Denial-of-Service Attacks on Wi-Fi Protected Management Frames Preventing Reconnection
Kohei Senga, Shoei Nashimoto · 2025
Wireless networks are more susceptible to Denial-of-Service (DoS) attacks than wired networks. Deauthentication attacks are well-known DoS attacks on Wi-Fi. These attacks disconnect the client from the access point (AP), rendering it unable to use a wireless network. Protected Management Frames (PMF) have been standardized in IEEE 802.11w to thwart these attacks. However, recent studies have shown that DoS attacks can still succeed in disconnecting when the PMF is enabled. These studies employed various methods to disrupt communication between the client and the AP; however, once a DoS attack stops, the client can reconnect with the AP. To prevent reconnection, a DoS attack must be sustained, which increases the risk of the attacker detecting and localizing the longer the attack persists. In this paper, we propose two novel DoS attacks on PMF-enabled Wi-Fi that make reconnection difficult. One attack exhausts the resources for simultaneous connections, and the other directs the client to a rogue AP. Through experiments using commercial Wi-Fi devices, we demonstrate that the proposed attacks result in a prolonged inability of the client to communicate.