Wi-Fi Hacking: Deauthentication Attack

Disclaimer: This blog is intended solely for educational and ethical purposes. The information provided here is aimed at raising awareness about cybersecurity threats and promoting the importance of securing wireless networks. All activities were conducted in a controlled, isolated test environment, in compliance with ethical hacking standards.

Nowadays, wireless networks are essential for modern connectivity, but their security remains a significant concern. Among the various vulnerabilities that affect wireless networks, the Deauthentication Attack is one of the most disruptive. This blog offers a comprehensive analysis of deauthentication attacks, their potential consequences, and practical measures for both conducting controlled tests and securing networks against such threats.

1. What is a Deauthentication Attack and Why is it Significant?

A deauthentication attack is a Denial-of-Service (DoS) attack that targets Wi-Fi networks. The attacker sends fake deauthentication frames to the router, pretending to be the device, causing it to disconnect. This can be repeated to keep the device disconnected.

Why is it significant?

• Wireless networks rely on consistent connectivity, and deauthentication attacks can force devices, such as laptops and smartphones, to disconnect.

• No decryption of network encryption (e.g., WPA2) is required, making the attack relatively easy to perform.

• It exposes a critical vulnerability in outdated wireless protocols, highlighting the need for strong and up-to-date network security practices.

2. When and Why are Deauthentication Attacks Used?

Ethical Use Cases (Penetration Testing)

• Testing Network Resilience: Cybersecurity professionals utilise deauthentication attacks to assess the ability of a network to withstand potential disruptions.

• Vulnerability Assessments: Penetration testers simulate these attacks to identify weaknesses in wireless configurations and recommend the necessary defences.

• Wi-Fi Security Training: Demonstrating deauthentication attacks in controlled settings is crucial for training and educating professionals on effective cybersecurity practices.

Malicious Use Cases

• Denial of Service (DoS): Attackers can disrupt connectivity for legitimate users, which not only interrupts productivity but also leads to frustration.

• Man-in-the-Middle (MitM) Attacks: By disconnecting clients, attackers can manipulate devices to connect to a rogue access point (e.g., an “Evil Twin”), enabling them to intercept sensitive data.

• Credential Harvesting: When combined with tools such as Wifiphisher, attackers can deceive users into providing their Wi-Fi credentials after disconnection.

• Example: An attacker in a coffee shop could deploy a deauthentication attack to disconnect all users from the public Wi-Fi, forcing them to connect to the attacker’s rogue hotspot.

3. Objective of a Deauthentication Attack

The primary goal of a deauthentication attack is to disrupt connectivity between a client and an access point.

What the attacker aims to achieve:

• Force Disconnection: Interrupt the connection between devices and the target network.

• Interception: Set up rogue access points to capture credentials or sensitive data.

• Service Disruption: Prevent users from accessing the internet or critical services.

Potential Consequences:

• Productivity Loss: Organisations may face disruptions in operations.

• Data Theft: In advanced attacks, credentials and personal data can be stolen.

• Increased Vulnerability: Repeated disconnections could prompt users to connect to unsecured networks, exposing them to further risks.

4. Step-By-Step Guide: Performing a Deauthentication Attack in a Controlled Environment

Important Note: The following steps were performed on a test network in a secure and controlled environment. Attempting such activities without proper authorisation or outside a test environment is illegal and unethical.

This section outlines my practical execution of a deauthentication attack in a controlled environment, using the necessary tools and commands to simulate the attack on the target network, Plasmorix. Each step includes the commands I used, their purpose, and the observations made during the demonstration, along with corresponding outputs.

Tools Used

• Kali Linux: A penetration testing operating system

• Aircrack-ng Suite: Includes tools for network monitoring and packet injection.

• RealTek RTL8812AU Chipset: A versatile wireless network adapter that supports monitor mode, packet injection, and AP mode, ideal for discovering and testing the security of Wi-Fi networks without direct connection.

Step-By-Step Instructions:

Step 1: Verify Network Connectivity

Before initiating the attack, I made sure that the target network, Plasmorix, was operational. This step confirmed that the network was stable and connected.

1. I opened the Wi-Fi menu on my device and ensured it was connected to Plasmorix.

2. I performed a basic browser search to verify internet connectivity and confirmed that the network was functioning properly.

At this stage, the network was active, establishing a baseline for the attack.

Caption: Wi-Fi menu showing connection to Plasmorix and successful browser search result.

Step 2: Scan for Nearby Wi-Fi Network

Next, I scanned the airwaves to gather information on nearby Wi-Fi networks, including Plasmorix. I used the airodump-ng tool, which provided a comprehensive list of all wireless networks within range.

1. I ran the following command:

airodump-ng --band bg wlan0

2. Explanation:

   • --band bg scans the 2.4 GHz frequency band.

   • wlan0 specifies the wireless interface I was using.

