FragAttacks: Fragmentation &Aggregation Attacks against Wi-Fi
Mathy Vanhoef
Draft version 1, 8 March 2021

Table of contents
Design flaws:
1. Design flaw: aggregation attack (CVE-2020-24588)
2. Design flaw: mixed key attack (CVE-2020-24587)
3. Design flaw: fragment cache attack (CVE-2020-24586)

2

Table of contents› Implementation flaws allowing trivial plaintext injection:
4. Accepted plaintext frames (CVE-2020-26140 / 26143)
6. Plaintext broadcast fragments (CVE-2020-26145)
7. Cloacked aggregated frames (CVE-2020-26144)› Other implementation flaws:
8. Pre-auth EAPOL forwarding (CVE-2020-26139)
9. Non-consecutive packet numbers (CVE-2020-26146)
10. Mixed plain/encrypted fragments (CVE-2020-26147)
11. No fragmentation support (CVE-2020-26142)
3

Aggregation Attack
CVE-2020-24588
4

Background
Sending small frames causes high overhead:
header packet1

ACK

header packet2

ACK

heade5

Background
Sending small frames causes high overhead:
header packet1

ACK

header packet2

ACK

heade

This can be avoided by aggregating frames:
header’ packet1 packet2 ...

ACK

Problem: how to recognize aggregated frames?
6

Recognizing aggregated frames
headerpayload7

Recognizing aggregated frames
headerFalse

aggregated?

payloadpacket8

Recognizing aggregated frames
headeraggregated?

False rfc1042 IP header

payload

TCP header

data

9

Recognizing aggregated frames
headeraggregated?

False rfc1042 IP header

payload

TCP header

data

10

Recognizing aggregated frames
headeraggregated?

False rfc1042 IP header

True metadata length

payload

TCP header

packet1

datametadata length

packet211

Recognizing aggregated frames
headeraggregated?

False rfc1042 IP header

True metadata length

payload

TCP header

packet1

data

metadata length

packet212

Recognizing aggregated frames
AuthenticatedAuthenticated & encrypted

headerpayloadaggregated?

False rfc1042 IP header

True metadata length

TCP header

packet1

data

metadata length

packet213

Recognizing aggregated frames
Not authenticated: adversary can flip value

headeraggregated?

False rfc1042 IP header

True metadata length

payload

TCP header

packet1

data

metadata length

packet2

What happens if we flip this flag?
14

Spoofing aggregated frames
False rfc1042 IPv4 hdr

TCP hdrdata

15

Spoofing aggregated frames
False rfc1042 IPv4 hdr

TCP hdrdata

Adversary turns normal frame into aggregated one
True metadata length

ignoredmetadata length

packet16

Spoofing aggregated frames
False rfc1042 IPv4 hdr

TCP hdrdata

Adversary turns normal frame into aggregated one
True metadata length

ignoredmetadata length

packet› Metadata = rfc1042 & IPv4 hdr  1st sub-packet is ignored

17

Spoofing aggregated frames
False rfc1042 IPv4 hdr

TCP hdrdata

Adversary turns normal frame into aggregated one
True metadata length

ignoredmetadata lengthpacket› Metadata = rfc1042 & IPv4 hdr  1st sub-packet is ignored› Length = IPv4 ID field: determines start of 2nd sub-packet

18Spoofing aggregated frames
False rfc1042 IPv4 hdr

TCP hdrdata

Adversary turns normal frame into aggregated one
True metadata length

ignoredmetadata lengthpacket› Metadata = rfc1042 & IPv4 hdr  1st sub-packet is ignored› Length = IPv4 ID field: determines start of 2nd sub-packet

