe Request/Response: Used by clients to scan for available networks.
• Association/Reassociation Request/Response: Used by clients to connect to an AP.
• Disassociation/Deauthentication: Used to terminate a connection.

Traditionally, these frames are sent in the clear (unencrypted), even on a WPA2/WPA3 secured network. This allows an attacker to easily forge a deauthentication frame, pretending it came from the AP, and send it to a connected client. The client, believing the frame is legitimate, will disconnect.

The 802.11w amendment addresses this by protecting a subset of these robust management frames, including Deauthentication and Disassociation frames. It does not encrypt the entire frame but adds a cryptographic signature (Message Integrity Check or MIC) to ensure the frame is authentic and has not been tampered with. When a PMF-enabled client receives a management frame, it checks the MIC. If the MIC is invalid or missing, the frame is discarded.

This step is purely for understanding the technology. There are no commands to execute.

Check Your Router Settings for a PMF Option

In this step, we'll discuss how you would find the PMF setting on a real-world wireless router.

Note: This action must be performed on your physical home or office router's web administration interface and cannot be done within the LabEx virtual environment.

To enable PMF, you first need to log in to your router's configuration page. This is typically done by entering the router's IP address (like 192.168.1.1 or 192.168.0.1) into a web browser.

Once logged in, you will need to navigate to the wireless security settings. The location and name of the PMF setting can vary widely between router manufacturers and firmware versions. Look for it under sections such as:

• Wireless Settings
• Advanced Wireless Settings
• WPA/WPA2/WPA3 Settings
• Professional Settings

The option itself might be labeled as:

• Protected Management Frames (PMF)
• 802.11w
• Management Frame Protection

The goal of this step is to familiarize yourself with where this critical security feature is located on typical network hardware.

Enable PMF (Set to 'Required' or 'Capable')

In this step, we will explore the different configuration options for PMF.

Once you locate the PMF setting on your router, you will typically find three options: Disabled, Capable, and Required. Understanding the difference is key to proper configuration.

1. Disabled: PMF is turned off. The network is vulnerable to deauthentication attacks. This is the default on many older routers.

2. Capable (or Optional): The router advertises that it supports PMF.

   • Clients that also support PMF will connect using protection.
   • Older clients that do not support PMF can still connect, but their connection will be unprotected.
   • This mode provides backward compatibility but offers a mixed-security environment. It's a good intermediate step if you have legacy devices on your network.

3. Required (or Mandatory): The router enforces the use of PMF.

   • All clients must use PMF to connect to the network.
   • Any client that does not support 802.11w will be unable to join.
   • This is the most secure setting and is highly recommended for modern networks where all devices are relatively new (manufactured after ~2014). WPA3 security requires PMF to be set to 'Required'.

For maximum security, you should set PMF to Required.

Attempt a Fluxion Deauth Attack Against the PMF-Enabled Network

In this step, we will simulate the process of launching a deauthentication attack. We will install the necessary tools and examine the command used, though we cannot execute it against a live network in this environment.

The aircrack-ng suite is a set of tools for auditing wireless networks. It includes aireplay-ng, a tool used to inject frames, which is commonly used for deauthentication attacks. Let's install it.

Open a terminal and run the following command to install aircrack-ng:

sudo apt-get install -y aircrack-ng

After the installation is complete, you can see the help options for aireplay-ng to understand its capabilities.

aireplay-ng --help

A typical deauthentication attack command looks like this: aireplay-ng --deauth 0 -a <BSSID_OF_AP> -c <BSSID_OF_CLIENT> wlan0mon

Let's break down this command:

• --deauth 0: The 0 signifies a broadcast deauthentication, sending packets to all clients of the AP. A specific number sends that many deauths.
• -a <BSSID_OF_AP>: Specifies the MAC address (BSSID) of the target Access Point.
• -c <BSSID_OF_CLIENT>: Specifies the MAC address of the target client to deauthenticate.
• wlan0mon: The name of the wireless interface in monitor mode, which is required to inject packets.

In a real-world scenario, an attacker would first put their Wi-Fi card into monitor mode and then run this command to disconnect a client from a network.

Observe that the Deauthentication Attack Fails

In this final step, we will discuss the expected outcome when a deauthentication attack is launched against a network with PMF enabled.

As we learned in the previous step, an attacker would use a command like aireplay-ng --deauth to send forged deauthentication frames to a target client.

On a network without PMF: The client would instantly accept the forged frame as legitimate and terminate its connection to the AP. The attack would be successful.

On a network with PMF enabled (Capable or Required):

1. The attacker's aireplay-ng tool sends an un-protected, forged deauthentication frame.
2. The PMF-enabled client and AP have already negotiated a secure session for management frames.
3. When the client receives the forged frame, it checks for the cryptographic signature (MIC) that PMF requires.
4. The forged frame from the attacker lacks a valid MIC.
5. The client identifies the frame as inauthentic and simply discards it.
6. The client's connection to the AP remains stable and uninterrupted.

The attack completely fails. The attacker's tool might report that it is sending packets, but they have no effect on the target. This demonstrates the power of PMF as a direct and effective countermeasure to one of the most common Wi-Fi attacks.

Summary

In this lab, you explored the critical Wi-Fi security feature known as Protected Management Frames (PMF or 802.11w). You learned that traditional Wi-Fi networks are vulnerable to deauthentication attacks because their management frames are unencrypted.

We covered how PMF solves this problem by adding cryptographic protection to essential management frames, ensuring their authenticity and integrity. You also learned about the different PMF settings on a router (Disabled, Capable, Required) and why Required is the most secure option for modern networks. Finally, you understood why tools like aireplay-ng fail to disconnect clients on a PMF-protected network.

Enabling PMF on your wireless router is a simple yet powerful step to significantly enhance your network's resilience against common denial-of-service attacks.