Wi-Fi Deauthentication Attacks
A deauthentication attack floods a wireless client with forged 802.11 deauthentication management frames, tricking it into dropping its association with the legitimate access point. It is one of the oldest and most reliable Wi-Fi attacks — a denial-of-service primitive on its own, and the standard opening move for handshake-capture and evil-twin attacks. 1
Why it works
Classic 802.11 encrypts and authenticates data frames (under WPA/WPA2) but sends management frames — beacons, probes, authentication, deauthentication — unauthenticated and unencrypted. Any station can therefore claim to be any other station for management purposes: the attacker sniffs the AP’s BSSID (see wi-fi for SSID/BSSID mechanics), then transmits deauth frames with the AP’s MAC as the source address, directed at a victim client (or broadcast). The client has no way to distinguish the forgery from a legitimate AP instruction and disconnects. Repeated transmission keeps it disconnected — a sustained DoS. 2 3
Two structural reasons this has persisted for decades: the wireless medium crosses physical boundaries (attacks come “from the parking lot”), and management/control-plane authentication simply was not part of the original 802.11 specification. 4
What it’s used for
- Pure DoS — keep clients off the network. Crude, loud, effective.
- WPA handshake capture — deauth a client to force it to re-run the 4-way handshake while airodump-ng captures it for offline cracking:
aireplay-ng -0 1 -a <BSSID> -c <client MAC> wlan0mon. This is step 3 of the canonical WPA assessment workflow. 5 - Evil twin / rogue AP — deauth clients off the real AP so they reassociate to an attacker-controlled one (KARMA-style SSID impersonation, captive-portal phishing). This is the WiFi Pineapple’s core pairing: harvest probe requests, impersonate wanted SSIDs, deauth to force the hop. 6
Field instance: Delta Flight 591 (August 2026)
On August 10, 2026, passengers returning from DEF CON 34 aboard Delta Flight 591 (Las Vegas → Atlanta, a 757 with 199 passengers) allegedly ran a mid-flight deauthentication attack against the aircraft’s in-flight Wi-Fi, then broadcast a rogue network named “Delta WiFi Fast” presenting a phishing page that harvested “personal credentials and Google login data.” Crew ACARS messages — “THEY WERE ABLE TO JAM OUR WIFI AND BROADCAST THEIR SIGNAL” — show the attack chain working end-to-end against a captive, high-value audience. The crew killed the onboard Wi-Fi for ~30 minutes; federal agents met the plane at the gate and seized portable Wi-Fi hardware. Delta stated aircraft safety systems were never affected. 7
The incident is a textbook demonstration of why conference-travel opsec treats “the flight home from DEF CON” as a hostile network environment — and of the evil-twin follow-on being the real payload: the deauth is just the crowbar.
Mitigation: 802.11w Protected Management Frames
IEEE 802.11w-2009 (now folded into 802.11-2020) defines Management Frame Protection (MFP/PMF): a post-association cryptographic wrapper for a class of “robust” management frames — deauthentication, disassociation, and certain action frames. Mechanically it mirrors what 802.11i/RSN does for data frames: unicast robust frames get confidentiality; broadcast/multicast robust frames get integrity + replay protection via the Broadcast Integrity Protocol (BIP), which appends a Message Integrity Code computed with a shared key. An attacker can’t compute a valid MIC for a forged deauth, and replayed legitimate frames are dropped — so clients silently discard the attack. 8
WPA3 and Enhanced Open require PMF (MFPC/MFPR flags are automatic), which is why deauth is finally a mitigable attack on modern networks rather than a permanent design flaw.
Limits of the fix
- Coverage — 802.11w protects only deauth/disassoc/action frames; association-flood, beacon, data-plane, and RF-jamming DoS remain outside its scope. Frames sent before key derivation are unprotected. Both APs and clients need support; legacy devices get nothing. 9
- Implementation robustness — Schepers, Ranganathan, and Vanhoef (ACM WiSec 2022) analyzed the standard and every major implementation, finding unspecified cases and contradictory rules in 802.11w itself plus disconnect vulnerabilities in Linux, hostap, IWD, macOS/iOS/iPadOS, Windows, and Android — e.g., a corrupted 4-way-handshake message or EAPoL logoff that coerces a protected deauth frame out of the victim. Their conclusion: MFP is insufficient by itself; an adversary can still disconnect any client from personal or enterprise networks despite it. Patches followed (e.g., CVE-2023-21061 in Android; hostap/IWD now silently discard invalid EAPOL frames), and the authors proposed 802.11 standard updates. 10
Cross-domain note: the unauthenticated-control-plane pattern
Deauth is one instance of a recurring design failure: foundational protocols that can’t authenticate their control messages. The same shape appears in SMTP (envelope sender vs. header sender — spoofable by design, retrofitted with SPF/DKIM/DMARC decades later) and in BGP (prefix announcements accepted on trust, retrofitted with RPKI). In each case the data plane got security first and the control plane got bolted-on protection a generation later — and in each case the retrofit (PMF, DMARC, RPKI) remains partial because legacy peers can’t be forced to upgrade.
Sources
- IEEE 802.11
- Aircrack-ng — Tutorial: How to Crack WPA/WPA2
- WiFi Pineapple — Hak5 Shop
- 2026 — Delta probes Wi-Fi deauth attack on flight carrying DEF CON attendees
- Wireless LAN Security and IEEE 802.11w
- 2022
Related
- wi-fi — the protocol layer; why management frames were attackable in the first place
- aircrack-ng — the standard deauth/handshake-capture toolchain
- hak5-attack-hardware — the Pineapple operationalizes deauth + evil twin
- conference-device-security — the defensive checklist for exactly the DEF CON scenario
- smtp — sibling case of the unauthenticated-control-plane pattern