Networking – How did the Marriott block wifi hotspots

blockingwireless-networking

As per this article in CNN: Marriott fined $600,000 by FCC for blocking guests' Wi-Fi

How is it possible to do what's described in this article? It's saying that they were able to block personal wifi hotspots while still allowing people to access only their wifi access points. It also says they weren't "jamming" (I can't see how you could jam and also allow access to your own access points). Another article covering the same story said you just couldn't even "see" your own wifi hotspots.

EDIT:
The FCC release says "The FCC Enforcement Bureau’s investigation revealed that Marriott employees had used containment features of a Wi-Fi monitoring system at the Gaylord Opryland to prevent individuals from connecting to the Internet via their own personal Wi-Fi networks". It also seems to indicate they did it with packet injection to cause disconnections (is that possible when using encryption? Or does that get done before the connection can go into encryption?)

Best Answer

If you read the FCC release further it says:

Marriott operates a Wi-Fi monitoring system manufactured by a third party that was installed at the Gaylord Opryland. Among other features, the system includes a containment capability that, when activated, will cause the sending of de-authentication packets to Wi-Fi Internet access points that are not part of Marriott’s Wi-Fi system or authorized by Marriott and that Marriott has classified as “rogue.”

A Wi-Fi Deauthentication Attack uses a feature of the IEEE 802.11 protocol called a deauthentication frame which is a "sanctioned technique to inform a rogue station that they have been disconnected from the network".

An attacker can send a deauthentication frame at any time to a wireless access point, with a spoofed address for the victim. The protocol does not require any encryption for this frame and the attacker only needs to know the victim's MAC address, which is available in the clear.

A good article on how to do this is Forcing a device to disconnect from WiFi using a deauthentication attack

Note that this is prevented by the new Protected Management Frames (PMF) feature of WPA2 and WPA3, also known as IEEE 802.11w-2009.

Related Question