Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A security analyst reviews alert logs from a Wireless Intrusion Detection System (WIDS) deployed at a corporate headquarters. The WIDS flagged an anomaly where a single access point MAC address is sending immediate 802.11 Probe Response frames to every nearby device broadcasting Probe Requests, automatically matching whatever Service Set Identifier (SSID) the client requests—including 'Airport_Free_WiFi', 'Hotel_Guest', and 'Home_Network'. Which of the following attack types is indicated by this wireless behavior?

  1. Karma attackAnswer
  2. B
    Initialization Vector (IV) attack
  3. C
    Disassociation attack
  4. D
    Radio Frequency (RF) Jamming

Answer

Karma attack
The correct answer identifies a Karma attack. In a Karma attack, a rogue access point exploits the behavior of wireless devices broadcasting probe requests for SSIDs in their Preferred Network List (PNL). The attacker's AP responds to every probe request claiming to be the exact network the client is seeking, enticing the device to connect automatically.

Step-by-Step Solution

1
Analyze the observed wireless frame behavior in the WIDS log
The rogue device responds to client probe requests by dynamically adopting whichever SSID the requesting device searches for.
Wireless client devices maintain a Preferred Network List (PNL) and broadcast probe requests searching for known networks.
2
Differentiate Karma attacks from general rogue APs or deauthentication attacks
Karma specifically exploits client probe request broadcasts by spoofing responses for any SSID, causing clients to auto-connect to the rogue AP.
This behavior directly defines the signature mechanism of a Karma attack.

Key Concept

Karma Attack Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic