# Multi-channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks and Their Attack Signatures

Manesh Thankappan, Helena Rifà-Pous, Carles Garrigues

► To cite this version:

Manesh Thankappan, Helena Rifà-Pous, Carles Garrigues. Multi-channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks and Their Attack Signatures. 7th International Conference on Computer, Communication, and Signal Processing (ICCCSP), Jan 2023, Chennai, India. pp.269-285, 10.1007/978-3-031-39811-7_22. hal-05363238

HAL Id: hal-05363238

https://inria.hal.science/hal-05363238v1

Submitted on 13 Nov 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Multi-channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks and Their Attack Signatures

Manesh Thankappan<fnref n="1" />(✉) ID, Helena Rifà-Pous<fnref n="1" />,<fnref n="2" /> ID, and Carles Garrigues<fnref n="1" />,<fnref n="2" /> ID

**Abstract.** Multi-Channel Man-in-the-Middle (MC-MitM) attack is an advanced form of MitM attack that can manipulate protected wireless communication between the Access Point (AP) and connected clients in a wireless network. Frontline MC-MitM attacks in recent years include Key Reinstallation Attacks (KRACK) reported in 2017 and the FragAttacks reported in 2021. Such attacks affected millions of wireless devices, particularly those associated with the Internet of Things (IoT) systems due to faculty implementations of the standard. Despite the fact that there are security updates available to defend against specific attacks, significant issue is that most of the IoT and Wi-Fi devices do not comply with them. Existing security mechanisms to combat MC-MitM attacks are unfeasible since they demand firmware upgrades on all network devices or use of complicated hardware and software for deployment. In this paper, we empirically develop lightweight attack signatures capable of passively and quickly identifying various MC-MitM attacks without altering any existing protocols or devices.

**Keywords:** WLAN · MitM · Wi-Fi · WPA · MitM · MC-MitM · KRACK · FragAttacks · IoT · attack signature

## 1 Introduction

WLANs (Wireless Local Area Networks) are prone to a wide array of cyberattacks. MitM attacks represent a critical threat to WLANs, which allows the attacker to listen in on, alter, or spoof either of the two parties. This type of attack typically involves using two wireless cards, one being associated with his own AP or legitimate AP, and the other acting like a rogue AP by spoofing the legitimate one. Wireless clients can connect such rogue APs through the built-in automatic access point choosing function. In a WLAN, there are typically two methods for carrying out MitM attacks.

The first method, which we mention as a “traditional rogue AP MitM attack,” involves launching a rogue AP that deceives clients to associate with it using an already-known or familiar wireless password. In order to manipulate the encrypted communication

<footnote n="1">¹ Estudis d'Informàtica Multimèdia i Telecomunicació, Internet Interdisciplinary Institute (IN3), Universitat Oberta de Catalunya (UOC), Barcelona, Spain {mthankappan,hrifa,cgarrigueso}@uoc.edu</footnote>

<footnote n="2">² Center for Cybersecurity Research of Catalonia (CYBERCAT), Barcelona, Spain</footnote>
between the AP and victims, such traditional rogue AP attacks thus require the attacker to know the wireless password in advance. Traditional rogue AP MitM attacks are often done with tools like Fluxion [1] and WiFi-Pumpkin [2]. Furthermore, if the wireless password is unknown, the above tools are used to conduct MitM attacks against unprotected or open wireless traffic. The second method, on which we are focusing this research, is the Multi-Channel MitM attack [3]. The attack also uses two wireless cards, but they are on different channels and create a fake connection between the victim client and the legitimate AP. This allows the MC-MitM attack to tamper encrypted wireless communication between them on the fly without knowing a wireless password. In MC-MitM attacks, the legitimate AP is cloned on a new distinct channel. This lets the attacker to exchange beacon, probe response, and connection establishment (such as authentication, association and 4-way handshake) frames between both channels (i.e., new and operating channels) at the same time, so they communicate and manipulate subsequent data frames between the AP and victims. The attacker obtains the MC-MitM position by employing either unique jamming techniques (which are hereafter referred to as base variants) or channel switch announcement (which are referred to as improved variants) to trick the victims to direct to his channels.

The key reinstallation attack (KRACK) is the most impactful and popular base variant MC-MitM attack. KRACK exploits vulnerability in IEEE 802.11 standard's (e.g., WPA/2) 4-way handshake mechanisms [4]. An attacker can exploit these vulnerabilities to decode/decrypt wireless frames, particularly from Android or Linux devices that support WPA or WPA2. FragAttacks is a recent non-vendor-specific attack series performed using the MC-MitM [5]. With FragAttacks, the attacker exploits a set of authentication flaws in the fragmentation and aggregation procedures of the 802.11 standards by injecting frames into protected wireless networks for tricking the client into using a malicious web server, and then obtaining sensitive client information. Such exploitations also affect the WPA3 standard. Most notably, millions of wireless enabled devices are at risk of these non-vendor-specific vulnerabilities due to faulty implementations of the standard. In our paper [6], we provide an in-depth evaluation of capabilities of different MC-MitM attacks.

In response to KRACK and FragAttacks, the Wi-Fi Alliance released security patches. In spite of the existence of these patches, the main concern is that they cannot be applied to every wireless device, especially IoT device due to the issues such as resource limitations, deprecated security mechanisms, deceased device support duration. Over 75% of wireless devices remain vulnerable to the KRACK vulnerability even four years after its disclosure [7]. The FragAttacks once again posed significant security challenges for wireless devices and IoT systems. It is expected that devices will be vulnerable in the following years as a result of a lack of security fixes for FragAttacks.

Besides providing security patches, the Wi-Fi alliance mandated the use of PMF (Protected Management Frame) standard [8] to ensure wireless communication integrity protection, particularly against spoofed deauthentication and disassociation based MitM attacks. In contrast, MC-MitM attacks do not use deauthentication attacks, but instead make use of certain management frames (e.g., beacons or probe frames), which PMF does not protect, thus allowing attackers to circumvent the PMF. In order to protect sensitive communications over WLANs, perimeter security measures, such as firewalls
and VPNs, are commonly used. Firewalls and VPNs work at higher layers, so they cannot detect MC-MitM attacks that target individual wireless clients, as such attacks exploit weaknesses in the data link layer.

MC-MitM attacks pose a challenge because the attackers behave as normal as an AP in WLANs. While acquiring the MitM position, he does not flood the wireless by disas- sociation/deauthentication packets or perform any other suspicious actions. MC-MitM attackers create a particular type of jamming using cheap wireless dongles to take the MitM settings, which can be relatively difficult for existing intrusion detection systems to detect. [3, 9]. This is due to the fact that the MC-MitM attack emits noise signals arbi- trarily while jamming, which could be wrongly treated as non-wireless devices operating in the same frequency range.

The above scenarios make it difficult to correctly differentiate between MC-MitM attacks. Researchers have proposed some security mechanisms [10, 11]. In general, these security mechanisms are designed to cryptographically authenticate wireless channels or beacons so as to detect potential intrusions. Furthermore, such security mechanisms can be employed only if every device belonging to a WLAN is compatible with them. Moreover, they are heavily dependent upon modified standards, especially PMF. This strict security requirement unfeasible in Wi-Fi networks, particularly IoT scenarios. In some security mechanisms [9], anomalies are identified using identities of AP, such as network name (SSID) and MAC address (BSSID). Nevertheless, such mechanisms are more expensive due to the need for sophisticated software or devices, as well as multiple protocol modifications. Our paper [6] provides a detailed feasibility study of existing defense mechanisms. Therefore, it is necessary to develop a mechanism with some prudent decision-making intelligence to detect MC-MitM attacks in real-time and be lightweight enough to be deployed in IoT environments. In this paper, we identify potential parameters to recognize different MC-MitM attack signatures and analyze the feasibility to deploy lightweight MC-MitM detection.

## 2 Background

In this section, we briefly describe the inner workings of different MC-MitM attacks.

### 2.1 MC-MitM Attack Setup

The primary goal of MC-MitM attacks is to get the MitM position between the targeted client and the AP while preserving the original security association, and then exchange and manipulate encrypted traffic between them.

Figure 1 demonstrate how the MC-MitM attacker clones end devices (the AP and the client) on opposing side channels in order to establish a fake connection between them.

