Skip Links

Network World

Brad Reese

DEFCON 16 presentation: Tricking Cisco WLAN APs into committing suicide

By Brad Reese on Thu, 08/07/08 - 6:49am.
Newsletter Signup

Airtight Networks Presents at DEFCON 16

According to the wireless security researchers at AirTight Networks, this Saturday, August 9th at 4:30PM in the Riviera Las Vegas, they will be sharing with DEFCON 16 their findings about self destructive behavior spotted in select open source and commercial wireless LAN Access Points.

Below is a sneak peek at what the presentation will cover, in AirTight's own words:
Autoimmunity disorder in Wireless LANs

An autoimmune disorder is a condition that occurs when the immune system mistakenly attacks and destroys healthy body tissue.

This presentation is about discovery of autoimmunity disorder in select open source and commercial 802.11 AP implementations.

By sending specially crafted packets, it is possible to trigger autoimmunity disorder and cause AP to turn hostile against its own clients.

Eight examples of autoimmune disorder will be demonstrated.

Autoimmunity disorder can be exploited to craft new DoS attacks.

Although 802.11w promises immunity from DoS attacks, we show that autoimmunity disorder leaves a door open through which DoS attacks can still be launched.

One example of DoS attack against MFP(11w) will be demonstrated.


What has Autoimmunity disorder got to do with Wireless LANs?

Biological Systems vs. WLAN Systems: Similarities

Similarities between biological systems and security systems have been known for years.

Both systems are known to possess some degree of attack resistance (self defense) capability.


Autoimmunity Disorder

An autoimmune disorder is a condition that occurs when the immune system mistakenly starts attacking and destroying healthy body cells.

This suicidal tendency is known to exist in biological systems.

We spotted similar self destructive behavior in WLAN Systems.

An attacker only needs to inject a stimulus to trigger self destructive behavior.

The rest of the damage is inflicted by the AP upon its own clients.


Example of Self DoS

During the presentation we’ll show an example stimulus packet which will cause a select set of WLAN APs to turn against their own clients.

This attack exploits implementation bugs (not protocol flaws) in select open source and commercial WLAN APs.


More Examples

We’ll demonstrate eight additional examples.

These attacks do not make WLANs any more vulnerable than they already are – except that they cause destruction by triggering suicidal tendencies imbedded in faulty software code of WLAN APs.


What about MFP (802.11w)?

Cisco’s self defending WLAN network implement Management Frame Protection (MFP).

MFP capability is supposed to make Cisco WLAN networks attack resistant.


MFP Background

We’ll show an example stimulus packet

We’ll show an example stimulus packet which will turn a Cisco self defending WLAN AP into a self destructing WLAN AP!


Food for Thought

Security software is very hard to get right until extreme care is taken in designing and coding it correctly.

View more information about this DEFCON 16 presentation.


Do YOU believe it's possible that a Cisco self defending WLAN AP can be turned into a suicidal self-destructing WLAN AP?

Contact Brad Reese
http://www.BradReese.Com

Search 49,398 current Cisco Job openings worldwide.

Brad's Top 5 Story Picks
# 1. Is Juniper working on a major re-launch of their WAN acceleration platform?
# 2. Motorola: Global video on demand subscribers could grow from 58M in 2007 to 165M in 2011
# 3. F5 Networks: Viprion high end modular switches continue to see robust demand
# 4. CCIE water cooler gossip: 55% of all new CCIEs are coming from the Pacific Rim
# 5. 40 million credit and debit card numbers stolen: What could have prevented this theft?
Story Archives Brad Reese on Cisco Story Archives

Cisco Refurbished

Cisco VoIP Gateways

Cisco Power Supplies

Cisco Aironet Wireless

  

Welcome, visitor. Register Log in
About Brad Reese on Cisco

Brad Reese cofounded BradReese.Com Cisco Refurbished, which enables affordable networks globally by assuring customer satisfaction with guaranteed one year warranties on both Cisco Repair as well as Refurbished Cisco.

Don't be shy, contact Brad Reese online or call him Toll Free:

866-864-0506

International callers may wish to call Brad by dialing:

850-364-4115

Archives
November 2009
October 2009
September 2009
August 2009
July 2009
June 2009
May 2009
April 2009
March 2009
February 2009
January 2009
December 2008
November 2008
October 2008
September 2008
August 2008
July 2008
June 2008
May 2008
April 2008
March 2008
February 2008
January 2008
December 2007
November 2007
October 2007
September 2007
August 2007
July 2007
June 2007
May 2007
April 2007
March 2007
February 2007
January 2007
Categories
America's Best profile written by Useem regarding Chambers' success
Avian Securities Senior Telecom Research Analyst - Catharine Trebnick
Breakingviews.com correspondent - Robert Cyran
CCIE
Careers
Charlie Giancarlo - Managing Director of Silver Lake Partners and Skype investor
Cisco
Cisco ASR 9000 architecture
Cisco ISR G2 Module Support
Cisco Integrated Services Router Generation 2 (ISR G2) Model Comparison
Cisco Integrated Services Routers Generation 2 Portfolio
Cisco Unified Communications Support for Microsoft Windows 7
Cisco is pushing their ASR 9000 at very competitive prices
Cisco is warning Unified Communications customers about NOT successfully offering support for Microsoft Windows 7
Cisco technical star Jonathan Rosenberg
Cisco will have no liability for any delay in delivery
Daniel Berg - Skype's CTO
Data Center
Douglas Smith - Cofounder and President of Network Instruments
Expand visibility of NetFlow-dependent NBAD and compliance applications
Father of SIP - Jonathan Rosenberg
GigaStor captures and converts packets in NetFlow data flows
Index Venture partner Danny Rimer
Jonathan Rosenberg - a Cisco Fellow in Cisco's Voice Technology Group
Juniper MX960 lab test results
LANs / WANs
Mark Roberts - Polycom vice president of partner marketing
Michael Useem - Professor of Management
Microsoft
NetFlow
NetFlow add-ons
NetFlow overhead can overtax infrastructure
Network Behavior Anomaly Detection (NBAD)
Network Management
Non-NetFlow capable devices are blind to local traffic
Produce NetFlow about any device
Rosenberg is now Skype's Chief Technology Strategist
SMB
Security
Selection committee member for America's Best Leaders
September 2009 vs. October 2009 Worldwide CCIE Count Comparison
Silver Lake Managing Director - Egon Durban
Skills and abilities of Skype CTO Daniel Berg
Skype announced Roseberg jumped ship from Cisco
Skype's Chief Technology Strategist - responsible for Skype's overall architecture and technology strategy
Skype's cofounders Niklas Zennstrom and Janus Friis
Software
The Charlie angle is to keep Dave Roux on track
The new Cisco ISR G2 portfolio is priced as follows
VoIP / Convergence
What are the benefits of GigaStor NetFlow Agent?
What’s new on the Cisco ISR G2 models vs. the old ISR models?
Windows 7
Windows 7 just not worth an all-out urgent effort by Cisco to support
Wireless / Mobile
eBay CEO - John Donahoe
sFlow
sFlow and NetFlow provides extended visibility
On The Web
Twitter