19Spoofing aggregated frames
False rfc1042 IPv4 hdr

TCP hdrdata

Adversary turns normal frame into aggregated one
True metadata lengthignored

metadata lengthpacket› Metadata = rfc1042 & IPv4 hdr  1st sub-packet is ignored› Length = IPv4 ID field: determines start of 2nd sub-packet› Control IP ID & part of TCP data  inject arbitrary packets
20How to control IPv4 ID and TCP data?
Send IPv4 packets to the victim› Client: if there’s a firewall, trick client to visit our website
Allows adversary to send IP/TCP packets, not any others› AP: can attack AP if a client uses predictable IP IDs
All major operating systems affected› 802.11n mandates support for aggregated frames› Excluding Net/OpenBSD and certain IoT devices
21

Recap: can inject arbitrary packets
1. Inject special IPv4 frame to the victim
2. Adversary will intercept the corresponding Wi-Fi frame, set
the aggregated flag, and forward it to the victim
Example attacks:› Inject IPv6 Router Advertisement with our DNS server› Victim will use our DNS server  intercept IP-based traffic› Against IPv4-only clients we performed a port scan22

Mixed Key Attack
CVE-2020-24587
23Background
Large frames have a high chance of being corrupted:
headerpacketACK

24

Background
Large frames have a high chance of being corrupted:
headerpacketACK

Avoid by fragmenting & only retransmitting lost fragments:
header fragment1

ACK

header fragment2

ACK

headeProblem: how to (securely) reassemble the fragments?
25Reassembling plaintext fragments
headerfragment1

headerfragment2

headerfragment3

26

Reassembling plaintext fragments
header𝑠

fragment1

header𝑠

fragment2

header𝑠

fragment3› All Wi-Fi frames have an incremental sequence number 𝑠› Fragments of a frame have the same sequence number 𝒔

27Reassembling plaintext fragments
header𝑠

0

fragment1

header𝑠

1

fragment2

header𝑠

2

fragment3› All Wi-Fi frames have an incremental sequence number 𝑠› Fragments of a frame have the same sequence number 𝒔› All fragments also have a fragment number ...

28

Reassembling plaintext fragments
header𝑠0

Morefragment1

header𝑠1

Morefragment2

header𝑠2

Last

fragment3› All Wi-Fi frames have an incremental sequence number 𝑠› Fragments of a frame have the same sequence number 𝒔› All fragments also have a fragment number ...
... and a flag to identify the last fragment
29

Reassembling encrypted fragments
header𝑠𝑛0

More

fragment1

header

𝑠𝑛+1

1

More

fragment2

header

𝑠𝑛+2

2

Last

fragment3› All encrypted frames have a packet number to detect replays
Cannot reuse sequence number (not unique & too small)30

Reassembling encrypted fragments
header𝑠𝑛0

Morefragment1

header

𝑠𝑛+1

1

More

fragment2

header

𝑠𝑛+2

2

Last

fragment3

AuthenticatedAuthenticated› All encrypted frames have a packet number to detect replays
Cannot reuse sequence number (not unique & too small)› Everything except sequence number is authenticated› Drop if packet & fragment numbers are not consecutive
31

Problem: key renewal› Session key can be periodically renewed ...
› ... or updated when roaming between APs› Receiver is allowed to reassemble fragments encryptedunder different keys (i.e. mixed keys)› Attacker can trick victim to combine fragments (from twodifferent frames) encrypted under mixed keys
› Can be abused to exfiltrate data under specific conditions
32

Mixed Key Attack
Visit attacker website
Frag1(s, n)
Frag2(s, n+1)

Frag1(s, n)
Decrypt & store fragment

33

Mixed Key Attack
Visit attacker website
Frag1(s, n)
Frag2(s, n+1)

Header (Frag1)
192.168.1.2 to 3.5.1.1

Frag1(s, n)
Decrypt & store fragment

Payload (Frag2)
GET /image.png HTTP/1.134

Mixed Key Attack
Visit attacker website
Frag1(s, n)
Frag2(s, n+1)

Frag1(s, n)
Decrypt & store fragment

Renew session key

35

Mixed Key Attack
Visit attacker website
Frag1(s, n)
Frag2(s, n+1)

Frag1(s, n)
Decrypt & store fragment

Renew session key

Packet numbers will
restart from zero36

Mixed Key Attack
Visit attacker website
Frag1(s, n)
Frag2(s, n+1)

