Back to Details

offensive-krack-fragattacks

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

KRACK & FragAttacks

KRACK 与 FragAttacks

Two attack families against WPA2 client implementations. Both well-disclosed (KRACK 2017, FragAttacks 2021) and largely patched on modern OSes — but the embedded/IoT long tail keeps them in scope for many engagements.
针对 WPA2 客户端实现的两类攻击。两者均已充分公开披露（KRACK 2017，FragAttacks 2021），且现代 OS 上的相关实现大多已修补——但嵌入式/IoT 领域的长尾设备使它们在许多安全测试活动中仍属于测试范围。

When These Apply

适用范围

FamilyTargetPatch Status
KRACKWPA2 supplicants in 4-way handshake / GTK / FT / TDLSMajor OSes patched 2017–2018
FragAttacksFrame fragmentation/aggregation across WPA2/3Most stacks patched 2021–2022
Probability of success today is high only against:
  • Embedded OEM devices (cameras, sensors, point-of-sale)
  • Old Android phones (<8 unpatched)
  • Industrial / SCADA Wi-Fi clients
  • Wi-Fi-enabled toys, smart bulbs, no-name IoT
Modern Win11 / iOS 16+ / Android 13+ / hostapd-2.10 are mitigated.
攻击家族目标修补状态
KRACK使用 4-way handshake / GTK / FT / TDLS 的 WPA2 supplicant主要 OS 已于 2017–2018 年修补
FragAttacksWPA2/3 中的帧分片和聚合大多数技术栈已于 2021–2022 年修补
如今只有在以下目标上，攻击成功的概率才较高：
  • 嵌入式 OEM 设备（摄像头、传感器、POS）
  • 旧版 Android 手机（<8 且未修补）
  • 工业 / SCADA Wi-Fi 客户端
  • 支持 Wi-Fi 的玩具、智能灯泡、无品牌 IoT 设备
现代 Win11 / iOS 16+ / Android 13+ / hostapd-2.10 已缓解这些攻击。

KRACK — Key Reinstallation

KRACK——密钥重装

The 4-way handshake's M3 retransmission causes the supplicant to reinstall the same PTK with reset nonce/replay counters. Frames encrypted under the reused keystream become decryptable.
bash
undefined
4-way handshake 中的 M3 重传会导致 supplicant 重新安装相同的 PTK，并重置 nonce/replay counter。使用复用 keystream 加密的帧将变得可解密。
bash
undefined

Vanhoef's official test scripts

Vanhoef's official test scripts

git clone https://github.com/vanhoefm/krackattacks-scripts cd krackattacks-scripts/krackattack sudo ./krack-test-client.py --interface wlan0
git clone https://github.com/vanhoefm/krackattacks-scripts cd krackattacks-scripts/krackattack sudo ./krack-test-client.py --interface wlan0

Tests the supplicant on a connected client

Tests the supplicant on a connected client


Output identifies which CVE variants the client is vulnerable to.

输出会指明客户端受哪些 CVE 变体影响。

Practical Outcomes

实际结果

When successful:
  • Decryption of WPA2-encrypted frames between client and AP
  • TKIP downgrade enables packet injection
  • Recovery of session keys for the duration of the affected key cycle
Not a PSK recovery — you don't get the wireless password from KRACK.
攻击成功时：
  • 解密客户端与 AP 之间的 WPA2 加密帧
  • TKIP 降级可实现数据包注入
  • 在受影响的密钥周期内恢复 session key
这不是 PSK 恢复——无法通过 KRACK 获取无线密码。

FragAttacks — Frame Splicing

FragAttacks——帧拼接

FragAttacks abuse 802.11 fragmentation and aggregation to inject frames that mix encrypted and plaintext fragments, or to splice attacker-controlled fragments into legitimate frames.
bash
git clone https://github.com/vanhoefm/fragattacks
cd fragattacks
sudo ./test-fragattacks.py wlan0 --interface wlan0
FragAttacks 利用 802.11 分片和聚合，注入同时包含加密与明文分片的帧，或将攻击者控制的分片拼接进合法帧。
bash
git clone https://github.com/vanhoefm/fragattacks
cd fragattacks
sudo ./test-fragattacks.py wlan0 --interface wlan0

