Because all traffic reaching the attacker (from the AP) is encrypted with the attacker's PTK, the attacker can decrypt the traffic (including login credentials, emails and other sensitive data). The AP will decrypt the traffic and forward it to the attacker, now encrypting it using the attacker's PTK. All clients that receive this message will update their ARP table - mapping the attacker's MAC address with the gateway's IP address.Īll "poisoned" Wi-Fi clients will send all their traffic, encrypted with their respective private keys (PTKs), to the AP, but with the attacker's MAC address as the destination. The ARP Request has the IP address of the actual gateway, but the MAC address of the attacker's machine.
In the ARP poisoning exploit, the insider can include for instance an ARP Request message inside the GTK-encrypted packet. One example of an exploit that can be launched using GTK is the classic ARP poisoning (man-in-the-middle) attack (demonstrated at Black Hat Arsenal 2010 and Defcon18). In a WPA2 network, a malicious insider broadcasts fake packets (with the AP's MAC address as the transmitter's address) encrypted using the shared group key (GTK) directly to other authorized Wi-Fi clients in the network. AirTight has an article that does a great job of explaining exactly what Hole 196 is, and (pasted below) how it can be exploited so that Eve can sniff WPA2 traffic as if it were in the clear. So, for WPA2 networks, FaceNiff is most likely exploiting "Hole 196". An attacker would have to know the security password, however.
The app works even on networks protected by WPA and WPA2 encryption schemes by using a technique known as ARP spoofing to redirect local traffic through the attacker's device. The packets are now effectively cleartext to Eve.Īccording to an article at The Register, it would seem that ARP poisoning is indeed involved.
Clients send packets encrypted with their private keys (PTKs) to the AP, but addressed to Eve.Clients register Eve's MAC address as their new gateway.Eve uses the Group Temporal Key (GTK) to inject ARP packets into the network, with the network's gateway IP paired to her MAC address.TL DR: FaceNiff probably exploits WPA's "Hole 192" and uses ARP poisoning to set up a Man-in-the-Middle attack.
0 kommentar(er)
