Skip to content

Commit 3947d0b

Browse files
omaidfomaidf
committed
Added Attack Scripts for Android
1 parent 958c198 commit 3947d0b

File tree

1,280 files changed

+580655
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,280 files changed

+580655
-0
lines changed

‎attack-scripts/Android.mk

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
LOCAL_PATH:= $(call my-dir)
2+
3+
ifneq ($(filter VER_0_8_X VER_2_1_DEVEL,$(WPA_SUPPLICANT_VERSION)),)
4+
# The order of the 2 Android.mks does matter!
5+
# TODO: Clean up the Android.mks, reset all the temporary variables at the
6+
# end of each Android.mk, so that one Android.mk doesn't depend on variables
7+
# set up in the other Android.mk.
8+
include $(LOCAL_PATH)/hostapd/Android.mk \
9+
$(LOCAL_PATH)/wpa_supplicant/Android.mk
10+
endif

‎attack-scripts/CONTRIBUTIONS

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
Contributions to hostap.git
2+
---------------------------
3+
4+
This software is distributed under a permissive open source license to
5+
allow it to be used in any projects, whether open source or proprietary.
6+
Contributions to the project are welcome and it is important to maintain
7+
clear record of contributions and terms under which they are licensed.
8+
To help with this, following procedure is used to allow acceptance and
9+
recording of the terms.
10+
11+
All contributions are expected to be licensed under the modified BSD
12+
license (see below). Acknowledgment of the terms is tracked through
13+
inclusion of Signed-off-by tag in the contributions at the end of the
14+
commit log message. This tag indicates that the contributor agrees with
15+
the Developer Certificate of Origin (DCO) version 1.1 terms (see below;
16+
also available from http://developercertificate.org/).
17+
18+
19+
The current requirements for contributions to hostap.git
20+
--------------------------------------------------------
21+
22+
To indicate your acceptance of Developer's Certificate of Origin 1.1
23+
terms, please add the following line to the end of the commit message
24+
for each contribution you make to the project:
25+
26+
Signed-off-by: Your Name <your@email.example.org>
27+
28+
using your real name. Pseudonyms or anonymous contributions cannot
29+
unfortunately be accepted.
30+
31+
32+
The preferred method of submitting the contribution to the project is by
33+
email to the hostap mailing list:
34+
hostap@lists.infradead.org
35+
Note that the list may require subscription before accepting message
36+
without moderation. You can subscribe to the list at this address:
37+
http://lists.infradead.org/mailman/listinfo/hostap
38+
39+
The message should contain an inlined patch against the current
40+
development branch (i.e., the master branch of
41+
git://w1.fi/hostap.git). Please make sure the software you use for
42+
sending the patch does not corrupt whitespace. If that cannot be fixed
43+
for some reason, it is better to include an attached version of the
44+
patch file than just send a whitespace damaged version in the message
45+
body.
46+
47+
The patches should be separate logical changes rather than doing
48+
everything in a single patch. In other words, please keep cleanup, new
49+
features, and bug fixes all in their own patches. Each patch needs a
50+
commit log that describes the changes (what the changes fix, what
51+
functionality is added, why the changes are useful, etc.).
52+
53+
Please try to follow the coding style used in the project.
54+
55+
In general, the best way of generating a suitable formatted patch file
56+
is by committing the changes to a cloned git repository and using git
57+
format-patch. The patch can then be sent, e.g., with git send-email.
58+
59+
60+
History of license and contributions terms
61+
------------------------------------------
62+
63+
Until February 11, 2012, in case of most files in hostap.git, "under the
64+
open source license indicated in the file" means that the contribution
65+
is licensed both under GPL v2 and modified BSD license (see below) and
66+
the choice between these licenses is given to anyone who redistributes
67+
or uses the software. As such, the contribution has to be licensed under
68+
both options to allow this choice.
69+
70+
As of February 11, 2012, the project has chosen to use only the BSD
71+
license option for future distribution. As such, the GPL v2 license
72+
option is no longer used and the contributions are not required to be
73+
licensed until GPL v2. In case of most files in hostap.git, "under the
74+
