Prabhaker Mateti Wright State University

Prabhaker Mateti Wright State University
Hacking Wireless Prabhaker Mateti Wright State University

Talk Outline Wireless LAN Overview Wireless Network Sniffing
Wireless Spoofing Wireless Network Probing AP Weaknesses Denial of Service Man-in-the-Middle Attacks War Driving Wireless Security Best Practices Conclusion

Ack There is nothing new in this talk. It is an overview what has been known for a couple of years. Several figures borrowed from many sources on the www. Apologies that I lost track of the original sources.

Wireless LAN Overview

OSI Model Application Presentation Session Transport Network Data Link
MAC header 802.11b Physical PLCP header

Network Layers

IEEE 802.11 Published in June 1997 2.4GHz operating frequency
1 to 2 Mbps throughput Can choose between frequency hopping or direct sequence spread modulation

IEEE 802.11b 1999 Data Rate: 11 Mbps Reality: 5 to 7 Mbps
2.4-Ghz band; runs on 3 channels shared by cordless phones, microwave ovens, and many Bluetooth products Only direct sequence modulation is specified Most widely deployed today

Channels

Unlicensed Frequencies of Operation Number of Non-overlapping Channels
Physical Layer 802.11a 802.11g 802.11b Standard Approved September 1999 Available Bandwidth 300MHz 83.5MHz Unlicensed Frequencies of Operation GHz GHz GHz Number of Non-overlapping Channels 4(Indoor) 4(Indoor/Outdoor) 3(Indoor/Outdoor) Data Rate Per Channel 6,9,12,18,24,36,48,54Mbps 1,2,5.5,11 6,9,12,18,22,24,33,36,48,54Mbps 1,2,5.5,11Mbps Modulation OFDM DSSS,OFDM PBCC(O),CCK-OFDM(O) DSSS CCK Frequency band of operation: 2.400GHz-2.483GHz unlicensed - Globally represented  Nor America: FCC part  Europe: ETS  Japan: RCR - STD-33A

The Unlicensed Radio Frequency Spectrum
GHz IEEE a HiperLAN/2

Channel Plan – /11b/11g

Channel Spacing (5MHz) 2.437 2.462 2.412 Non-overlapping channels

IEEE 802.11a Data Rate: 54 Mbps Reality: 25 to 27 Mbps
Runs on 12 channels Not backward compatible with b Uses Orthogonal Frequency Division Multiplexing (OFDM)

IEEE g An extension to b Data rate: 54 Mbps 2.4-Ghz band

IEEE 802.1X General-purpose port based network access control mechanism for 802 technologies Authentication is mutual, both the user (not the station) and the AP authenticate to each other. supplicant - entity that needs to be authenticated before the LAN access is permitted (e.g., station); authenticator - entity that supports the actual authentication (e.g., the AP); authentication server - entity that provides the authentication service to the authenticator (usually a RADIUS server). Extensible Authentication Protocol (EAP) RFC 2284) that was first developed in the Internet community for Point-to-Point Protocol (PPP ) Authentication is mutual, both the user (not the wireless device as in the case of WEP) and the access point authenticate to each other. Prevents rogue access points EAP in 802.1x is called EAPOL (Extensible Authentication Protocol over LANs) and is based on three entities: supplicant - entity that needs to be authenticated before the LAN access is permitted (i.e. the wireless client station); authenticator - entity that supports the actual authentication (i.e. the access point); authentication server - entity that provides the authentication service to the authenticator (usually a RADIUS server).