Frag1(s, n)
Decrypt & store fragment

Renew session key
Login to website

37

Mixed Key Attack
Visit attacker website
Frag1(s, n)
Frag2(s, n+1)

Frag1(s, n)
Decrypt & store fragment

Renew session key
Login to website

Frag1(s’, n)Frag2(s’, n+1)

Frag2(s, n+1)38

Mixed KeyAttack
Header(Frag1)

Payload (Frag2)

POST /login.php HTTP/1.1
Visitattacker
website192.168.1.2 to 39.15.69.7
Frag1(s, n)
Frag2(s, n+1)

user=admin&pass=SeCr3t
Frag1(s, n)
Decrypt & store fragment

Renew session key
Login to website

Frag1(s’, n)Frag2(s’, n+1)

Frag2(s, n+1)39

Mixed Key Attack
Visit attacker website
Frag1(s, n)
Frag2(s, n+1)

Frag1(s, n)
Decrypt & store fragment

Renew session key
Login to website

Frag1(s’, n)Frag2(s’, n+1)

Frag2(s, n+1)
Reassemble & forward40

Mixed Key Attack
Visit attacker website
Frag1(s, n)
Frag2(s, n+1)

Header (Frag1)

Frag1(s, n)
Decrypt& store fragment
Payload(Frag2)

Renew session key

192.168.1.2 to 39.15.69.7
Login to website

POST /login.php HTTP/1.1
user=admin&pass=SeCr3t

Frag1(s’, n)Frag2(s’, n+1)

Frag2(s, n+1)
Reassemble & forward
41

Data exfiltration
Header (Frag1)

Payload (Frag2)

192.168.1.2 to 3.5.1.1

GET /image.png HTTP/1.1

192.168.1.2 to 39.15.69.7

POST /login.php HTTP/1.1
user=admin&pass=SeCr3t

42

Data exfiltration
Header (Frag1)

Payload (Frag2)

192.168.1.2 to 3.5.1.1

GET /image.png HTTP/1.1

192.168.1.2 to 39.15.69.7

POST /login.php HTTP/1.1
user=admin&pass=SeCr3t

43

Data exfiltration
Header (Frag1)

Payload (Frag2)

192.168.1.2 to 3.5.1.1

GET /image.png HTTP/1.1

192.168.1.2 to 39.15.69.7

POST /login.php HTTP/1.1
user=admin&pass=SeCr3t

Adversary mixes different fragments
192.168.1.2 to 3.5.1.1

POST /login.php HTTP/1.1
user=admin&pass=SeCr3t
44

Data exfiltration
Header (Frag1)

Payload (Frag2)

192.168.1.2 to 3.5.1.1

GET /image.png HTTP/1.1

192.168.1.2 to 39.15.69.7

POST /login.php HTTP/1.1
user=admin&pass=SeCr3t

Adversary mixes different fragments
192.168.1.2 to 3.5.1.1

POST /login.php HTTP/1.1
user=admin&pass=SeCr3t

 Login info is sent to attacker’s server
45

Experiments
All major operating systems are vulnerable› Specifics may depend on driver being used
› All four tested home routers affected (Asus, Linksys, D-Link)› One out of three professional APs affected (LANCOM)

Practically all clients are vulnerable› Data exfiltration not possible when exploiting a client› Possible attacks depend on target (non-trivial, see paper)
46

Practicality
Non-trivial exploitation requirements:
1. In our example AP must be vulnerable
2. Client must send fragmented frames
3. Session key is periodically refreshed
4. Client sends IP packets to attacker’s server
When combined with implementation bugs,
this attack becomes more practical47

Fragment Cache Attack
CVE-2020-24586
48

Background: fragment cache
Incomplete fragments are stored in memory = fragment cache
Frag1(s, n)
Decrypt & store
fragment in cache

49

Background: fragment cache
Incomplete fragments are stored in memory = fragment cache
Frag1(s, n)
Decrypt & store
fragment in cache

