more on New flaw takes Wi-Fi off the air

[Dave Farber <dave () farber net>]

Delivered-To: dfarber+ () ux13 sp cs cmu edu
Date: Fri, 14 May 2004 07:23:37 -0700
From: Jim Thompson <jim () netgate com>
Subject: Re: [IP] more on New flaw takes Wi-Fi off the air
To: dave () farber net

Um, no, I don't think it has anything to do with OFDM's "sub-carriers".

The authors haven't described the attack, exactly, I believe, because there 
is a paper coming out in a couple days, and there are pre-publication 
issues.  That stated, the Australian CERN report does provide clues.  The 
"problem isn't as bad with 802.11g or 802.11a at speeds over 20Mbps" may 
provide a hint.

The "vulnerability" may have to do with the longer slot time of DSSS 
modulation in 802.11b (20us) in comparison to that in OFDM modulations 
(9us) of 802.11a, and, in particular, values derived from the slot time,
such as DIFS (50us)

802.11b:
        •       SIFS = 10 µs
        •       Slot time = 20 µs
        •       DIFS = 2 x Slot time + SIFS = 50 µs

802.11a:
        •       SIFS = 16 µs
        •       Slot time = 9 µs
        •       DIFS = 2 x Slot time + SIFS = 34 µ

 802.11g SIFS = 10 µs
 802.11g short slot time = 9 µs (802.11g-only mode with no legacy stations)
 802.11g long slot time = 20 µs (mixed mode requires slow slot time)
(I'll leave it to the reader to calculate DIFS for each of the two 11g 
modes  (2 x slot time + SIFS))

Now, whats the throughput for 54Mbps station in a mixed-mode 802.11b/g 
network?  Well, with an 802.11b station associated, but idle (such that 
protection is enabled, but the 11b STA isn't tying up the air), the 
(calculated)UDP throughput is .. 19.6Mbps.  So once you're "over 20Mbps" 
then you don't have any 11b STAs associated.  And lets not forget that 
these protection frames have to be sent modulated with DSSS (so the 11b 
stas can grok them), and thus, it "only affects DSSS" (ahem).

BTW max theoretic TCP throughput for 11g with a 11b client associated to 
the AP is around 13.5Mbps (if the AP and STA are both sending @ 54Mbps,)

Its not proof, but it does 'fit', given what they've released.  I'll also 
guess out loud that the 'attack' has to do with setting (or resetting) 
CWmin (15us for 11a/11g, 31us for 11b), an causing overly-long NAVs to be set.

Again, this is just off the top of my head (and from memory).  And all of 
the above is DCF, not PCF or EDCF.  If your readers don't understand the 
terms here, google can be of help.

Jim


On May 14, 2004, at 6:08 AM, Dave Farber wrote:


> Delivered-To: dfarber+ () ux13 sp cs cmu edu
> Date: Fri, 14 May 2004 01:50:44 -0400
> From: Valdis.Kletnieks () vt edu
> Subject: Re: [IP] New flaw takes Wi-Fi off the air
> To: dave () farber net
>
> On Thu, 13 May 2004 19:25:28 EDT, Dave Farber <dave () farber net>  said:
>
> > "When under attack, the device behaves as if the channel is always busy,
> > preventing the transmission of any data over the wireless network," a
> > security advisory (http://www.auscert.org.au/render.html?it=4091) released
> > by AusCERT reads.
>
> It's hardly a "newly discovered" flaw.  It's been known for several decades
> that CSMA/CA based networks will fail if something interferes with the
> detection of "quiet" on the network.
>
> Anybody who's ever had to find a jabbering transciever or a missing terminator
> on an Ethernet thin/thickwire segment knows about this "flaw".
>
> My favorite part was that they *first* mention that you can do this jamming
> with very little hardware - so you can hack up even a PDA's software to make
> its wireless card jabber.  Then in what appears to be a classic case of
> Just Not Getting It, they add:
>
>         The model of a shared communications channel is a fundamental
>         factor in the effectiveness of an attack on this vulnerability.
>         For this reason, it is likely that devices based on the newer IEEE
>         802.11a standard will not be affected by this attack where the
>         physical layer uses Orthogonal Frequency Division Multiplexing
>         (OFDM).
>
> Yes, *this* attack won't work against a .11a network because the signal is
> split across some 48 subchannels.
>
> Obviously, getting a PDA that has an 802.11a card and hacking it to jabber
> across all 48 subchannels (and remember - for the card to talk .11a it has to
> have the circutry to transmit on the subchannels)... that's considered a
> different attack.
>
> -------------------------------------
> You are subscribed as jim () netgate com
> To manage your subscription, go to
>  http://v2.listbox.com/member/?listname=ip
>
> Archives at: http://www.interesting-people.org/archives/interesting-people/


-------------------------------------
You are subscribed as interesting-people () lists elistx com
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/