Preamble Injection and Spoofing Attacks in Wi-Fi Networks

In Wi-Fi networks, every frame begins with a preamble that is used to support frame detection, synchro-nization, and channel estimation. The preamble also establishes compatibility and interoperability among devices that operate different Wi-Fi versions (e.g., IEEE 802.11a/g/n/ac/ax). Despite the crucial functions of the preamble, no guarantees can be made on its authenticity or confidentiality. Only weak integrity protection is currently possible. In this paper, we introduce novel Preamble Injection and Spoofing (PrInS) attacks that exploit the vulnerabilities of the preamble. Specifically, an adversary can inject forged preambles without any payload for the purpose of disrupting legitimate receptions or forcing legitimate users to de-fer their transmissions. The proposed PrInS attacks are effective irrespective of the Wi-Fi versions used by the adversary and its targets, as the attacks take advantage of the physical (PHY) layer receive state machine and/or capture effect. The efficacy of our attacks are validated experimentally using software-defined radios (SDRs). Our results show that the adversary can almost silence the channel, bringing the throughput of a legitimate user to 2% of its normal throughput. Even at 30 dB less power, the adversary still causes an 87% reduction in the legitimate users' throughput. To mitigate the PrInS attacks, we propose a backward-compatible scheme for preamble authentication.