802.11 Wireless Attacks  Home ToC Prev Up Next 
802.11
Attacks
O/S/M Vulnerabilities
WEP Encryption
Passive Attacks
Active Attacks
IV Reply Attack
+Bit-flipping Attack
ManInTheMiddle
MITM Attack
Cisco LEAP
LEAP weaknesses
LEAP attack
ICV issue
Passive WPA PSK
WPA PSK attacks
PSK attack tools
Conclusion
  

Bit-flipping Attack

  1. The attacker captures the frame and flips random bits in the data payload of the frame

  2. The attacker modifies the ICV (Integrity Check Value - CRC32) and transmits the modified frame

    • An original frame (F1) has an ICV (C1)

    • The attacker creates a new frame (F2) containing the bits to flip and computes its ICV (C2)

    • The attackers computes a new bit-flipped frame as F3=F1 XOR F2 and its new ICV C3=C1 XOR C2

  3. The receiver (a client or AP) receives the frame and calculates the ICV based on the frame contents and compares this value with the value in the ICV field of the frame - everything is ok - the receiver accepts the modified frame

  4. The receiver de-encapsulates the frame and processes the Layer 3 packet. Because bits are flipped in the layer packet, the Layer3 checksum fails and the receiver IP stack generates a predictable error

  5. The attacker sniffs the wireless LAN looking for the encrypted error message

  6. When the attacker receives the encrypted error message, he computes the key stream as with the IV replay attack
Copyright © 2005 Pavol Lupták, OpenWeekend 2005  Prev Next