- [Narrator] An attacker can cause
legitimate wireless clients
to de-authenticate from legitimate wireless access points
or from wireless routers.
And they do that
to either perform and denounce a risk condition,
or to make those clients connect to a rouge access point,
or to an evil twin.
Now, let's actually define
how wireless networking actually works
in just a few seconds.
Now within wireless networking, there's this concept
of a Service Set Identifier, or the SSID.
And basically that is the name
or identifier that is associated with the
92.11 wireless local internet network.
Now SSID's are included in plain text
in many different wireless packets
and many different beacons.
Now, a wireless client needs to know the SSID
in order to associate with a wireless access point.
It is possible to configure wireless passive tools
like Kismet and Airmon or Airmon-ng,
which is actually by the way,
part of a very popular suite of tools called
Aircrack-ng.
Basically you can use Airmon
to perform this type of reconnaissance
and to obtain the SSID's of the wireless networks
that are adjacent to you.
In this case, actually I'm sniffing wireless network traffic
to obtain the SSID's that are associated,
or are available within the environment,
along with the channels that they are operating.
Many corporations and individuals actually
configure their wireless access points
not to advertise or broadcast their SSID's.
And also not to respond
to broadcast probe requests as well.
However, if you sniff on a wireless network long enough
you will actually, eventually catch a client
trying to associate with the IP, or the access point.
And then you actually can get that SSID.
But now let's take a look
at how to perform a de-authentication attack.
You can actually see here two terminal windows.
The terminal window here, is actually displaying
the output of the error dump utility on a specific channel,
in this case, channel 11.
And then one ESSID that is actually configured
with the name Corp-net.
Now, in that same terminal window,
you can actually see
a wireless client station in the bottom,
along with a BSSID, which is connected to this access point,
as you can see in this screen.
So now, I'm launching a tool called error replay,
also part of the same suite,
part of the Aircrack-ng suite.
After the error replay command is actually used,
the de-authentication message from the attacker,
in this case from me,
is sent to the BSSID that I'm highlighting on the screen.
Now, the attack can actually be accelerated
by sending the de-authentication packets to the client
with the C option, so, -C.
There are several mitigation's
against these types of attacks.
The 802.11w standard, basically defines
the management frame protection,
which is a feature that wireless devices
can actually detect these type of attacks
and also protect against spoof management frames
from other wireless devices
that might otherwise de-authenticate a valid client.
Now let's go over what is the preferred network list,
and how to actually hack and attack
the preferred network list.
Basically, operating systems and wireless supplicants,
or clients.
So, that means your laptop, your phone,
your tablet, in many cases,
maintain a list of trusted or preferred
wireless networks.
This is also referred to as the preferred network list
or PNL.
And basically,
PNL includes a list of the wireless network SSID's,
the plain text passwords and WAP and wpa passwords
of the networks that you actually have authenticated before.
So let's say you're in a hotel,
or in an airport, or at a coffee shop,
when a reader device connects to a wireless network
most definitely, it's going to put that network
in a preferred network list,
and whenever the client actually is not connected
to a network and is trying to connect,
it will actually look into the list
and try to connect to all those wireless networks
when they are not connected to an IP or wireless router.
It is possible for attackers
to listen to this client request
and then impersonate the wireless networks
in order to make the clients
connect to the attackers wireless device.
Then, form there,
the attacker can eavesdrop to the conversation
or manipulate any type of transactions
from the client to the rest of the network.