Suite of ~12 tests covering each variant

Suite of ~12 tests covering each variant


| CVE | Mechanism |
|---|---|
| CVE-2020-24588 | A-MSDU spoofing — inject crafted A-MSDU subframes |
| CVE-2020-24587 | Mixed-key fragment cache poisoning |
| CVE-2020-24586 | Decoupled fragment cache → reuse |
| CVE-2020-26139 | Forwarding plaintext frames before authentication |
| CVE-2020-26140 | Accepting plaintext frames in protected network |

| CVE | 机制 |
|---|---|
| CVE-2020-24588 | A-MSDU 欺骗——注入精心构造的 A-MSDU 子帧 |
| CVE-2020-24587 | 混合密钥分片缓存投毒 |
| CVE-2020-24586 | 解耦分片缓存 → 重用 |
| CVE-2020-26139 | 在认证前转发明文帧 |
| CVE-2020-26140 | 在受保护网络中接受明文帧 |

Practical Outcomes

实际结果

  • Inject malicious frames that the client treats as legitimate (HTTP redirect, DNS poison)
  • Read decrypted fragments from cached state
  • Cross-protect data exfil via crafted A-MSDU
  • 注入客户端视为合法帧的恶意帧（HTTP 重定向、DNS 投毒）
  • 从缓存状态中读取已解密的分片
  • 通过精心构造的 A-MSDU 跨保护边界外泄数据

Targeting Workflow

目标确定流程

  1. Identify the in-scope client (MAC, OS, vendor)
  2. Estimate patch likelihood — if modern OS, likely patched; if embedded, likely vulnerable
  3. Run the test suite from a controlled AP setup
  4. Report each vulnerable variant separately with the matching CVE
bash
undefined
  1. 确定范围内的客户端（MAC、OS、vendor）
  2. 估算修补可能性——如果是现代 OS，很可能已修补；如果是嵌入式设备，很可能仍易受攻击
  3. 在受控 AP 环境中运行测试套件
  4. 分别报告每个存在漏洞的变体，并关联对应 CVE
bash
undefined

Rogue AP that drives the test

Rogue AP that drives the test

sudo hostapd-mana /tmp/krack_test_ap.conf
sudo hostapd-mana /tmp/krack_test_ap.conf

Force client to associate (deauth from real AP, or social-engineer)

Force client to associate (deauth from real AP, or social-engineer)

sudo aireplay-ng --deauth 5 -a <real-BSSID> -c <client-MAC> wlan0mon
sudo aireplay-ng --deauth 5 -a <real-BSSID> -c <client-MAC> wlan0mon

Run test once associated

Run test once associated

sudo ./krack-test-client.py --interface wlan0
undefined
sudo ./krack-test-client.py --interface wlan0
undefined

Detection

检测

  • WIPS may flag deauth-driven roams to attacker AP
  • Test scripts generate distinctive frame patterns; modern WIPS recognizes Vanhoef's tooling
  • Successful exploitation is essentially silent at protocol level
  • WIPS 可能会标记由 deauth 驱动并漫游到攻击者 AP 的行为
  • 测试脚本会生成 distinctive frame patterns；现代 WIPS 可识别 Vanhoef 的测试工具
  • 成功利用在协议层面基本无迹可寻

Reporting

报告

For each vulnerable CVE:
  • Client model + firmware version (be specific)
  • Variant tested + result (vulnerable / patched / partial)
  • Practical impact in the engagement context (decryption only, or injection viable?)
  • Remediation: vendor patch URL, mitigation (WPA3 + PMF blocks most)
针对每个存在漏洞的 CVE：
  • 客户端型号 + firmware version（需具体）
  • 测试的变体 + 结果（易受攻击 / 已修补 / 部分修补）
  • 在本次安全测试环境中的实际影响（仅可解密，还是可进行注入？）
  • 修复措施：厂商补丁 URL、缓解措施（WPA3 + PMF 可阻止大多数攻击）

Key References

主要参考资料