General update

Hello everyone,

Sorry about the extremely lagged updates to bat, downed cvs server and other
things. We should have the anoncvs server back up now, so let me know if
there's any problems with that. Additionally, I threw together some
injection tools a little bit before defcon that I should be committing to
cvs fairly soon. I was just wondering if anyone here has any ideas for
possible injection based attacks, here are a few that I've thought of or
seen:

Ones that I've done:
- Spoofing Aps/nodes (unbelievably easy)
- Disassociating nodes (unbelievably easy)
- Reassociating nodes to a different ap (fairly easy)
- Mitm attack \w Reassociation (fairly easy)
- Crashing XP (well, what do you think?)

Possible attacks?
- Possible no-ack or rts/cts DoS (make nodes keep re-sending??)
- Some sort of attack on powersave, to force sending nodes to queue or
resend??
- Buffer overflows in the variable length management fields?
- DoS an AP by associating spoofed nodes that are over it's max node limit?
- DoS a network by saturating the air with noise?

Any ideas?
-h1kari

P.S. I'm planning on recoding dstumbler when I get some free time to be
totally monitor mode based and allow some nifty features like: Single
keystroke disassociation/reassociation of nodes, DoS of a network, flooding
wardriving nodes with excessive Aps, (add any other attacks you can come up
with), 40-bit -> 21-bit on-the-fly key cracking, integrated weak-iv logging
and single keystroke weakksa cracking, etc. (You can see where this is
going). Comments welcome.

-- 
David Hulton <[email protected]>
Senior Researcher, Dachb0den Labs
http://www.dachb0den.com