IEEE 802.1X Extensible Authentication Protocol (EAP)
Can provide dynamic encryption key exchange, eliminating some of the issues with WEP Roaming is transparent to the end user Microsoft includes support in Windows XP

802.1x Architecture

IEEE 802.11e Currently under development
Working to improve security issues Extensions to MAC layer, longer keys, and key management systems Adds 128-bit AES encryption

Stations and Access Points

802 .11 Terminology: Station (STA)
Device that contains IEEE conformant MAC and PHY interface to the wireless medium, but does not provide access to a distribution system Most often end-stations available in terminals (work-stations, laptops etc.) Typically Implemented in a PC-Card

Station Architecture Ethernet-like driver interface
supports virtually all protocol stacks Frame translation according to IEEE Std 802.1H Ethernet Types 8137 (Novell IPX) and 80F3 (AARP) encapsulated via the Bridge Tunnel encapsulation scheme IEEE frames: translated to All other Ethernet Types: encapsulated via the RFC 1042 (Standard for the Transmission of IP Datagrams over IEEE 802 Networks) encapsulation scheme Maximum Data limited to 1500 octets Transparent bridging to Ethernet Platform Computer PC-Card Hardware Radio WMAC controller with Station Firmware (WNIC-STA) Driver Software (STADr) frame format 802.3 frame format Ethernet V2.0 / 802.3 frame format Protocol Stack

Terminology: Access-Point (AP)
A transceiver that serves as the center point of a stand-alone wireless network or as the connection point between wireless and wired networks. Device that contains IEEE conformant MAC and PHY interface to the wireless medium, and provide access to a Distribution System for associated stations (i.e., AP is a STA) Most often infra-structure products that connect to wired backbones Implemented in a “box” containing a STA PC-Card.

Access-Point (AP) Architecture
Stations select an AP and “associate” with it APs support roaming Power Management time synchronization functions (beaconing) Traffic typically flows through AP Bridge Software PC-Card Hardware Radio WMAC controller with Access Point Firmware (WNIC-AP) Driver (APDr) frame format 802.3 frame format Ethernet V2.0 / 802.3 frame format Kernel Software (APK) Ethernet Interface

Basic Configuration

Infrastructure and Ad Hoc Modes

Terminology: Basic Service Set (BSS)
A set of stations controlled by a single “Coordination Function” (=the logical function that determines when a station can transmit or receive) Similar to a “cell” in pre IEEE terminology A BSS may or may not have an AP

Basic Service Set (BSS)

Terminology: Distribution System (DS)
A system to interconnect a set of BSSs Integrated; A single AP in a standalone network Wired; Using cable to interconnect the AP Wireless; Using wireless to interconnect the AP

Terminology: Independent Basic Service Set (IBSS)
A BSS forming a self-contained network in which no access to a Distribution System is available A BSS without an AP One of the stations in the IBSS can be configured to “initiate” the network and assume the Coordination Function Diameter of the cell determined by coverage distance between two wireless stations

Independent Basic Service Set (IBSS)

Terminology: Extended Service Set (ESS)
A set of one or more BSS interconnected by a Distribution System (DS) Traffic always flows via AP Diameter of the cell is double the coverage distance between two wireless stations

ESS: single BSS (with int. DS)

ESS: with wired DS BSS Distribution System BSS

ESS: with wireless DS BSS Distribution System BSS

Terminology: Service Set Identifier (SSID)
“Network name” Upto 32 octets long One network (ESS or IBSS) has one SSID E.g., “WSU Wireless”; defaults: “101” for 3COM and “tsunami” for Cisco

Terminology: Basic Service Set Identifier (BSSID)
“cell identifier” One BSS has one BSSID Exactly 6 octets long BSSID = MAC address of AP

Communication CSMA/CA (Carrier Sense Multiple Access/Collision Avoidance) instead of Collision Detection WLAN adapter cannot send and receive traffic at the same time on the same channel Hidden Node Problem Four-Way Handshake

Hidden Node Problem

Four-Way Handshake Source Destination RTS – Request to Send
CTS – Clear to Send DATA ACK

Infrastructure operation modes
Root Mode Repeater Mode

Frames

Ethernet Packet Structure
14 byte header 2 addresses Graphic Source: Network Computing Magazine August 7, 2000