To gain the MitM position, it is necessary to force the victim to switch to his channel by jamming or issuing channel switch announcement (CSA). An attacker forces the client by broadcasting legitimate AP beacons that have been collected through channel A. While receiving those beacon frames on channel B, a client determines that it is previously associated in accordance with the preferred network list (PNL) and thereby
<figure><img src="image_3.png" /><figcaption>Fig. 1. MC-MitM attack setup</figcaption></figure>

transmitting a probes on the chosen SSID. In response, the attacker sends (using rogue AP) a forged probe response targeting the victim on channel B, causing it to transmit authentication request frames on channel B. On the other hand, the rogue AP acquires such authentication request frames and retransmits them with the help of the rogue client on channel A. This results in the legitimate AP transmitting authentication response frames on channel A, whereas the rogue client acquires and retransmits them on channel B. (see Fig. 2a). Similarly, association frames are exchanged as depicted in Fig. 2b.

Following the exchange of association frames, the legitimate AP initiates a four-way handshake involving four EAPOL messages. Figure 2c illustrates how the MC-MitM attacker acquires the respective EAPOL messages from the source channel and retransmits them on the destination channel. While the attacker exchanges those handshake messages between two channels, they have a correct Message Integrity Check (MIC) when handled by the legitimate AP. Consequently, on their respective sides, the AP and client negotiate a similar and new session key (PTK). This session key is being used to encrypt data or communication between victim and the AP. As of now, the MC-MitM attacker subsequently hand over those encrypted data amid channels (see Fig. 3). This allows the attacker to reliably manipulate, i.e., blocking, delaying, modifying, injecting, replaying) encrypted frames amid end devices.

Moreover, the attacker uses the fake connection (see Fig. 1) to exchange encrypted wireless data in order to prevent the client and legitimate AP from communicating directly. The exchange of frames between channels is possible regardless of the authentication method with the AP. It is therefore possible to use MC-MitM attacks in both personal and enterprise Wi-Fi networks. Most importantly, it should be noted that the MC-MitM attack does not necessarily violate encryption protocols but rather makes use of specific vulnerabilities (e.g., in encryption or authentication) in IEEE 802.11 standards to obtain sensitive data.

Based on the tactics to force the client to change its channel, we categorize MC-MitM attacks into two variants: the base variant and the improved variant.

## 2.2 MC-MitM Base Variant Attack

Vanhoef and Piessens [3] introduced the MC-MitM base variant attack in 2014. Figure 4 demonstrates the working of a base variant MC-MitM attack.

This variant uses two types of jamming techniques: constant jamming and reactive jamming. Constant jamming blocks traffic on a target channel entirely, whereas reactive
<figure><img src="image_4.png" /><figcaption>(a)</figcaption></figure>

<figure><img src="image_5.png" /><figcaption>(b)</figcaption></figure>

<figure><img src="image_6.png" /><figcaption>(c)</figcaption></figure>

**Fig. 2.** Attacker exchanges: (a) authentication frames; (b) association frames; (c) EAPOL messages. The blue arrows indicate frames that are being acquired, and the red arrows indicate frames that are being retransmitted. Order of exchange is indicated by numbers on arrows. (Color figure online)

<figure><img src="image_7.png" /></figure>

**Fig. 3.** Attacker exchanges the data frames. The blue arrows indicate data frames that are being acquired, and the red arrows indicate data frames that are being retransmitted. Order of exchange is indicated by numbers on arrows. (Color figure online)
<figure><img src="image_8.png" /><figcaption>Fig. 4. MC-MitM base variant attack.</figcaption></figure>

jamming jams specific frames (e.g., beacons or probe responses) by making them mal-
formed. In the literature, [3, 4, 12, 13] are some MC-MitM-BV attacks using constant
jamming, whereas [9] uses an MC-MitM using reactive jamming.

## 2.3 MC-MitM Improved Variant Attack

Vanhoef and Piessens [14] further proposed an improved variant of the MC-MitM attack using CSAs in 2018, which is more effective than the MC-MitM-BV attack. Figure 5 demonstrates the working of an improved variant MC-MitM attack. By using CSA, the cost and effort of jamming can be reduced significantly. In addition, only a few CSAs are required to execute the attack (four or five, as per the standards). CSAs are more effective since they represent AP’s actions while receiving radar pulses that cannot be rejected by clients.[5, 15] are some notable examples of improved variant attacks.

<figure><img src="image_9.png" /><figcaption>Fig. 5. MC-MitM improved variant attack.</figcaption></figure>

In our paper [6], we extensively examined various MC-MitM attacks reported in the literature, as well as their potential impacts on Wi-Fi and IoT devices.

## 3 MC-MitM Attack Traffic Analysis

This section examines the peculiar network traffic behavior of MC-MitM attacks and
corresponding network traffic behavior during normal or benign scenarios. Additionally,
we identify possible metrics or parameters that change in relation to network traffic
behavior when MC-MitM attacks occur.
We categorize MC-MitM attack traffic into two stages: stage 1 attack traffic and stage 2 attack traffic. At first, stage 1 attack traffic arrives on the operating or legitimate channel when the attacker tricks clients into selecting his channel. Stage 1 attack traffic in base variant attacks is typically constant or reactive jamming (see Sect. 2.2). Stage 1 attack traffic in improved variant is the arrival of fake CSAs (see Sect. 2.3). As soon as the attacker obtains the MitM position, stage 2 attack traffic arrives. Both variants of the MC-MitM attack generate similar stage 2 attack traffic. The following Tables 1 and 2 illustrate the peculiar behavior of stage 1 attack and stage 2 attack traffic, as well as the benign traffic behavior, and highlight metrics and parameters that can be used to identify different specific traffic behavior.

# 4 MC-MitM Attack Signature Creation

In this section, we design distinct attack signatures of MC-MitM through an empirical analysis about the attack traffic and benign traffic presented in the previous section. Furthermore, we identify appropriate threshold values for metrics to distinguish specific attack traffic.

## 4.1 Assumptions

We employ a threshold-based approach in order to passively identify signatures during MC-MitM attacks. Moreover, a threshold-based approach is cost effective and faster compared to artificial intelligence-based solutions. Furthermore, we design a signature or misuse-based detection, especially to identify different MC-MitM attack variants. By employing these attack signatures, we plan to propose a wireless intrusion detection system. Our solution is lightweight and suitable for plug-and-play installations. The solution must be simple to integrate into any Wi-Fi or IoT environment and ensure continuous protection against all kinds of MC-MitM threats without mandating any changes to network settings, protocols, or existing devices.

## 4.2 Reference Scenario

Figure 6 illustrates the setup in our university research lab for testing the suitability of specific metrics to identify attack signatures.

We set up three wireless clients and a transition-mode AP (D-Link AX router) to create WPA2 as well as WPA3 connections. We maintained a moderate network traffic by generating a maximum of 50 Mbps traffic using *iperf* tool during experiments. We implemented MC-MitM base variant attacks through the ModWifi tools [3] and MC-MitM improved variant attacks through multi-channel MitM [18]. Furthermore, we launched MC-MitM attacks alternatively against WPA2/WPA3 clients. We used Wireshark tool and TL-WN722N wireless dongles to collect client-AP communication (network traffic or wireless frames) through the MC-MitM position. Following sections analyze attack traffic over a specific time period, called the probe interval.
<table><caption>**Table 1.** Analysis of stage 1 network behavior while MC-MitM attacks</caption><thead><tr><td>Signatures</td><td>Attack traffic behavior</td><td>Benign traffic behavior</td><td>Metrics</td></tr></thead><tbody><tr><td>Constant jamming</td><td>Constant jamming indiscriminately jams all the traffic on a channel for a specific period of time, causing the clients to lose Wi-Fi connection from the legitimate AP</td><td>There should be no interruptions in a Wi-Fi connection, especially in receiving beacon traffic, as long as the client is in range of the legitimate AP</td><td>Wi-Fi frame inter arrival time (FIAT)<sup>a</sup> Wi-Fi frame delivery ratio (FDR)<sup>b</sup>. [17] employs above metrics to detect jamming attacks</td></tr><tr><td>Reactive Jamming</td><td>Reactive jamming causes instant malformation of all beacon traffic or probe response traffic for a specific period of time</td><td>Normally, malformation of frames occurs in Wi-Fi networks due to common issues such as incorrect frame reassembly. However, such a malformation frames occurs very rare in benign Wi-Fi networks</td><td>Malformed frame rate</td></tr><tr><td>Fake CSAs</td><td>CSAs usually occur near airports only if the DFS (Dynamic Frequency Selection) feature [19] is enabled in 5 GHz routers to avoid radar noise and is a rare event in household networks. CSAs will not occur in 2.4 GHz routers. When fake CSAs occur, there will be traffic (old and new or rogue channels)</td><td>When genuine CSAs occur, the legitimate AP begins communicating on the new channel and stops communicating on the old channel. This is because wireless networks or routers operate on one channel (operating channel) during its uptime</td><td>Number of CSAs</td></tr></tbody></table>

## 4.3 Stage 1 Attack Traffic Signatures

In this section, we analyze stage 1 attack traffic signatures. We utilize these signatures as warnings of impending MC-MitM attacks and to differentiate between variants of these attacks. Additionally, we monitor the operating channel of the AP specifically this traffic.

