Protecting Wi-Fi Beacons from Outside Forgeries: Beacon Protection & Dragonblood
Security researcher Mathy Vanhoef demonstrates attacks possible via spoofed Wi-Fi beacons and explores emerging beacon protection standards in WPA3.
Summary
The Vulnerability of Unauthenticated 802.11 Beacons
Wi-Fi access points periodically broadcast unencrypted beacon frames to announce network capabilities, SSIDs, operating channels, and cryptographic ciphers.
Demonstrating Beacon Spoofing and Channel Confusion Attacks
Mathy Vanhoef illustrates how rogue actors inject forged beacon frames to manipulate victim power-save modes, downgrade cipher suites, and force rogue network roaming.
Analyzing WPA3 Beacon Protection Standards (802.11w / 802.11mc)
The author explores cryptographic beacon protection mechanisms designed to sign management frames and authenticate beacon contents.
Implementing Robust Wireless Defenses
The presentation outlines how operating systems and wireless access points can deploy beacon integrity verification to block rogue AP attacks.
Related talks
Main Stage·41 min
George Chatzisofroniou
Conducts a comprehensive security analysis of Wi-Fi Easy Connect (Device Provisioning Protocol v3.0), uncovering protocol design flaws and implementation vulnerabilities.
RF Village·45 min
Loaning
Reverse engineers commercial 802.11ah Wi-Fi hardware to design a custom solar-powered long-range repeater running OpenWrt for off-grid remote connectivity.
RF Village·25 min
Allan Riordan Ball
Allan Riordan Ball demonstrates bypassing SSIDs, handshakes, and IP stacks to sling raw 802.11 frames with Scapy as a peer-to-peer data transport pipe.