Users Guide

Dell PowerConnect W-Series ArubaOS 6.1 | User Guide Wireless Intrusion Prevention | 553
Detect FATA-Jack Attack Structure
FATA-Jack is an 802.11 client DoS tool that tries to disconnect targeted stations using spoofed authentication
frames that contain an invalid authentication algorithm number.
Detect Hotspotter Attack
The Hotspotter attack is an evil-twin attack which attempts to lure a client to a malicious AP. Many enterprise
employees use their laptop in Wi-Fi area hotspots at airports, cafes, malls etc. They have SSIDs of their hotspot
service providers configured on their laptops. The SSIDs used by different hotspot service providers are well
known. This enables the attackers to set up APs with hotspot SSIDs in close proximity of the enterprise premises.
When the enterprise laptop Client probes for hotspot SSID, these malicious APs respond and invite the client to
connect to them. When the client connects to a malicious AP, a number of security attacks can be launched on
the client. A popular hacking tool used to launch these attacks is Airsnarf.
Detect Meiners Power Save DoS Attack
To save on power, wireless clients will "sleep" periodically, during which they cannot transmit or receive. A client
indicates its intention to sleep by sending frames to the AP with the Power Management bit ON. The AP then
begins buffering traffic bound for that client until it indicates that it is awake. An intruder could exploit this
mechanism by sending (spoofed) frames to the AP on behalf of the client to trick the AP into believing the client
is asleep. This will cause the AP to buffer most, if not all, frames destined for the client.
Detect Omerta Attack
Omerta is an 802.11 DoS tool that sends disassociation frames to all stations on a channel in response to data
frames. The Omerta attack is characterized by disassociation frames with a reason code of 0x01. This reason code
is “unspecified” and is not be used under normal circumstances.
Detect Rate Anomalies
Many DoS attacks flood an AP or multiple APs with 802.11 management frames. These can include authenticate/
associate frames which are designed to fill up the association table of an AP. Other management frame floods,
such as probe request floods, can consume excess processing power on the AP.
Detect TKIP Replay Attack
TKIP is vulnerable to replay (via WMM/QoS) and plaintext discovery (via ChopChop). This affects all WPA-
TKIP usage. By replaying a captured TKIP data frame on other QoS queues, an attacker can manipulate the RC4
data and checksum to derive the plaintext at a rate of one byte per minute.
By targeting an ARP frame and guessing the known payload, an attacker can extract the complete plaintext and
MIC checksum. With the extracted MIC checksum, an attacker can reverse the MIC AP to Station key and sign
future messages as MIC compliant, opening the door for more advanced attacks.
Detect Unencrypted Valid Clients
An authorized (valid) client that is passing traffic in unencrypted mode is a security risk. An intruder can sniff
unencrypted traffic (also known as packet capture) with software tools known as sniffers. These packets are then
reassembled to produce the original message.
Detect Valid Client Misassociation
This feature does not detect attacks, but rather it monitors authorized (valid) wireless clients and their
association within the network. Valid client misassociation is potentially dangerous to network security. The four
types of misassociation that we monitor are:
 Authorized Client associated to Rogue—A valid client that is associated to a rogue AP
 Authorized Client associated to External AP—An external AP, in this context, is any AP that is not valid and
not a rogue