**Constant Jamming Attack Signature.** As a first step, we connect the client and the access point wirelessly. Next, we conduct a probe interval of 60 s involving constant

<footnote>a Time elapsed between the reception of a frame and next frame</footnote>

<footnote>b Ratio of frames delivered to frames sent by the AP</footnote>
<table><caption>**Table 2.** Analysis of stage 2 network behavior while MC-MitM attacks</caption><thead><tr><td>Signatures</td><td>Attack traffic behavior</td><td>Benign traffic behavior</td><td>Metrics</td></tr></thead><tbody><tr><td>Concurrent beacon traffic</td><td>This kind of traffic arrives simultaneously on two distinct channels with similar BSSID and SSID. This is because on the one hand, the attacker uses a rogue channel for transmitting beacons or probe responses, and in contrast, the legitimate AP, which is unaware of the attacker, will keep transmitting beacons on its operating channel</td><td>Such a traffic is impossible within WLANs. This is because wireless routers operate only on one channel to communicate with their clients during their uptime</td><td>Number of beacons or probe responses</td></tr><tr><td>Concurrent connection establishment traffic</td><td>This kind of traffic occurs simultaneously on two distinct channels with similar BSSID and SSID due to the exchange the authentication, association, and EAPOL frames between the operating or legitimate channel and the rogue channel for establishing the MitM position between the AP and victim (see Fig. 2)</td><td>Such a traffic is impossible within WLANs</td><td>Number of authentications, associations, or EAPOL frames</td></tr><tr><td>Concurrent data traffic</td><td>Following the concurrent connection establishment traffic, the attacker exchanges the encrypted data between the AP and the victim (see Fig. 3). This results in the occurrence of data frames simultaneously on two distinct channels with similar BSSID and SSID</td><td>Such a traffic is impossible within WLANs</td><td>Number of data frames</td></tr></tbody></table>

jamming for 30 s, followed by a 30-s network monitoring period. This experiment is repeated 50 times. For each probe interval, we compute FIAT values and FDR values (as explained in Table 1) of attack traffic and compare their values in terms of AVG (average) and SD (standard deviation) with that of benign traffic. We present the observed values of FIAT & FDR during different traffic scenarios in Table 3.

Table 3 illustrates how constant jamming affects values of FIAT as well as FDR. Therefore, in order to identify constant jamming attacks and warn against MC-MitM base variant attacks, we adjust the FIAT threshold to 2 ms(ms) and the FDR threshold to 50%.

**Reactive Jamming Attack Signature.** In our experiment, we observed reactive jamming attacks for a probe interval of five minutes. In this period, we mounted three periods of reactive jamming for 60 s, 100 s, and 150 s. We then captured the beacon and probe
<figure><img src="image_10.png" /><figcaption>**Fig. 6.** Reference attack analysis scenario.</figcaption></figure>

<table><caption>**Table 3.** Observed values of FIAT & FDR.</caption><thead><tr><th rowspan="2"></th><th colspan="2">FIAT (ms)</th><th colspan="2">FDR (%)</th></tr><tr><th>AVG</th><th>SD</th><th>AVG</th><th>SD</th></tr></thead><tbody><tr><th>Attack traffic</th><td>5</td><td>1.5</td><td>30</td><td>5.7</td></tr><tr><th>Benign traffic</th><td>0.1</td><td>0.02</td><td>90</td><td>1</td></tr></tbody></table>

response frames separately during each period and we discovered that more than 90% of the frames were malformed because of incorrect FCS, as shown in Fig. 7.

<figure><img src="image_11.png" /><figcaption>**Fig. 7.** Trace of network traffic when reactive jamming happens.</figcaption></figure>

In contrast, after examining benign traffic for 15 min from the AP, we found only a negligible number of malformed frames (below 0.8%) belonging to beacons or probe responses, as shown in Fig. 8. As a result, malformed beacons or probe response frame occurring at a high rate (above 50%), particularly on the operating channel of the access point, may provide evidence of deliberate reactive jamming attempt. Consequently, we adjust the threshold of rate malformation to 50% so as to identify reactive jamming and warn against attacks involving the base variants of the MC-MitM.

