An enterprise security analyst investigates an incident report where multiple corporate mobile devices in a satellite office automatically established wireless associations with an untrusted rogue access point without user intervention. Packet capture analysis shows that the rogue access point listened for directed 802.11 Probe Request frames sent by client devices searching for their Preferred Network Lists (PNL) and dynamically broadcast matching SSIDs using open authentication. Which of the following attack classifications and technical controls accurately apply to this scenario? (Select TWO.)
- The observed wireless packet behavior represents a Karma attack exploiting automatic client probe responses.Answer
- Enforcing 802.1X EAP-TLS authentication with client-side server certificate verification prevents client auto-connection to open rogue networks.Answer
- CThe capture logs document a 802.11w disassociation frame flood targeting management frame encryption keys.
- DDeploying captive portal gateways with WPA3-Personal preshared keys stops access points from responding to probe requests.
Answer
The attack pattern is identified as a Karma attack, and the effective mitigation requires implementing 802.1X EAP-TLS authentication with strict client-side server certificate validation.
The scenario describes a classic Karma attack, where an attacker configures an access point to listen for 802.11 Probe Request frames from mobile devices searching for saved networks in their Preferred Network List (PNL) and dynamically responds claiming to be that network. The most effective technical countermeasure is migrating corporate wireless configurations to 802.1X EAP-TLS, which enforces mutual authentication using public key infrastructure (PKI) certificates, ensuring devices refuse connections to untrusted access points.
Step-by-Step Solution
Key Concept
Karma Attack Indicators and Enterprise Wireless Mutual Authentication