Hello and welcome this video titled PMF and SA queries.
In this particular video we're going to be talking about specific aspects
of protected management frames that protects clients and access points
against malicious actors attempting to spoof a client and associate.
So let's go into the details here.
So prior to protected management frames and if you remember this is a
brief recap of protected management frames we learned that in a previous
video that there are certain management frames called robust management
frames such as deauthentication, disassociation and action frames.
And protected management frames was designed to so that the access point
could add a MIC, a message integrity code to those frames so that when
a receiver received them like your wireless client it had the warm fuzzies
that that frame had actually come from a legitimate access point and not
a malicious actor acting as a rogue access point.
So this is something that comes with protected management frames.
So when you enable protected management frames this comes with it.
It's already on by default although there are a couple of timers that
you're going to tweak with it and that's what we're going to look at here.
So before protected management frames existed if you were already associated
so let's talk about like WPA2 or even the older original WPA.
If you a legitimate client were associated to your access point and then
a malicious actor came along did some Wi-Fi spoofing discovered your MAC
address, changed their own MAC address to look exactly like yours and
then they sent an association request to the access point it would actually
result in the access point kicking you off of the wireless LAN and so
this is how that worked.
So here we have an existing security association an existing association
between the access point and the station then all of a sudden the malicious
actor like to talk about changed their MAC address to look exactly like
yours and they send their own association request.
Well at this point the access point is going to get a little confused
it's going to say wait a second this person's already associated I thought
hmm maybe something happened they got booted off and now they're associating
again so the access point's response would be to connect to terminate
the connection so the legitimate Wiles LAN client all of a sudden just
lost their Wi-Fi connectivity and then in the second or two it takes them
to connect again the malicious actor could then successfully associate
to the wireless LAN.
Now fortunately for us when you turn on protected management frames which
is required for WPA3 it has a built-in mechanism which this video is about
to prevent that type of thing.
So here's how this works.
So with protected management frames you've got two mechanisms you have
an association comeback timer and an SA query procedure both of these
were designed to prevent that type of attack I just showed you.
Let's first of all talk about the association comeback timer.
So the way this works is let's say an association request is received.
So the now the access point or the wireless LAN controller either or is
going to check to see if there's currently an association already from
that same client from that same MAC address.
If there is instead of just kicking that client off it will actually send
a response back to that association request in an association response
basically denying it and saying with a status code of 30 and saying please
come back later and this is actually what it looks like here in a stiffer
trace I'm sorry that's a little fuzzy here I couldn't get a clear screenshot
than this but you can see up in the top that this says association response
so this is coming from the access point status code association request
rejected temporarily try again later and the status code is 30 you can
see 1e and hex is equal to 30 and then down below it actually says this
is a result of the association comeback time it says you can try again
in now this is in milliseconds so this would be one second or 1000 milliseconds
now that timer right there is what you can configure at least on the Cisco
9800 wireless LAN controllers I'll show you how you can set that timer
to a different value if you wish.
Okay now there's another thing that happens once that association comeback
timer starts on the access point and says okay I'm not going to allow
any more association requests from this particular client during that
time it also says hmm maybe I should check to see if the actual client
is really still connected to me or not and that's what the purpose of
this is so the security association queries so once that association comeback
timer begins and remember the whole reason that started is because somebody
was trying to spoof you and they sent an association request and the access
point said I've already got one for that guy or that girl so it started
the association comeback timer now the second it starts that it also sends
a message to the client the legitimate client that's really associated
called an SA query request now this is within a specific action frame
you know which is a management frame so this falls under protected management
frames an action frame is a robust management frame type and this is the
access points way of saying hey client are you really still here I think
you are I have an association with you but are you really here and there's
a timer called the SA query interval so this is our second timer now it's
shorter obviously than the association comeback timer and the client if
he really is associated the legitimate one has to respond back with an
SA query response so the the data within these frames within the SA query
request and the SA query response remember this is unicast between the
access point and the legitimate client and so we are going to use protected
management frames to protect that actually we're going to protect it actually
encrypting it so in this case the tk the temporal key that was created
when that client first associated and went through the eep over land handshake
is going to be used to encrypt these requests and response frames and
so here's an example of what this looks like so once again our client
has a valid association and in comes the malicious actor attempting to
spoof it in this case the malicious actor will get back that association
response saying rejected try again later now soon that happens the association
comeback time starts we saw in the previous slide that that was 1000 milliseconds
or one second but that's configurable and then when that starts the SA
query time will start as well which is less during that SA query time
the access point sends to the legitimate client an SA query request and
hopefully if that client really is there and really is associated it will
send an SA query response now once that association comeback timer expires
the malicious actor could always try again and this process would repeat
itself so we can see here that there this type of attack while the malicious
actor may have had the original intent of using this to try to kick off
a legitimate Wi-Fi client maybe the malicious actor isn't even really
concerned about actually connecting to the Wi-Fi I mean after all the
malicious actor might not have the pairwise master key or the shared secret
or anything his sole intention is to try to kick off a legitimate client
and that's why he's doing it so with this he won't be able to kick off
the client but there is a downside what if that malicious actor decides
you know what i'm just going to keep doing this every second or every
half second or something i'm just gonna i'm gonna set up some automated
thing that mimics this client here you know maybe this client is my CEO
and i don't really like my CEO so i'm going to mimic his MAC address her
MAC address and i'm just gonna send association requests like every 500
milliseconds or something over and over and over again well think about
what's happening in the background it's going to be taking some CPU processing
power and some memory on behalf of the access point and the client the
legitimate client to go through all this because that access point is
going to have to be continually sending these association response denied
doing the essay query requests then the client is going to constantly
send an essay query response so if this is happening over and over and
over again it could actually exhaust some resources in the access point
and the client and maybe slow down the actual transmission of legitimate
Wi-Fi frames so this could be used in that sense as sort of a crude form
of a denial of service attack so there's nothing you can really do about
that but at least the client is not actually getting kicked off of the
wireless LAN so last thing i want to show you is how in the 9800 how you
can manage this how you can configure it so like i said when you turn
protected management frames to required this feature is already there
now this is in this is under the edit wireless LAN obviously and you can
see here here's the two timers so by default the association comeback
timer will be one second and the essay query timer will be 200 milliseconds
however you can see here within the association of comeback timer you've
got a range not a big range but a range of one to 20 seconds and the essay
query timer you've got from 100 to 500 milliseconds so if you're concerned
about a malicious actor maybe descending spoofed association requests
over and over and over again and driving up resource usage maybe what
you want to do is take this association comeback timer and increase it
from one second to maybe 10 or 15 seconds if you do that then not nearly
as many essay queries and essay replies will have to be generated so that
concludes this video thank you so much for watching and i hope it was