Aircrack-ng: Why deauth works

Question

When using aircrack to attack WPA, deauth packets are used to force a host to deauthenticate. But the machine sending these deauth packets is not even connected to the network. How possible is it that the AP accepts packets from a machine not connected to it? In other-wards, why would an AP or end host accepts de-authentication requests from arbitrary senders who are not even connected to the network?

Answer 1

AP accepts packets from a machine not connected to it from arbitrary senders

Normally, deauthentication [and other management] frames don't have to be encrypted (i.e. require an existing authenticated 'connection' between the AP and the client). Therefore, they can be spoofed.

The way to protect against this kind of attack is to use Management Frame Protection (check out http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/82196-mfp.html#climfp):

Specifically, client MFP encrypts management frames sent between access points and CCXv5 clients so that both access points and clients can take preventive action and drop spoofed class 3 management frames (that is, management frames passed between an access point and a client that is authenticated and associated). Client MFP leverages the security mechanisms defined by IEEE 802.11i to protect these types of class 3 unicast management frames: disassociation, deauthentication, and QoS (WMM) action.

What are the legitimate uses for deauth frame?

In addition to just that, termination of the secure communication (e.g. 'Forget this network'), there are a few possible reasons specified by 802.11, like these (reason/description):

• 2 - Previous authentication no longer valid
• 3 - Station is leaving (or has left) IBSS or ESS
• 4 - Disassociated due to inactivity

(you can read more at, for example, https://supportforums.cisco.com/document/141136/80211-association-status-80211-deauth-reason-codes or )

Why is it that Access Points do not implement these Management Frame Protection mechanisms?

It is available in many APs, but usually "Optional" by default, to prevent client connectivity issues. You can read more in this answer: 802.11w protected management frames - Wi-Fi

Personally, I think that it is not such a big deal, because (a) strong PSKs make bruteforcing long and non-so-effective, (b) you can just wait for a legitimate client to leave and come back to catch the handshake. I.e. it makes it harder to get in, but doesn't prevent the possibility.