Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2025-02-17 17:43:06 -05:00
Code Issues Projects Releases Wiki Activity

fragattacks: draft README done

Browse Source
This commit is contained in:
Mathy Vanhoef 2020-08-07 10:24:41 +04:00
parent 5a072bac17
commit a270eb63b7
1 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
research/README.md
View File

@ -109,10 +109,11 @@ Install patched drivers:
make -j 4 make -j 4
sudo make install sudo make install
**TODO: Address any warnings during make install**
This compiles the drivers for all network cards supported by Linux. If you only want to compile This compiles the drivers for all network cards supported by Linux. If you only want to compile
the drivers for network cards we explicitly tested, use `make defconfig-experiments` instead. the drivers for network cards we explicitly tested, use `make defconfig-experiments` instead.
During the install command you may get several warnings containing `needs unknown symbol`. You can
ignore these warning as long they do not contain the `/lib/modules/*/updates/` directory and the
compiled drivers are working.
Now install patched `ath9k_htc` firmware: Now install patched `ath9k_htc` firmware:
@ -417,7 +418,7 @@ presence of a certain vulnerability class, there is no need to test the other at
| `ping I,F,BE,E` | In case the new key is installed relatively late. | `ping I,F,BE,E` | In case the new key is installed relatively late.
| `ping I,E,F,AE --rekey-plain` | If the device performs the rekey handshake in plaintext. | `ping I,E,F,AE --rekey-plain` | If the device performs the rekey handshake in plaintext.
| `ping I,E,F,AE --rekey-req --rekey-plain`| Same as above, and actively request a rekey as client. | `ping I,E,F,AE --rekey-req --rekey-plain`| Same as above, and actively request a rekey as client.
| `ping I,E,F,AE --rekey-early-install` | Install the new key before sending message 4 as an AP. **TODO: Test again against Windows.** | `ping I,E,F,AE --rekey-early-install` | Install the new key before sending message 4 as an AP.
| `ping I,F,BE,AE --freebsd` | Mixed key attack against FreeBSD. | `ping I,F,BE,AE --freebsd` | Mixed key attack against FreeBSD.
| <div align="center">*Cache attacks (§5)*</div> | <div align="center">*Cache attacks (§5)*</div>
| `ping I,E,R,AE --freebsd [--full-reconnect]` | Cache attack specific to FreeBSD implementations. | `ping I,E,R,AE --freebsd [--full-reconnect]` | Cache attack specific to FreeBSD implementations.
@ -745,10 +746,6 @@ I tested the Intel AX200 as well and found that it is _not_ compatible with the
crashes after sending a fragmented frame. If an Intel developer is reading this, please update the firmware crashes after sending a fragmented frame. If an Intel developer is reading this, please update the firmware
and make it possible to inject fragmented frames. and make it possible to inject fragmented frames.
### Injection mode
**TODO: Device that were tested as being an AP while using another one to inject? Broadcom of macOS, Intel AX200?**
## 9.8. Hwsim mode details ## 9.8. Hwsim mode details
**Warning**: *this is currently an experimental mode, only use it for research purposes.* **Warning**: *this is currently an experimental mode, only use it for research purposes.*