Attack on MAC randomized ap/client

[oayz-git]

Hi Mike, as you already mentioned randomization makes BPF useless and only way to attack is "full open". Can you think of something smart? For one I think hcxdumptool (HDT) can detect such case and either prompt user or disable BPF. Second idea depends on how often randomization happens. If not too often maybe HDT can detect new MAC and generate new BPF on the fly

[ZerBea]

At its core, MAC randomization is a method that changes the unique hardware address of wireless clients..
By periodically altering this identifier, devices can prevent tracking and profiling by third parties, enhancing user privacy in public and private wireless environments.
There is now way for hcxdumptool to detect or to prevent this.

[oayz-git]

As a client or AP? If client, can't we still filter by AP's MAC? Or the problem is us flooding channel with PROBEREQUEST and DEASSOCIATIONS? Maybe we somehow can limit the flood - detecting rapid MAC creation, limit PRBR and DA rates, especially broadcast ones. Anything else between BPF and nothing?
My neighborhood is getting oversaturated - on weekend I counted 44 AP's and 117 client. Feel bad being jerk with my experiments

[ZerBea]

You're doing something wrong.

Protect all 44 APs in range by BPF (not wlan addr 3). Than run hcxdumptool with this switches:

$ hcxdumptool -i wlan0 -w dump_$(date +"%s").pcapng --bpf=protect.bpf --associationmax=0 --m2max=1 --disable_disassociation -t 120 -c 1a,5a,9a,2a,6a,10a,3a,7a,4a,8a,11a

[oayz-git]

I do exactly that with BPF, even have a small script to convert captured MAC list into your "not wlan addr 3" :

_MACS="112233445566 112233445577 112233445588"
  LIST=""
  BOOL=" or "

for ADDR in $MACS; do
  LIST=$LIST"wlan addr3 $ADDR$BOOL "
done
LIST=${LIST:0:-${#BOOL}}_

So based on your suggestion we do can filter by AP's MAC and let clint to randomize its own. My worry was that AP can also randomize MAC. I think I have seen this but may be it was a hallucination

BTW, isn't filtering lots of APs by BPF can result in packets drop? IMHO BPF is done by CPU

P.S. Thanks for "--associationmax=0 --m2max=1 --disable_disassociation" will try later
P.P.S. Why channels in such an order. I do "-F" - not good?

[ZerBea]

APs do not(!) randomize their MAC.
BPF is handled by Kernel and running in kernel space. There is no impact on performance.

In attack mode, hcxdumptool does not send PROBEREQUESTs.

[ZerBea]

I suggest to run hcxdumptool using the command line switches as mentioned above.
Than run kimet in parallel on a second physical wlan interface.
I'm sure i does not detect hcxdumptool.