Examkin

Question

Difficulty: HardNetwork and Wireless Attack Indicators

A network administrator receives multiple user tickets regarding frequent, transient disconnections on an enterprise wireless network using WPA3-Enterprise. A wireless packet capture collected near the affected access points reveals an abnormally high frequency of IEEE 802.11 Type 0 (Management) Subtype 12 frames sent with the BSSID spoofed as the legitimate AP address targeting client MAC addresses, causing immediate client state reset. Further configuration inspection indicates that Management Frame Protection (802.11w / PMF) was set to 'Optional' across all access points. Which of the following wireless attack types is directly indicated by these packet capture artifacts?

  1. Wireless Deauthentication attack exploiting unauthenticated 802.11 management framesAnswer
  2. B
    Radio frequency (RF) broadband jamming targeting the 5 GHz spectrum
  3. C
    Address Resolution Protocol (ARP) poisoning on the wireless distribution system
  4. D
    Initialization Vector (IV) reuse attack against the WPA3 encryption suite

Answer

Wireless Deauthentication attack exploiting unauthenticated 802.11 management frames
The correct answer identifies a Wireless Deauthentication attack. In 802.11 wireless networks, management frames such as Deauthentication (Subtype 12) and Disassociation (Subtype 10) are sent unauthenticated by default unless Protected Management Frames (IEEE 802.11w / PMF) are mandated. An attacker eavesdropping on the network can capture the MAC address of the Access Point (BSSID) and target clients, then send forged deauthentication frames with the spoofed AP source address, forcing clients off the network repeatedly.

Step-by-Step Solution

1
Analyze the frame types specified in the packet capture.
IEEE 802.11 Type 0 (Management) Subtype 12 frames explicitly define Deauthentication frames in the 802.11 wireless standard specifications.
Deauthentication frames instruct a recipient station that its wireless association is terminated, causing immediate client disconnection.
2
Evaluate the underlying vulnerability mechanism noted in the configuration.
Because 802.11w (Protected Management Frames / PMF) was configured as 'Optional', management frames were transmitted unauthenticated and unencrypted.
Without mandatory PMF enforcement, threat actors can spoof the BSSID source MAC address of the legitimate AP to forge teardown packets.
3
Correlate packet capture evidence with attack definitions to identify the correct threat.
A high volume of unauthenticated spoofed deauthentication frames causing repeated client dropouts is the classic indicator of a Wireless Deauthentication / Disassociation attack.
Enforcing mandatory 802.11w PMF ensures management frames are cryptographically secured, preventing attackers from forging deauthentication frames.

Key Concept

Wireless Deauthentication Attack Indicators & Protected Management Frames (802.11w)
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic