Examkin

Question

Difficulty: Very hardNetwork and Wireless Attack Indicators

A wireless intrusion prevention system (WIPS) generates a high-severity alert for a mobile workstation located on an enterprise campus. The event log records that an unauthorized device is transmitting targeted unicast 802.11 Probe Response frames matching multiple distinct entries from the workstation's Preferred Network List (PNL). Immediately following the probe responses, the unauthorized device initiates an EAP-TTLS handshake and requests legacy authentication credentials. Which of the following attack mechanisms is most accurately represented by these indicators?

  1. A Karma attack utilizing passive probe request harvesting to spoof trusted SSIDs and intercept enterprise authentication credentials.Answer
  2. B
    An Initialization Vector (IV) reuse attack manipulating packet keystreams to derive the WPA2-Enterprise pre-shared encryption key.
  3. C
    A radio frequency (RF) jamming attack emitting high-power signals to force connected clients onto a secondary unencrypted fallback channel.
  4. D
    A wireless disassociation flood utilizing spoofed management frames to force all campus endpoints to re-authenticate with the primary RADIUS server.

Answer

A Karma attack utilizing passive probe request harvesting to spoof trusted SSIDs and intercept enterprise authentication credentials.
The correct answer accurately identifies a Karma attack. Mobile wireless devices broadcast 802.11 Probe Requests containing SSIDs from their Preferred Network List (PNL) to locate known Wi-Fi networks. In a Karma attack, a rogue access point listens for these requests and immediately responds with unicast Probe Responses matching whichever SSID the client requested. Once the client auto-connects under the assumption that it is reaching a trusted network, the rogue AP initiates authentication exchanges (like EAP-TTLS) to harvest user credentials.

Step-by-Step Solution

1
Analyze the log indicators provided in the scenario.
Identified unicast Probe Responses matching multiple SSIDs from the client workstation's Preferred Network List (PNL), followed by EAP authentication requests.
Client wireless devices periodically broadcast Probe Requests containing SSIDs of previously connected networks stored in their PNL.
2
Correlate the observed frame behavior with wireless attack profiles.
A rogue access point running a Karma attack framework captures these probe requests and dynamically advertises itself as any network requested by the client, inducing automatic client association.
Karma attacks exploit client auto-connect behavior based on PNL probe probing.
3
Evaluate the subsequent credential request indicator.
Once connected to the spoofed SSID, the rogue AP initiates an inner EAP authentication exchange (such as EAP-TTLS/PAP) to capture domain credentials in cleartext or weak hashed format.
This confirms the attacker's motive is unauthorized credential harvesting via rogue AP association.

Key Concept

Karma Attack and Probe Request Harvesting Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic