Systems and methods for managing wireless-network deauthentication attacks
The disclosed computer-implemented method for managing wireless-network deauthentication attacks may include (1) detecting, at the wireless access point, a deauthentication signal, transmitted over a wireless network that is managed at least in part by the wireless access point, that prompts a target computing device to disconnect from the wireless network, (2) determining both that the deauthentication signal is directed to the target computing device and that the deauthentication signal was not initiated by the wireless access point, (3) determining, based at least in part on the determination that the deauthentication signal was not initiated by the wireless access point, that the deauthentication signal represents an illegitimate deauthentication signal, and (4) performing, in response to determining that the deauthentication signal represents an illegitimate deauthentication signal, a security action to mitigate effects of the illegitimate deauthentication signal on the target computing device. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for managing wireless-network deauthentication attacks, at least a portion of the method being performed by a wireless access point comprising at least one processor, the method comprising:
detecting, at the wireless access point, a deauthentication signal, transmitted over a wireless network that is managed at least in part by the wireless access point, that prompts a target computing device to disconnect from a network connection between the target computing device and the wireless access point;
determining, based at least in part on querying a log of deauthentication signals initiated by the wireless access point, both that the deauthentication signal is directed to the target computing device and that the deauthentication signal was not initiated by the wireless access point;
determining, based at least in part on the determination that the deauthentication signal was not initiated by the wireless access point, that the deauthentication signal represents an illegitimate deauthentication signal; and
performing, in response to determining that the deauthentication signal represents an illegitimate deauthentication signal, a security action to mitigate effects of the illegitimate deauthentication signal on the target computing device.
2. The method of claim 1 , further comprising generating, based at least in part on information contained in the illegitimate deauthentication signal, a device fingerprint for an attacker computing device that transmitted the illegitimate deauthentication signal.
3. The method of claim 2 , further comprising using the device fingerprint to detect and pre-emptively block additional illegitimate deauthentication signals from the attacker computing device.
4. The method of claim 2 , further comprising providing the device fingerprint to a backend device fingerprinting system that:
maintains a database of device fingerprints for computing devices known to have transmitted illegitimate deauthentication signals; and
provisions information in the database to a plurality of client wireless access points.
5. The method of claim 4 , further comprising:
receiving, from the backend device fingerprinting system, a previously established device fingerprint that matches the device fingerprint for the attacker computing device; and
pre-emptively detecting and blocking, based on matching the previously established device fingerprint and the device fingerprint, illegitimate deauthentication signals from the attacker computing device.
6. The method of claim 1 , further comprising determining, by the wireless access point, a physical location of an attacking device that transmitted the illegitimate deauthentication signal.
7. The method of claim 1 , wherein performing the security action comprises throttling subsequent connection attempts by the target computing device.
8. The method of claim 1 , further comprising causing the target device to ignore the illegitimate deauthentication signal and preventing the target device from disconnecting from the wireless network.
9. The method of claim 1 , wherein the wireless access point comprises an endpoint computing device that serves as a wireless hotspot for other computing devices.
10. The method of claim 1 , wherein performing the security action comprises notifying at least one of:
an administrator of the wireless network;
an administrator of the targeted computing device;
an end user of the targeted computing device; and
a software security system installed on the targeted computing device.
11. A system for managing wireless-network deauthentication attacks, the system comprising:
at least one physical processor; and
a memory, the memory having stored thereon instructions that, when executed by the at least one physical processor of the system, cause the system to:
detect, at a wireless access point, a deauthentication signal, transmitted over a wireless network that is managed at least in part by the wireless access point, that prompts a target computing device to disconnect from a network connection between the target computing device and the wireless access point;
determine, based at least in part on querying a log of deauthentication signals initiated by the wireless access point, both that the deauthentication signal is directed to the target computing device and that the deauthentication signal was not initiated by the wireless access point;
determine, based at least in part on the determination that the deauthentication signal was not initiated by the wireless access point, that the deauthentication signal represents an illegitimate deauthentication signal; and
perform, in response to determining that the deauthentication signal represents an illegitimate deauthentication signal, a security action to mitigate effects of the illegitimate deauthentication signal on the target computing device.
12. The system of claim 11 , wherein the memory stores further instructions that, when executed by the physical processor, cause the physical processor to generate, based at least in part on information contained in the illegitimate deauthentication signal, a device fingerprint for an attacker computing device that transmitted the illegitimate deauthentication signal.
13. The system of claim 12 , wherein the performing the security action comprises using the device fingerprint to detect and pre-emptively block additional illegitimate deauthentication signals from the attacker computing device.
14. The system of claim 12 , wherein the memory stores further instructions that, when executed by the physical processor, cause the physical processor to:
provide the device fingerprint to a backend device fingerprinting system;
maintain a database of device fingerprints for computing devices known to have transmitted illegitimate deauthentication signals; and
provision information in the database to a plurality of client wireless access points.
15. The system of claim 14 , wherein the memory stores further instructions that, when executed by the physical processor, cause the physical processor to:
receive, from the backend device fingerprinting system, a previously established device fingerprint that matches the device fingerprint for the attacker computing device; and
pre-emptively detect and block, based on matching the previously established device fingerprint and the device fingerprint, illegitimate deauthentication signals from the attacker computing device.
16. The system of claim 11 , performing the security action comprises determining, by the wireless access point, a physical location of an attacking device that transmitted the illegitimate deauthentication signal.
17. The system of claim 11 , performing the security action comprises throttling subsequent connection attempts by the target computing device.
18. The system of claim 11 , wherein the memory stores further instructions that, when executed by the physical processor, cause the physical processor to cause the target device to ignore the illegitimate deauthentication signal and prevent the target device from disconnecting from the wireless network.
19. The system of claim 11 , wherein the wireless access point comprises an endpoint computing device that serves as a wireless hotspot for other computing devices.
20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
detect, at a wireless access point, a deauthentication signal, transmitted over a wireless network that is managed at least in part by the wireless access point, that prompts a target computing device to disconnect from a network connection between the target computing device the wireless access point;
determine, based at least in part on querying a log of deauthentication signals initiated by the wireless access point, both that the deauthentication signal is directed to the target computing device and that the deauthentication signal was not initiated by the wireless access point;
determine, based at least in part on the determination that the deauthentication signal was not initiated by the wireless access point, that the deauthentication signal represents an illegitimate deauthentication signal; and
perform, in response to determining that the deauthentication signal represents an illegitimate deauthentication signal, a security action to mitigate effects of the illegitimate deauthentication signal on the target computing device.