**CSA Attack Signature.** Figure 9 illustrates the arrival of fake CSAs on the operating channel of the AP. It shows that the AP still transmits beacons on its operating channel despite CSAs occurred about 110 s. Ideally, this type of traffic should not occur with genuine CSAs since the AP begins communicating on the new channel after receiving
<figure><img src="image_12.png" /><figcaption>Fig. 8. Trace of benign traffic with malformed frames</figcaption></figure>

CSAs. In contrast, during fake CSAs, the legitimate AP continues to send beacons on its operating channel because it does not know about the spoofed CSA.

<figure><img src="image_13.png" /><figcaption>Fig. 9. Trace of network traffic during fake CSA attack.</figcaption></figure>

In order to observe the benign traffic behavior in household networks during a genuine CSA, we switched channel of the AP from 36 to 40 by implementing a hostapd (software implementation of the access point) with the hostapd_cli interface. An example of a genuine channel switch is shown in Fig. 10. During this channel switch, we then simultaneously monitored channels 36 as well as 40 and found no traffic on operating channel 36 following the arrival of channel switch announcements about 100 s later. It should also be noted that the legitimate AP does not begin transmitting on channel 40 until the channel switch occurs, depicted in Fig. 10b.

Whenever a genuine channel switch occurs, the access point stops transmitting data on its current channel and transfers to the newly designated channel, and this can be used to distinguish whether CSAs are fake or not. As a result, to warn against possible improved variant attacks, we adjust the CSA threshold to 1 frame. DFS detectors can also be used to verify CSA occurrences [16]. In such detectors, radar pulses are recognized by advanced devices, which can increase the cost of detecting attacks. Instead, we consider that below mentioned attack signatures to detect fake CSAs. Furthermore, these signatures can potentially detect malicious CSAs irrespective of location, such as household networks or wireless networks near airports, where genuine CSAs can occur due to radar signals.
<figure><img src="image_14.png" /><figcaption>**Fig. 10.** Trace of benign traffic during a genuine CSA on (a) operating channel; (b) new channel.</figcaption></figure>

## 4.4 Stage 2 Attack Traffic Signatures

In this section, we develop stage 2 attack traffic signatures in order to identify and confirm the existence of deliberate MC-MitM attacks. To analyze traffic, we observe both operating (legitimate) and rogue channels simultaneously during a probe interval of about five minutes. During this time, MC-MitM attacks are launched in three periods (for about 60 to 100 s).

**Concurrent Beacon Traffic Signature.** Figure 11 shows a network trace of an attack consisting of beacons (or probe responses) on two distinct/separate wireless channels with the similar BSSID and SSID at the same time. Regarding corresponding investigation on benign traffic, we discovered no such beacon traffic on more than one channel belonging to similar frequency band within a WLAN.

Thus, in conjunction with stage 1 attack traffic signature warnings, a sudden influx of beacon traffic on two distinct channels with similar BSSIDs and SSIDs can indicate MC-MitM activity within the WLAN. Therefore, we adjust the beacon (or probe response) threshold to 1 frame in order to quickly confirm this peculiar beacon traffic in a probe interval duration when MC-MitM attacks happen.

**Concurrent Connection Establishment Traffic Signature.** Figure 12 shows the network trace with multiple authentications, associations, and EAPOL messages/frames on two distinct channels with similar BSSID and SSID at the same time.

In the light of the aforementioned signatures, in conjunction with stage 1 attack traffic signature warnings, we confirm that these peculiar connection establishment traffic can potentially indicate the existence of MC-MitM attacks within a WLAN. Due to the frame exchange, if the MC-MitM attacker selects only one client/victim, there occurs
<figure><img src="image_15.png" /></figure>

<figure><img src="image_16.png" /><figcaption>Fig. 11. Trace of network with beacon traffic on (a) operating channel; (b) rogue channel.</figcaption></figure>

<figure><img src="image_17.png" /></figure>

<figure><img src="image_18.png" /><figcaption>Fig. 12. Trace of network traffic having authentication and association frames and EAPOL messages on (a) operating channel; (b) rogue channel.</figcaption></figure>
at most two authentication frames, two association frames, and four EAPOL frames on two distinct channels at a time. As a result, we adjust the thresholds for authentication, association, and EAPOL messages to 1 frame in order to quickly confirm this peculiar traffic in a probe interval duration when MC-MitM attacks happen.