open source license indicated in the file" means that the contribution
75+
is licensed under the modified BSD license (see below).
76+
77+
Until February 13, 2014, the project used an extended version of the DCO
78+
that included the identical items (a) through (d) from DCO 1.1 and an
79+
additional item (e):
80+
81+
(e) The contribution can be licensed under the modified BSD license
82+
as shown below even in case of files that are currently licensed
83+
under other terms.
84+
85+
This was used during the period when some of the files included the old
86+
license terms. Acceptance of this extended DCO version was indicated
87+
with a Signed-hostap tag in the commit message. This additional item (e)
88+
was used to collect explicit approval to license the contribution with
89+
only the modified BSD license (see below), i.e., without the GPL v2
90+
option. This was done to allow simpler licensing terms to be used in the
91+
future. It should be noted that the modified BSD license is compatible
92+
with GNU GPL and as such, this possible move to simpler licensing option
93+
does not prevent use of this software in GPL projects.
94+
95+
96+
===[ start quote from http://developercertificate.org/ ]=======================
97+
98+
Developer Certificate of Origin
99+
Version 1.1
100+
101+
Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
102+
660 York Street, Suite 102,
103+
San Francisco, CA 94110 USA
104+
105+
Everyone is permitted to copy and distribute verbatim copies of this
106+
license document, but changing it is not allowed.
107+
108+
109+
Developer's Certificate of Origin 1.1
110+
111+
By making a contribution to this project, I certify that:
112+
113+
(a) The contribution was created in whole or in part by me and I
114+
have the right to submit it under the open source license
115+
indicated in the file; or
116+
117+
(b) The contribution is based upon previous work that, to the best
118+
of my knowledge, is covered under an appropriate open source
119+
license and I have the right under that license to submit that
120+
work with modifications, whether created in whole or in part
121+
by me, under the same open source license (unless I am
122+
permitted to submit under a different license), as indicated
123+
in the file; or
124+
125+
(c) The contribution was provided directly to me by some other
126+
person who certified (a), (b) or (c) and I have not modified
127+
it.
128+
129+
(d) I understand and agree that this project and the contribution
130+
are public and that a record of the contribution (including all
131+
personal information I submit with it, including my sign-off) is
132+
maintained indefinitely and may be redistributed consistent with
133+
this project or the open source license(s) involved.
134+
135+
===[ end quote from http://developercertificate.org/ ]=========================
136+
137+
138+
The license terms used for hostap.git files
139+
-------------------------------------------
140+
141+
Modified BSD license (no advertisement clause):
142+
143+
Copyright (c) 2002-2016, Jouni Malinen <j@w1.fi> and contributors
144+
All Rights Reserved.
145+
146+
Redistribution and use in source and binary forms, with or without
147+
modification, are permitted provided that the following conditions are
148+
met:
149+
150+
1. Redistributions of source code must retain the above copyright
151+
notice, this list of conditions and the following disclaimer.
152+
153+
2. Redistributions in binary form must reproduce the above copyright
154+
notice, this list of conditions and the following disclaimer in the
155+
documentation and/or other materials provided with the distribution.
156+
157+
3. Neither the name(s) of the above-listed copyright holder(s) nor the
158+
names of its contributors may be used to endorse or promote products
159+
derived from this software without specific prior written permission.
160+
161+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
162+
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
163+
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
164+
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
165+
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
166+
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
167+
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
168+
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
169+
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
170+
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
171+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

