Bit-flipping Attack

  1. The attacker captures the frame and flips random bits in the data payload of the frame

  2. The attacker modifies the ICV (Integrity Check Value - CRC32) and transmits the modified frame

    • An original frame (F1) has an ICV (C1)

    • The attacker creates a new frame (F2) containing the bits to flip and computes its ICV (C2)

    • The attackers computes a new bit-flipped frame as F3=F1 XOR F2 and its new ICV C3=C1 XOR C2

  3. The receiver (a client or AP) receives the frame and calculates the ICV based on the frame contents and compares this value with the value in the ICV field of the frame - everything is ok - the receiver accepts the modified frame

  4. The receiver de-encapsulates the frame and processes the Layer 3 packet. Because bits are flipped in the layer packet, the Layer3 checksum fails and the receiver IP stack generates a predictable error

  5. The attacker sniffs the wireless LAN looking for the encrypted error message

  6. When the attacker receives the encrypted error message, he computes the key stream as with the IV replay attack