Caption: Output of airodump-ng showing the Plasmorix network. All other Wi-Fi networks and associated information have been redacted for privacy.

The output displayed multiple networks, including Plasmorix, along with key details:

• BSSID: The MAC address of the target network.

• PWR: The signal strength (power) of the network. A stronger signal would indicate that the network is either closer or is transmitting with higher power.

• Beacons: Beacons are frames sent by the network to broadcast its existence.

• #Data: The number of data packets, or data frames.

• #/s: The number of data packets collected within the previous 10 seconds.

• Channel (CH): The frequency channel on which the network operates on.

• MB: The maximum speed supported by the network.

• ENC: The encryption used by the network.

• CIPHER: The cipher used in the network.

• AUTH: The authentication used in the network.

• ESSID: The names of the wireless networks around the user.

The highlighted information above was crucial for targeting the Plasmorix network in subsequent steps.

Step 3: Focus on the Target Network

To narrow the focus to the Plasmorix network, I filtered the scan to monitor only this network and its connected devices. This step was important for identifying which client devices would be targeted in the attack.

1. I ran the following command:

airodump-ng --bssid 10:13:31:DC:C6:F3 --channel 1 wlan0

2. Explanation:

   • --bssid specifies the MAC address of the target network.

   • --channel locks the scan to the frequency channel of Plasmorix.

The output now displayed information about the Plasmorix network, including the connected client device(s) listed under the STATION column. The target of the deauthentication attack was my MacBook, which was the only device listed under the station.

Caption: Filtered output of airodump-ng focusing on Plasmorix and displaying my MacBook.

Step 4: Perform the Deauthentication Attack

With the target network and client identified, the deauthentication attack is executed using the aireplay-ng tool. This command forced the client device to disconnect from the network until the program had terminated.

1. Run the following command:

aireplay-ng --deauth 100000 -a 10:13:31:DC:C6:F3 -c 22:50:AB:67:72:D3 wlan0

2. Explanation:

   • --deauth 100000 sends 100000 deauthentication packets. This value can be adjusted as needed.

   • -a <BSSID> specifies the MAC address of the target network.

   • -c <STATION> specifies the MAC address of the client to be disconnected.

After running this command, the target client will be disconnected from the Plasmorix network, as shown below:

Caption: Top terminal displaying airodump-ng network and device information, while the bottom terminal shows aireplay-ng deauthentication packets. The bottom right of the screen shows Wi-Fi settings with disconnection from the Plasmorix network.

Step 5: Stop the Attack and Restore Connectivity

After demonstrating the attack, it is crucial to stop it and verify that the network can recover.

1. Press Ctrl + C in the terminal to terminate the attack.

2. Go to the Wi-Fi menu in Settings and reconnect to the Plasmorix network.

Caption: Wi-Fi menu showing successful reconnection to Plasmorix after stopping the deauthentication attack.

This step demonstrates that the disruption caused by the attack is temporary, ensuring a controlled and ethical conclusion to the test.

Findings

Impact: The attack effectively disrupted connectivity, revealing a significant vulnerability within the wireless network.

Insight: In older protocols such as WPA2, deauthentication frames are transmitted unencrypted, which makes this attack highly effective unless appropriate mitigation measures are implemented.

5. Mitigation Strategies: How to Protect Against Deauthentication Attacks

To safeguard against deauthentication attacks, both individuals and organizations should consider the following best practices:

• Upgrade to WPA3 Encryption: WPA3 introduces Protected Management Frames (PMF), which encrypt deauthentication frames, making them resistant to tampering.

• Use MAC Address Filtering: Restrict network access to known devices. While not foolproof, this method adds an additional layer of security to your network.

• Monitor Wi-Fi Traffic: Leverage network monitoring tools to identify unusual deauthentication activities that may signal an ongoing attack.

• Deploy Intrusion Detection Systems (IDS): An IDS can provide real-time alerts to administrators about suspicious activity, enabling swift responses to mitigate attacks.

• Limit Signal Range: Reducing the range of Wi-Fi signals can help limit the ability of attackers to target the network from a distance.

• Regularly Update Firmware and Security Configurations: Ensure routers and access points are updated with the latest firmware and security patches to address known vulnerabilities.

6. Conclusion

Deauthentication attacks emphasise the critical importance of securing wireless networks against protocol-level vulnerabilities. Although disruptive, understanding the mechanics of these attacks is crucial for both penetration testers and network administrators. By adopting advanced security standards like WPA3, organisations can significantly enhance the protection of their networks against this type of threat.

This blog has provided a detailed overview of deauthentication attacks, from the execution in controlled environments to practical mitigation strategies. For cybersecurity professionals, addressing these vulnerabilities is key to building stronger and more resilient wireless networks.

Thank you for reading the blog. This article was created with the help of AI and edited for clarity and accuracy.