‎attack-scripts/COPYING

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
wpa_supplicant and hostapd
2+
--------------------------
3+
4+
Copyright (c) 2002-2016, Jouni Malinen <j@w1.fi> and contributors
5+
All Rights Reserved.
6+
7+
8+
See the README file for the current license terms.
9+
10+
This software was previously distributed under BSD/GPL v2 dual license
11+
terms that allowed either of those license alternatives to be
12+
selected. As of February 11, 2012, the project has chosen to use only
13+
the BSD license option for future distribution. As such, the GPL v2
14+
license option is no longer used. It should be noted that the BSD
15+
license option (the one with advertisement clause removed) is compatible
16+
with GPL and as such, does not prevent use of this software in projects
17+
that use GPL.
18+
19+
Some of the files may still include pointers to GPL version 2 license
20+
terms. However, such copyright and license notifications are maintained
21+
only for attribution purposes and any distribution of this software
22+
after February 11, 2012 is no longer under the GPL v2 option.

‎attack-scripts/README

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
krackattacks
2+
------------
3+
4+
Copyright of portions of this project are held by Jouni Malinen and
5+
contributors (see below). Copyright of project krackattacks are held by
6+
Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven> and contributors.
7+
8+
Software of project krackattacks is licensed under the 2-clause BSD
9+
license (the license below with the 3rd clause removed).
10+
11+
12+
wpa_supplicant and hostapd
13+
--------------------------
14+
15+
Copyright (c) 2002-2016, Jouni Malinen <j@w1.fi> and contributors
16+
All Rights Reserved.
17+
18+
These programs are licensed under the BSD license (the one with
19+
advertisement clause removed).
20+
21+
If you are submitting changes to the project, please see CONTRIBUTIONS
22+
file for more instructions.
23+
24+
25+
This package may include either wpa_supplicant, hostapd, or both. See
26+
README file respective subdirectories (wpa_supplicant/README or
27+
hostapd/README) for more details.
28+
29+
Source code files were moved around in v0.6.x releases and compared to
30+
earlier releases, the programs are now built by first going to a
31+
subdirectory (wpa_supplicant or hostapd) and creating build
32+
configuration (.config) and running 'make' there (for Linux/BSD/cygwin
33+
builds).
34+
35+
36+
License
37+
-------
38+
39+
This software may be distributed, used, and modified under the terms of
40+
BSD license:
41+
42+
Redistribution and use in source and binary forms, with or without
43+
modification, are permitted provided that the following conditions are
44+
met:
45+
46+
1. Redistributions of source code must retain the above copyright
47+
notice, this list of conditions and the following disclaimer.
48+
49+
2. Redistributions in binary form must reproduce the above copyright
50+
notice, this list of conditions and the following disclaimer in the
51+
documentation and/or other materials provided with the distribution.
52+
53+
3. Neither the name(s) of the above-listed copyright holder(s) nor the
54+
names of its contributors may be used to endorse or promote products
55+
derived from this software without specific prior written permission.
56+
57+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
58+
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
59+
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
60+
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
61+
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
62+
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
63+
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
64+
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
65+
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
66+
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
67+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

‎attack-scripts/README-ap.md

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Extra: Access Point Attack Details
2+
3+
## CVE-2017-13082: Key Reinstall in FT Handshake (802.11r)
4+
5+
Access Points (APs) might contain a vulnerable implementation of the Fast BSS Transition (FT) handshake. More precisely, a retransmitted or replayed FT Reassociation Request may trick the AP into reinstalling the pairwise key. If the AP does not process retransmitted FT reassociation requests, or if it does not reinstall the pairwise key, it is not vulnerable. If it does reinstall the pairwise key, the effect is similar to the attack against the 4-way handshake, except that the AP instead of the client is now reinstalling a key. More precisely, the AP will subsequently reuse packet numbers when sending frames protected using TKIP, CCMP, or GCMP. This causes nonce reuse, voiding any security these encryption schemes are supposed to provide. Since the packet number is also used as a replay counter for received frames, frames sent *towards* the AP can also be replayed.
6+
7+
In contrast to the 4-way handshake and group key handshake, this is not an attack against the specification. That is, if the state machine as shown in Figure 13-15 of the 802.11-2016 standard is faithfully implemented, the AP will not reinstall the pairwise keys when receiving a retransmitted FT Reassociation Request. However, we found that many APs do process this frame and reinstall the pairwise key.
8+
9+
## Suggested Solution
10+
11+
If the implementation is vulnerable, the suggested fix is similar to the one of the 4-way handshake. That is, a boolean can be added such that the first FT Reassociation Requests installs the pairwise keys, but any retransmissions will skip key installation. Note that ideally the AP should still send a new FT Reassociation Response, even though it did not reinstall any keys.
12+
13+
## Impact and Exploitation Details
14+
15+
Exploiting this vulnerability does not require a man-in-the-middle position! Instead, an adversary merely needs to capture a Fast BSS Transition handshake and save the FT Reassociation Request. Because this frame does not contain a replay counter, the adversary can replay it at any time (and arbitrarily many times). Each time the vulnerable AP receives the replayed frame, the pairwise key will be reinstalled. This attack is illustrated in Figure 9 of the paper.
16+
17+
An adversary can trigger FT handshakes at will as follows. First, if no other AP of the network is within range of the client, the adversary clones a real AP of this network next to the client using a wormhole attack (i.e. we forward all frames over the internet). The adversary then sends a BSS Transition Management Request to the client. This request commands to the client to roam to another AP. As a result, the client will perform an FT handshake to roam to the other AP.
18+
19+
The included network trace [example-ft.pcapng](example-ft.pcapng) is an example of the attack executed against Linux's hostapd. When using the wireshark filter `wlan.sa == 7e:62:5c:7a:cd:47`, notice that packets 779 to 1127 all use the CCMP IV value 1. This was caused by malicious retransmissions of the FT reassociation request.

0 commit comments

Comments
 (0)