Skip Links

Network World

Brad Reese

DEFCON 16 presentation: Tricking Cisco WLAN APs into committing suicide

By Brad Reese on Thu, 08/07/08 - 6:49am.
Newsletter Signup

Airtight Networks Presents at DEFCON 16

According to the wireless security researchers at AirTight Networks, this Saturday, August 9th at 4:30PM in the Riviera Las Vegas, they will be sharing with DEFCON 16 their findings about self destructive behavior spotted in select open source and commercial wireless LAN Access Points.

Below is a sneak peek at what the presentation will cover, in AirTight's own words:
Autoimmunity disorder in Wireless LANs

An autoimmune disorder is a condition that occurs when the immune system mistakenly attacks and destroys healthy body tissue.

This presentation is about discovery of autoimmunity disorder in select open source and commercial 802.11 AP implementations.

By sending specially crafted packets, it is possible to trigger autoimmunity disorder and cause AP to turn hostile against its own clients.

Eight examples of autoimmune disorder will be demonstrated.

Autoimmunity disorder can be exploited to craft new DoS attacks.

Although 802.11w promises immunity from DoS attacks, we show that autoimmunity disorder leaves a door open through which DoS attacks can still be launched.

One example of DoS attack against MFP(11w) will be demonstrated.


What has Autoimmunity disorder got to do with Wireless LANs?

Biological Systems vs. WLAN Systems: Similarities

Similarities between biological systems and security systems have been known for years.

Both systems are known to possess some degree of attack resistance (self defense) capability.


Autoimmunity Disorder

An autoimmune disorder is a condition that occurs when the immune system mistakenly starts attacking and destroying healthy body cells.

This suicidal tendency is known to exist in biological systems.

We spotted similar self destructive behavior in WLAN Systems.

An attacker only needs to inject a stimulus to trigger self destructive behavior.

The rest of the damage is inflicted by the AP upon its own clients.


Example of Self DoS

During the presentation we’ll show an example stimulus packet which will cause a select set of WLAN APs to turn against their own clients.

This attack exploits implementation bugs (not protocol flaws) in select open source and commercial WLAN APs.


More Examples

We’ll demonstrate eight additional examples.

These attacks do not make WLANs any more vulnerable than they already are – except that they cause destruction by triggering suicidal tendencies imbedded in faulty software code of WLAN APs.


What about MFP (802.11w)?

Cisco’s self defending WLAN network implement Management Frame Protection (MFP).

MFP capability is supposed to make Cisco WLAN networks attack resistant.


MFP Background

We’ll show an example stimulus packet

We’ll show an example stimulus packet which will turn a Cisco self defending WLAN AP into a self destructing WLAN AP!


Food for Thought

Security software is very hard to get right until extreme care is taken in designing and coding it correctly.

View more information about this DEFCON 16 presentation.


Do YOU believe it's possible that a Cisco self defending WLAN AP can be turned into a suicidal self-destructing WLAN AP?

Contact Brad Reese
http://www.BradReese.Com

Search 49,398 current Cisco Job openings worldwide.

Brad's Top 5 Story Picks
# 1. Is Juniper working on a major re-launch of their WAN acceleration platform?
# 2. Motorola: Global video on demand subscribers could grow from 58M in 2007 to 165M in 2011
# 3. F5 Networks: Viprion high end modular switches continue to see robust demand
# 4. CCIE water cooler gossip: 55% of all new CCIEs are coming from the Pacific Rim
# 5. 40 million credit and debit card numbers stolen: What could have prevented this theft?
Story Archives Brad Reese on Cisco Story Archives

Cisco Refurbished

Cisco VoIP Gateways

Cisco Power Supplies

Cisco Aironet Wireless

  

Welcome, visitor. Register Log in
About Brad Reese on Cisco

Brad Reese cofounded BradReese.Com Cisco Refurbished, which enables affordable Cisco networks globally by assuring customer satisfaction with guaranteed one year warranties on both Cisco Repair as well as Refurbished Cisco.

Don't be shy, contact Brad Reese online or call him Toll Free:

866-864-0506

International callers may wish to call Brad by dialing:

850-364-4115

Archives
November 2009
October 2009
September 2009
August 2009
July 2009
June 2009
May 2009
April 2009
March 2009
February 2009
January 2009
December 2008
November 2008
October 2008
September 2008
August 2008
July 2008
June 2008
May 2008
April 2008
March 2008
February 2008
January 2008
December 2007
November 2007
October 2007
September 2007
August 2007
July 2007
June 2007
May 2007
April 2007
March 2007
February 2007
January 2007
Categories
Allan Sulkin - founder and president of enterprise communications systems and applications consultancy - TEQConsult Group
Careers
Chambers and his Board of Dirctors urged Cisco shareholders to vote NO
China networking marketplace
Christian Brothers Investment Services notice
Cisco
Cisco F1Q10 earnings call
Cisco TelePresence
Cisco TelePresence revenue
Cisco engineer - Kevin Murphy
Cisco first quarter net product sales in emerging markets by fiscal year
Cisco has now become the target of unflattering employee reviews
Cisco is well known as being one of the best companies to work for
Cisco stock chart for the last 10 years
Cisco's 1st Quarter Other Product Revenue By Fiscal Year
Cisco's F1Q10 earnings call
Cisco's Form 10-Q
Cisco's new Stock Incentive Plan as amended and restated
Cisco's upcoming annual stockholder's meeting
Daniel Berg - Skype's CTO
Data Center
Dave Donatelli - HP executive vice president and general manager of enterprise servers and networking
Did Cisco take its eye off the ball in emerging markets
Do you think Cisco can effectively compete against Huawei
FNF
Father of SIP - Jonathan Rosenberg
Financial windfall for Cisco shareholders
Flexible NetFlow
Flip video camcorder
Flip video camcorder revenue
Gilbert Public School's $3.5 million network upgrade to HP
Gilbert Public Schools Board President - Thad Stump
Gilbert Public Schools assistant superintendent - Barb VeNard
Glassdoor.com is financially backed by 2 of the leading Silicon Valley venture capital firms - Benchmark Capital and Sutter Hill Ventures
HP also bid on the project
HP purchasing 3Com
HP's Converged Infrastructure strategy
HP's acquisition of 3Com
Huawei
John Chambers has had some good paydays as the CEO of Cisco
LANs / WANs
NBAD
NetFlow
NetFlow add-ons
Network Behavior Anomaly Detection
Network Management
Popular online career and workplace community - Glassdoor.com
ProCurve ONE alliance
Proposal submitted by Christian Brothers Investment Services
Proxy resolution during Cisco's annual meeting
Rosenberg is now Skype's Chief Technology Strategist
SMB
Say on executive pay
Security
Skills and abilities of Skype CTO Daniel Berg
Skype announced Roseberg jumped ship from Cisco
Skype's Chief Technology Strategist - responsible for Skype's overall architecture and technology strategy
So how does one verify that Glassdoor's information is really from Cisco employees?
Software
Superintendent Dave Allison
TelePresence revenue
VoIP / Convergence
When Cisco used its common stock to buy Linksys and Pure Digital
Who's right about Cisco's work environment - Fortune or Glassdoor?
Wireless / Mobile
On The Web
Twitter