802.11 Packet Structure 30 byte header 4 addresses
Graphic Source: Network Computing Magazine August 7, 2000

Ethernet Physical Layer Packet Structure
8 byte header (Preamble) Graphic Source: Network Computing Magazine August 7, 2000

802.11 Physical Layer Packet Structure
24 byte header (PLCP, Physical Layer Convergence Protocol) Always transferred at 1 Mbps Graphic Source: Network Computing Magazine August 7, 2000

Frame Formats MAC Header format differs per Type:
Control Duration ID Addr 1 Addr 2 Addr 3 Addr 4 Sequence CRC Body 2 6 0-2312 4 MAC Header Bytes: Protocol Version Type SubType To DS Retry Pwr Mgt More Data WEP Rsvd Frame Control Field Bits: 2 2 4 1 From Frag MAC Header format differs per Type: Control Frames (several fields are omitted) Management Frames Data Frames

Address Field Description
Protocol Version Type SubType To DS Retry Pwr Mgt More Data WEP Rsvd Frame Control Field Bits: 2 2 4 1 From Frag To DS From DS Address 1 DA BSSID RA Address 2 SA TA Address 3 Address 4 N/A Addr. 1 = All stations filter on this address. Addr. 2 = Transmitter Address (TA), Identifies transmitter to address the ACK frame to. Addr. 3 = Dependent on To and From DS bits. Addr. 4 = Only needed to identify the original source of WDS (Wireless Distribution System) frames

Type field descriptions
Protocol Version Type SubType To DS Retry Pwr Mgt More Data WEP Rsvd Frame Control Field Bits: 2 2 4 1 From Frag Type and subtype identify the function of the frame: Type=00 Management Frame Beacon (Re)Association Probe (De)Authentication Power Management Type=01 Control Frame RTS/CTS ACK Type=10 Data Frame

Management Frames Beacon Probe Probe Response
Timestamp, Beacon Interval, Capabilities, SSID, Supported Rates, parameters Traffic Indication Map Probe SSID, Capabilities, Supported Rates Probe Response same for Beacon except for TIM

Management Frames (cont’d)
Association Request Capability, Listen Interval, SSID, Supported Rates Association Response Capability, Status Code, Station ID, Supported Rates Re-association Request Capability, Listen Interval, SSID, Supported Rates, Current AP Address Re-association Response

Management Frames (cont’d)
Dis-association Reason code Authentication Algorithm, Sequence, Status, Challenge Text De-authentication Reason

Synchronization Necessary for keeping frequency hopping synchronized, and other functions like Power Saving. AP periodically transmits special type of frames called Beacon Frames MS uses info in Beacon frames to synchronize to the AP.

Control Frame Format

Authentication

Authentication To control access to the infrastructure via an authentication The station first needs to be authenticated by the AP in order to join the APs network. Stations identify themselves to other stations (or APs) prior to data traffic or association defines two authentication subtypes: Open system and shared key

Open system authentication
A sends an authentication request to B. B sends the result back to A

Shared Key Authentication
Uses WEP Keys

Access Point Discovery
Beacons sent out 10x second – Advertise capabilities Station queries access points – Requests features Access points respond – With supported features Authentication just a formality – May involve more frames Features used by war driving Software Probe request Authentication request Association request Probe response Authentication response Association response

Association

Association Next Step after authentication
Association enables data transfer between MS and AP. The MS sends an association request frame to the AP who replies to the client with an association response frame either allowing are disallowing the association.

