While browsing for techniques to protect against media level attacks, I found the 802.11w specification which protects management frames like deauth. This prevents an attacker from being able to kick clients off the network either to capture the WPA2 4-way handshake for password cracking or as a denial of service attack. https://en.wikipedia.org/wiki/IEEE_802.11w-2009
I saw that Mikrotik implements “Management frame protection” in the wireless settings, but according to the wiki “RouterOS implements proprietary management frame protection algorithm”. I am assuming that proprietary means that this is only compatible with other MT devices? Is there a chance to see the standardized 802.11w specification implemented as well? This would be a superior solution as standard wireless clients that support 802.11w such as laptops and phones would be able to benefit from the management frame protection and be resistant to deauth attacks and other nefarious behavior.
Bump - was wondering if there was any update or comment about this. With tools like WifiJammer[1] and scripts like [2] becoming more accessible, it’s becoming very easy for anyone with a laptop to cause havoc on networks that lack 802.11w. It wouldn’t surprise me if someone comes out with a USB Killer[3] style tool at some point to automate the process to a button press.
It’s getting far too easy to perform deauth attacks these days. Maybe someone should scatter some devices like this around Mikrotik HQ and then we will see a solution?
BTW: The wireless chips in MT devices should already have full support for this, just need to add it in software. “It is an optional feature in 802.11 and is required for 802.11 implementations that support TKIP or CCMP.” “The 802.11w standard is implemented in Linux and BSD’s as part of the 80211mac driver code base, which is used by several wireless driver interfaces; i.e., ath9k. The feature is easily enabled in most recent kernels and Linux OS’s using these combinations.”
No, really. It seriously stinks that it’s not supported yet. I’m going to keep deauth myself for next 2 months and complain that my RB2011 wifi doesn’t work as manifest.
