On the detection of Channel Switch Announcement Attack in 802.11 networks

Abstract

During Channel Switch Announcement attacks [1][2], a malicious individual sends a forged channel switch announcement to manipulate a device to connect to a rogue access point (AP) or cause a Denial of Service (DoS). In this work we demonstrate with off-the shelf devices, a MiTM 802.11 detection mechanism which can detect if the channel switch announcement is triggered by the legitimate presence of a radar system, or by an attacker aiming to perform a Wi-Fi Evil Twin attack. The attack could be detected either operating in Dynamic Frequency Selection (DFS) or non DFS channels and the proposed detection mechanism can be integrated into an 802.11 intrusion detection system.