**Concurrent Data Traffic Signature.** In Fig. 13, we show the network trace consisting of multiple data with two distinct channels using similar BSSID and SSID at the same time.

<figure><img src="image_19.png" /><figcaption>Fig. 13. Trace of network data traffic on (a) operating channel; (b) rogue channel.</figcaption></figure>

As we can see Fig. 13, there can be large number of exchanged data frames on both operating and rogue channels. Further, we use this peculiar data traffic as an optional way to confirm MC-MitM attacks and adjust data traffic threshold to 1 frame in a probe interval duration.

## 4.5 Summary of Attack Traffic Signatures

In Table 4, we summarize distinct attack signatures that can be used to recognize deliberate MC-MitM attacks in a probe interval duration.

## 4.6 Discussion

As we demonstrated in the previous section, the designed attack signatures differ greatly from the normal Wi-Fi network behavior, which makes passive detection of MC-MitM attacks feasible. Furthermore, we set appropriate minimum threshold values so as to quickly detect different attacks. The proposed attack signatures are also lightweight
<table><caption>**Table 4.** Summary of MC-MitM attack signatures.</caption><thead><tr><th></th><th>Signatures of attack</th><th>Used metrics with threshold values</th></tr></thead><tbody><tr><td rowspan="3">Stage 1<br>attack<br>traffic</td><td>Constant jamming</td><td>FIAT ≥ 2 ms and FDR &lt; 50%</td></tr><tr><td>Reactive Jamming</td><td>Malformed frame rate ≥ 50%</td></tr><tr><td>Fake CSAs</td><td>Number of CSA ≥ 1</td></tr><tr><td rowspan="3">Stage 2<br>attack<br>traffic</td><td>Concurrent beacon traffic</td><td>Number of beacons ≥ 1</td></tr><tr><td>Concurrent connection traffic</td><td>Number of Auth/ Asso/EAPOL frames ≥ 1</td></tr><tr><td>Concurrent data traffic</td><td>Number of data frames ≥ 1</td></tr></tbody></table>

and can be easily deployed in any Wi-Fi network, including IoT networks, without modifying any existing protocols. Furthermore, even though an attacker is aware of the deployed attack signatures, it is difficult for him to bypass. This is due to the fact that we defined the thresholds for identifying the appearance of malicious frames as part of the essential operations (i.e., stage 1 attack and stage 2 attack traffic) required for successful MC-MitM attempts, and it is impossible to carry out such attacks without meeting or surpassing those thresholds. Moreover, even if the attacker devises any other new tactics to deceive the victim besides jamming or CSA attacks as part of stage 1 attack, the stage 2 attack traffic signatures can predict the existence of such attacks.

# 5 Conclusions and Future Works

This paper provides researchers with an overview of MC-MitM attacks their ability to manipulate encrypted/protected wireless connections. We highlighted the security impacts of different MC-MitM attack exploits and various challenges to defending such attacks. To this end, we examined network behavior when MC-MitM attack happens. Afterwards, we designed lightweight signatures and selected appropriate metrics to quickly and passively distinguish MC-MitM attacks by conducting an empirical analysis about attack as well as normal behavior of the traffic. We showed that the attack signatures are quite different from normal Wi-Fi behavior. As a future work, we propose to implement a wireless intrusion detection system that utilizes different attack signatures created. Particularly, we aim to demonstrate and test it on a *Raspberry Pi* since it is widely used for establishing home automation domotic systems, such as Home Assistant and OpenHAB. Moreover, we plan to develop our system with a plug-and-play support, which facilitates easy integration into any wireless environments, including IoT networks without altering any existing devices or protocols.

**Acknowledgements.** This research work was funded by the Spanish Government through project PID2021-125962OB-C31 "SECURING".

