Detecting Wireless LAN MAC Address Spoofing
Detecting Wireless LAN MAC Address Spoofing
复制标题
检测无线 LAN MAC 地址欺骗
DOI：
--
复制
发表时间：
2003
期刊：
影响因子：
--
通讯作者：
Joshua Wright
中科院分区：
文献类型：
--
作者：
Joshua Wright
想要破坏无线网络的攻击者有大量的武器可用。其中许多工具依赖于使用伪造的MAC地址，伪装成授权的无线接入点或授权的客户端。使用这些工具，攻击者可以发起拒绝服务攻击、绕过访问控制机制或向无线客户端虚假通告服务。这为针对难以检测的无线网络的攻击提供了独特的机会，因为攻击者可以通过使用更改的MAC地址将自己伪装成授权客户端。由于几乎所有无线网卡都允许通过供应商提供的驱动程序、开源驱动程序或各种应用程序编程框架将其MAC地址更改为任意值，因此攻击者对目标无线局域网造成严重破坏是微不足道的。本文描述了攻击者利用MAC地址欺骗来破坏无线网络的一些技术，并以捕获的由AirJack、FakeAP和Wellenreiter工具生成的流量为例进行了演示。通过对这些痕迹的分析，作者确定了可用于检测使用欺骗MAC地址的应用程序的技术。有了这些信息，无线设备制造商可以实施基于异常的入侵检测系统，该系统能够识别MAC地址欺骗，以向管理员发出针对其网络的攻击警报。
An attacker wishing to disrupt a wireless network has a wide arsenal available to them. Many of these tools rely on using a faked MAC address, masquerading as an authorized wireless access point or as an authorized client. Using these tools, an attacker can launch denial of service attacks, bypass access control mechanisms, or falsely advertise services to wireless clients. This presents unique opportunities for attacks against wireless networks that are difficult to detect, since the attacker can present himself as an authorized client by using an altered MAC address. As nearly all wireless NICs permit changing their MAC address to an arbitrary value – through vendor-supplied drivers, open-source drivers or various application programming frameworks – it is trivial for an attacker to wreak havoc on a target wireless LAN. This paper describes some of the techniques attackers utilize to disrupt wireless networks through MAC address spoofing, demonstrated with captured traffic that was generated by the AirJack, FakeAP and Wellenreiter tools. Through the analysis of these traces, the author identifies techniques that can be employed to detect applications that are using spoofed MAC addresses. With this information, wireless equipment manufacturers could implement anomalybased intrusion detection systems capable of identifying MAC address spoofing to alert administrators of attacks against their networks.