Frag2(s, n+1)
Reassemble frame & clear
fragments from cache

50

Background: fragment cacheIncomplete fragments are stored in memory = fragment cache
Frag1(s, n)
Decrypt & store
fragment in cache

Frag2(s, n+1)
Reassemble frame & clear
fragments from cache

Problem: fragment cache isn’t cleared when(re)connecting to a different network
51

Background: fragment cache
Incomplete fragments are stored in memory = fragment cache
Frag1(s, n)
Decrypt & store
fragment in cache

Frag2(s, n+1)
Reassemble frame & clear
fragments from cache Can be abused to exfiltrate (or inject) data52

Cache Attack
Spoof victim MAC address
Connect with own credentials

53

Cache Attack
Spoof victim MAC address
Connect with own credentials

Target is an enterprise (hotspot) network› Users don’t trust each other› Adversary has valid credentials
54Cache Attack
Spoof victim MAC address
Connect with own credentials

Frag1(s, n)55

Cache Attack
Spoof victim MAC address
Connect with own credentials

Frag1(s, n)Store fragment undervictim MAC address

56

Cache Attack
Spoof victim MAC address
Connect with own credentials

Frag1(s, n)Store fragment undervictim MAC address

Header (Frag1)

Payload (Frag2)

192.168.1.2 to 3.5.1.1
57

Cache Attack
Spoof victim MAC address
Connect with own credentials

Frag1(s, n)Store fragment undervictim MAC address

58

Cache Attack
Spoof victim MAC address
Connect with own credentials

Frag1(s, n)Store fragment undervictim MAC address
Disconnect

Vulnerability: AP won’t clear fragment from it’s memory59Cache Attack
Spoof victim MAC address
Connect with own credentials

Frag1(s, n)Store fragment undervictim MAC address
Disconnect
Connect with real credentials
60Cache Attack

Store fragment undervictim MAC address
Disconnect
Connect with real credentials

61Cache Attack

Store fragment undervictim MAC address
Disconnect
Connect with real credentials

Login to website

62

Cache Attack

Store fragment undervictim MAC address
Disconnect
Connect with real credentials

Login to website

Frag1(s’, n)Frag2(s’, n+1)

Frag2(s, n+1)63

Cache Attack
Header (Frag1)

Store fragment undervictim
MAC address
Payload(Frag2)

Disconnect
POST/login.php HTTP/1.1
user=admin&pass=SeCr3t
Connect with real credentials
Login to website

Frag1(s’, n)Frag2(s’, n+1)

Frag2(s, n+1)64Cache Attack

Store fragment undervictim MAC address
Disconnect
Connect with real credentials

Login to website

Frag1(s’, n)Frag2(s’, n+1)

Frag2(s, n+1)
Reassemble and process frame65

Cache Attack
Header (Frag1)

Store fragment undervictim
MAC address
Payload(Frag2)

Disconnect
POST/login.php HTTP/1.1
192.168.1.2 to 3.5.1.1
user=admin&pass=SeCr3t
Connect with real credentials
Login to website

Frag1(s’, n)Frag2(s’, n+1)

Frag2(s, n+1)
Reassemble and process frame

66Cache Attack
Header (Frag1)

Store fragment undervictim
MAC address
Payload(Frag2)

Disconnect
POST/login.php HTTP/1.1
192.168.1.2 to 3.5.1.1
user=admin&pass=SeCr3t
Connect with real credentials
Login to website

Frag1(s’, n)Frag2(s’, n+1)

Frag2(s, n+1)
Reassemble and process frame Login data in Frag2 is now sent to the attacker
67Experiments
Roughly half of all tested devices are vulnerable› Seems to depend on driver & network card
› My four home routes were all affected› None of the three professional APs were affected

Also possible to exploit clients under non-trivial threat model› Can inject packets towards the client› See paper for details
68

Recap: attacker can exfilrate/inject packets
Fragments aren’t cleared from memory after (re)connecting› Adversary can poison the cache