Association To establish relationship with AP
Stations scan frequency band to and select AP with best communications quality Active Scan (sending a “Probe request” on specific channels and assess response) Passive Scan (assessing communications quality from beacon message) AP maintains list of associate stations in MAC FW Record station capability (data-rate) To allow inter-BSS relay Station’s MAC address is also maintained in bridge learn table associated with the port it is located on

Association + Authentication
State 1: Unauthenticated Unassociated Successful authentication Deauthentication State 2: Authenticated Unassociated Deauthentication Successful authentication or reassociation Disassociation State 3: Authenticated Associated

Starting an ESS The infrastructure network is identified by its ESSID
All Access-Points will have been set according to this ESSID Wireless stations will be configured to set their desired SSID to the value of ESSID On power up, stations will issue Probe Requests and will locate the AP that they will associate with: “best” Access-Point with matching ESSID “best” Access-Point if the SSID has been set to “ANY”

Starting an IBSS Station configured for IBSS operation will:
“look” for Beacons that contain a network name (SSID) that matches the one that is configured When Beacons with matching Network Name are received and are issued by an AP, Station will associate to the AP When Beacons with matching Network Name are received and are issued by another Station in IBSS mode, the station will join this IBSS When no beacons are received with matching Network Name, Station will issue beacons itself. All Stations in an IBSS network will participate in sending beacons. All stations start a random timer prior to the point in time when next Beacon is to be sent. First station whose random timer expires will send the next beacon

Inter-Frame Spacing DIFS Contention Window Slot time Defer Access Backoff-Window Next Frame Select Slot and Decrement Backoff as long as medium is idle. SIFS PIFS Free access when medium is free longer than DIFS Busy Medium Inter frame spacing required for MAC protocol traffic SIFS = Short interframe space PIFS = PCF interframe space DIFS = DCF interframe space Back-off timer expressed in terms of number of time slots

Data Frames and their ACK
Next MPDU Src Dest Other Contention Window Defer Access Backoff after Defer DIFS SIFS Acknowledgment are to arrive at within the SIFS The DCF interframe space is observed before medium is considered free for use

Traffic flow - Inter-BSS
AP-1000 or AP-500 Avaya Wireless PC-Card Association table Inter-BSS Relay Bridge learn table STA-1 2 STA-2 2 BSS-A Associate Associate ACK STA-1 Packet for STA-2 Packet for STA-2 ACK STA-2

Traffic flow - ESS operation
AP-1000 or AP-500 Avaya Wireless PC-Card Association table Bridge learn table Backbone AP-1000 or AP-500 Avaya Wireless PC-Card Association table Bridge learn table STA-2 2 STA-1 1 STA-2 1 STA-2 STA-1 2 STA-1 Packet for STA-2 ACK Packet for STA-2 ACK BSS-B STA-2 STA-1 BSS-A

Traffic flow - WDS operation
AP-1000 or AP-500 Bridge learn table AP-1000 or AP-500 STA-2 2 Bridge learn table Avaya Wireless PC-Card STA-1 2 Association table STA-2 2 Avaya Wireless PC-Card STA-2 STA-1 2 Association table Wireless Backbone WDS Relay STA-1 Packet for STA-2 ACK WDS Relay Packet for STA-2 ACK Packet for STA-2 ACK BSS-B STA-2 STA-1 BSS-A

Wireless Network Sniffing

Network Sniffing Sniffing is a reconnaissance technique
Sniffing is eavesdropping on the network. A sniffer is a program that intercepts and decodes network traffic broadcast through a medium. Sniffing is the act by a machine S of making copies of a network packet sent by machine A intended to be received by machine B. Sniffing is not a TCP/IP problem enabled by the media, Ethernet and , as the physical and data link layers.

Wireless Network Sniffing
An attacker can passively scan without transmitting at all. A passive scanner instructs the wireless card to listen to each channel for a few messages. RF monitor mode of a wireless card allows every frame appearing on a channel to be copied as the radio of the station tunes to various channels. Analogous to wired Ethernet card in promiscuous mode. A station in monitor mode can capture packets without associating with an AP or ad-hoc network. Many wireless cards permit RFmon mode.