# References

1. Fajar, B.: Fluxion Kali Linux Tutorial. https://linuxhint.com/fluxion-kali-linux-tutorial/. Accessed 20 May 2021
2. KaliTut, WiFi Pumpkin Framework for Rogue WiFi Access Point Attack. https://kalitut.com/wifi-pumpkin-framework-for-rogue-wi-fi/. Accessed 25 May 2021

3. Vanhoef, M., Piessens, F.: Advanced Wi-Fi attacks using commodity hardware. In: Proceedings of the 30th ACM Annual Computer Security Applications Conference, pp. 256–265 (2014)

4. Vanhoef, M., Piessens, F.: Key reinstallation attacks: forcing nonce Reuse in WPA2. In: Proceedings of the ACM SIGSAC Conference on Computer and Communication Security, pp. 1313–1328 (2017)

5. Vanhoef, M.: Fragment and forge: breaking Wi-Fi through frame aggregation and fragmentation. In: 30th USENIX Security Symposium, pp. 161–178 (2021)

6. Thankappan, M., Rifà-Pous, H., Garrigues, C.: Multi-Channel Man-in-the-Middle attacks against protected Wi-Fi networks: a state of the art review. Expert Syst. Appl. 210, 118401 (2022)

7. Freudenreich, J., Weidman, J., Grossklags, F.: Responding to KRACK: Wi-Fi security awareness in private households. In: Clarke, N., Furnell, S. (eds.) Human Aspects of Information Security and Assurance. HAISA 2020. IFIP Advances in Information and Communication Technology, vol. 593, pp. 233–243. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-57404-8_18

8. Philipp Ebbecke, Protected Management Frames enhance Wi-Fi network security. https://www.wi-fi.org/beacon/philipp-ebbecke/protected-management-frames-enhance-wi-fi-network-security. Accessed 20 May 2022

9. Gong, S., Ochiai, H., Esaki, H.: Scan-based self anomaly detection: client-side mitigation of channel-based man-in-the-middle attacks against Wi-Fi. In: IEEE 44th Annual Computers, Software, and Applications Conference, pp. 1498–1503 (2020)

10. Vanhoef, M., Bhandaru, N., Derham, T., Ouzieli, I., Piessens, F.: Operating channel validation: preventing multi-channel man-in-the-middle attacks against protected wi-fi networks. In: Proceedings of the 11th ACM Conference Security and Privacy in Wireless and Mobile Networks, pp. 34–39 (2018)

11. Vanhoef, M., Adhikari, P., Pöpper, C.: Protecting wi-fi beacons from outsider forgeries. In: Proceedings of the 13th ACM Conference Security and Privacy in Wireless and Mobile Networks, pp. 155–160, (2020)

12. Van Goethem, T., Vanhoef, M., Piessens, F., Joosen, W.: Request and conquer: exposing cross-origin resource size. In: 25th USENIX Security Symposium, pp. 447–462 (2016)

13. Vanhoef, M., Piessens, F.: Predicting, decrypting, and abusing WPA2/802.11 group keys. In: 25th USENIX Security Symposium, pp. 673–688 (2016)

14. Vanhoef, M., Piessens, F.: Release the kraken: new kracks in the 802.11 standard. In: Proceedings of the ACM Conference on Computer and Communication Security, pp. 299–314 (2018)

15. Chi, M., Bu, B., Wang, H., et al.: Multi-channel man-in-the-middle attack against communication-based train control systems: Attack implementation and impact. In: Liu, B., Jia, L., Qin, Y., Liu, Z., Diao, L., An, M. (eds.) Proceedings of the 4th International Conference on Electrical and Information Technologies for Rail Transportation (EITRT) 2019. EITRT 2019. LNEE, vol. 640, pp. 129–139. Springer, Singapore (2020). https://doi.org/10.1007/978-981-15-2914-6_14

16. Louca, C., Peratikou, A., Stavrou, S.: On the detection of channel switch announcement attack in 802.11 networks. In: International Conference on Cyber Security, pp. 281–285 (2021)
17. Osanaiye, O., Alfa, A., Hancke, G.: A statistical approach to detect jamming attacks in wireless sensor networks. Sensors (Switzerland) **18*(6), 1691 (2018)

18. Woody, L.: mitm-channel-based-package. https://pypi.org/project/mitm-channel-based/. Accessed 10 June 2022

19. ETSI E: Broadband Radio Access Networks (BRAN); 5 GHz high performance RLAN; Harmonized EN covering the essential requirements of article 3.2 of the R&TTE Directive. Broadband Radio Access Networks. v1.8.1 (2012)