Threat model and impact:› Exploiting an AP: against enterprise network, client sends
fragmented frames, can exfiltrate client data
› Exploiting a client: non-trivial threat model, AP sendfragmented frames, can inject packets towards the client69

Implementation Flaws:
trivial plaintext injection70

Accepted plaintext frames (CVE-2020-26140 / 26143)
Accepting plaintext frames (CVE-2020-26140)› Examples: some routers, some dongles on Linux/Windows
Accepting fragmented plaintext frames (CVE-2020-26143)› Examples: many dongles on Windows, some FreeBSD APs
 Can inject frames indepedent of network config
71

Plaintext broadcast fragments (CVE-2020-26145)
Some devices accept plaintext broadcast fragments› Sometimes only accepted while connecting› Treated as full frames!
› Examples: MacOS, iOS, and Free/NetBSD APs

 Can inject frames indepedent of network config72

Cloacked aggregated frames (CVE-2020-26144)
Implementations must accept plaintext EAPOL frames› Abuse to inject plaintext aggregated frames to low #devices:headerTrue

payloadaggregated?

metadata length

packet1

metadata length

packet273

Cloacked aggregated frames (CVE-2020-26144)
Implementations must accept plaintext EAPOL frames› Abuse to inject plaintext aggregated frames to low #devices:headerpayloadaggregated?

True EAPOL hdr length

ignoredmetadata length

packet2› Set metadata to start of EAPOL  plaintext frame is accepted74

Cloacked aggregated frames (CVE-2020-26144)
Implementations must accept plaintext EAPOL frames› Abuse to inject plaintext aggregated frames to low #devices:headerpayloadaggregated?

True EAPOL hdr lengthignored

metadata length

packet2› Set metadata to start of EAPOL  plaintext frame is accepted› 1st sub-packet will be ignored, but 2nd one is processed Can trivially inject plaintext frames
75Implementation flaws
with other impact76Pre-auth EAPOL forwarding (CVE-2020-26139)
Some APs forwards EAPOL frames before sender is authenticated› Examples: Net/FreeBSD APs and 2 4 home routers
1. Associate

3. EAPOL frame

2. EAPOL frame Abuse to inject frames in combination withaggregation attack (CVE-2020-24588)
77

Non-consective packet numbers (CVE-2020-26146)
header𝑠𝑛0

Morefragment1

header

𝑠𝑛+1

1

More

fragment2

header

𝑠𝑛+2

2

Last

fragment3› Recap: fragments must have consecutive packet numbers› Almost nobody checks this! Only Linux does.

› Can do mixed key “exfiltration” attack without periodic rekeys
Client must still use fragmentation & connect to attacker server
78

Mixed plain/encrypted fragments (CVE-2020-26147)
Many devices only require the first fragment to be encrypted› Most Windows & Linux drivers, some Free/NetBSD drivers› Aggregation attack possible without the victim needing toconnect to the attacker’s website (can inject packets)› Cache attack against client possible when even when theAP doesn’t send fragmented frames (can inject packets)
Some devices only require the last fragment to be encrypted› Several Free/NetBSD drivers› Trivial to inject data if fragmentation is used79

No fragmentation support (CVE-2020-26142)
Some devices don’t support fragmentation› They treat fragmented frames as full frames› Examples: OpenBSD and ESP12-F
Abuse to inject frames when:› Another device sends fragmented frames› This other device visits the attacker’s server
80Discussion
81Practicality vs. impact
Perhaps we’re lucky:› Widespread flaws  relatively trickly to exploit in practice› Trivial to exploit flaws  not widespread in practice (?)
Important concerns remain:› Significant #devices affected by trivial to exploit flaws› Every Wi-Fi device affected by one or more flaws› Combining flaws increases practicality of certain attacks

 Patch now before attack improve!
82Conclusion› Aggregation & fragmentation design flaws› Several common implementation flaws› Need patched drivers to test if affected› Impact varies per device & network83