Passive Scanning A corporate network can be accessed from outside a building using readily available technology by an eavesdropper

Passive Scanning Wireless LAN sniffers can be used to gather information about the wireless network from a distance with a directional antenna. These applications are capable of gathering the passwords from the HTTP sites and the telnet sessions sent in plain text. These attacks do not leave any trace of the hacker’s presence on the network

Passive Scanning Scanning is a reconnaissance technique
Detection of SSID Collecting the MAC addresses Collecting the frames for cracking WEP

Behind the scenes of a completely passive wireless pre-attack session
A Basic Attack Behind the scenes of a completely passive wireless pre-attack session

Installing Kismet Setting up Kismet is fairly straightforward.
Google on “Kismet”

Starting Kismet The mysqld service is started.
The gpsd service is started on serial port 1. The wireless card is placed into monitor mode. kismet is launched.

Detection Kismet picks up some wireless jabber! In order to take a closer look at the traffic, disengage “autofit” mode by pressing “ss” to sort by SSID. type WEP? yes or no. 4 TCP packets IP’s detected strength

Network Details Network details for the address are viewed by pressing the “i” key.

More network details More network details for the address are viewed by pressing the “i” key, then scrolling down to view more information.

traffic dump A dump of “printable” traffic can be had by pressing the “d” key. \MAILSLOTS? Could this be a postal office computer? (that is a joke. feel free to laugh at this point. thank you.)

packet list A list of packet types can be viewed by selecting a wireless point and pressing “p”

gpsmap A gpsmap is printed of the area using
# gpsmap –S2 –s10 -r gpsfile

ethereal - beacon The *.dump files Kismet generates can be opened with tcpdump or ethereal as shown here. This is an beacon frame.

ethereal – probe request
....an Probe Request from the same machine

ethereal - registration
oooh... a NETBIOS registration packet for “MSHOME”...

ethereal - registration
...another registration packet, this time from “LAP10”...

ethereal – DHCP request
...a DHCP request... it would be interesting to spoof a response to this...

ethereal – browser request
...a NETBIOS browser request...

ethereal – browser announce
...an SMB host announcement... revealing an OS major version of 5 and an OS minor version of 1... We have a Windows XP client laptop searching for an access point. This particular target ends up being nothing more than a lone client crying out for a wireless server to connect to. Spoofing management frames to this client would most likely prove to be pointless...

Passive Scanning This simple example demonstrates the ability to monitor even client machines which are not actively connected to a wireless access point In a more “chatty” environment, so much more is possible All of this information was captured passively. Kismet did not send a single packet on the airwaves. This type of monitoring can not be detected, but preventive measures can be taken.

Detection of SSID SSID occurs in the following frame types: beacon, probe requests, probe responses, association requests, and reassociation requests. Management frames are always in the clear, even when WEP is enabled. Merely collect a few frames and note the SSID. What if beacons are turned off? Or SSID is hidden?

When the Beacon displays a null SSID …
Patiently wait. Recall that management frames are in the clear. Wait for an associate request; Associate request and response both contain the SSID Wait for a probe request; Probe responses contain SSID

Beacon transmission is disabled ...
Wait for a voluntary associate request to appear. Or Actively probe by injecting spoofed frames, and then sniff the response

Collecting the MAC Addresses
Attacker gathers legitimate MAC addresses for use later in spoofed frames. The source and destination MAC addresses are always in the clear in all the frames. The attacker sniffs these legitimate addresses

Collecting frames for cracking WEP
Systematic procedures in cracking the WEP. Need to collect a large number (millions) of frames. Collection may take hours to days. Cracking is few seconds to a couple of hours.

Cracking WEP

Wired Equivalent Privacy (WEP)
Designed to be computationally efficient, self-synchronizing, and exportable All users of a given AP share the same encryption key Data headers remain unencrypted so anyone can see the source and destination of the data stream

Initialization Vector (IV)
Over a period, same plaintext packet should not generate same ciphertext packet IV is random, and changes per packet Generated by the device on the fly 24 bits long 64 bit encryption: IV bits WEP key 128 bit encryption: IV bits WEP key

WEP Encryption WEP encryption key: a shared 40- or 104-bit long number
WEP keys are used for authentication and encryption of data A 32-bit integrity check value (ICV) is calculated that provides data integrity for the MAC frame. The ICV is appended to the end of the frame data. A 24-bit initialization vector (IV) is appended to the WEP key. The combination of [IV+WEP encryption key] is used as the input of a pseudo-random number generator (PRNG) to generate a bit sequence that is the same size as the combination of [data+ICV]. The PRNG bit sequence, is bit-wise XORed with [data+ICV] to produce the encrypted portion of the payload that is sent between the wireless AP and the wireless client. The IV is added to the front of the encrypted [data+ICV] which becomes the payload for the wireless MAC frame. The result is IV+encrypted [data+ICV].

Decryption The IV is obtained from the front of the MAC payload.
The WEP encryption key is concatenated with the IV. The concatenated WEP encryption key and IV is used as the input of the same PRNG to generate a bit sequence of the same size as the combination of the data and the ICV which is the same bit sequence as that of the sending wireless node. The PRNG bit sequence is XORed with the encrypted [data+ICV] to decrypt the [data+ICV] portion of the payload. The ICV for the data portion of the payload is calculated and compared with the value included in the incoming frame. If the values match, the data is sent from the wireless client and unmodified in transit. The WEP key remains constant over a long duration but the IV can be changed frequently depending on the degree of security needed.

WEP Protocol

WEP: Wired Equivalent Privacy

Initialization Vector
What is an IV? Encrypted Octets IV MSDU ICV 0-2304 4 Bits Initialization Vector Pad Key ID 24 6 2 IV is short for Initialization Vector 24 bits long 64 bit encryption: 24 bits IV bits WEP key 128 bit encryption: 24 bits IV bits WEP key

What is a “Weak” IV? In the RC4 algorithm the Key Scheduling Algorithm (KSA) creates an IV-based on the base key A flaw in the WEP implementation of RC4 allows “weak” IVs to be generated Those IVs “give away" info about the key bytes they were derived from An attacker will collect enough weak IVs to reveal bytes of the base key

WEP problem discovery timeline
In October 2000, Jesse Walker was one of the first people to identify several of the problems within WEP. In February 2001 three researchers (Fluhrer, Mantin, and Shamir) found a flaw in the RC4 key setup algorithm which results in total recovery of the secret key. In June 2001 Tim Newsham found a problem in the algorithm that some vendors used to automatically generate WEP keys. He also built code to perform dictionary attacks against WEP-intercepted traffic.

WEP Attacks (cont.) Four types of attacks
Passive attacks to decrypt traffic based on statistical analysis. Active attack to inject new traffic from unauthorized mobile stations, based on known plaintext. Active attacks to decrypt traffic, based on tricking the access point. Dictionary-building attack that, after analysis of about a day's worth of traffic, allows real-time automated decryption of all traffic. Time required to gather enough wireless traffic depends heavily on the network saturation of target access point

Drawbacks of WEP Protocol
The determination and distribution of WEP keys are not defined There is no defined mechanism to change the WEP key either per authentication or periodically for an authenticated connection No mechanism for central authentication, authorization, and accounting No per-frame authentication mechanism to identify the frame source. No per-user identification and authentication

Fluhrer Paper/AirSnort Utility
Key recovery possible due to statistical analysis of plaintext and “weak” IV Leverages “weak” IVs—large class of weak IVs that can be generated by RC4 Passive attack, but can be more effective if coupled with active attack Two major implementations AirSnort AT&T/Rice University tests (not released)

UC Berkeley Study Bit flipping Replay
Bits are flipped in WEP encrypted frames, and ICV CRC32 is recalculated Replay Bit flipped frames with known IVs resent AP accepts frame since CRC32 is correct Layer 3 device will reject, and send predictable response Response database built and used to derive key

UC Berkeley Study Stream Cipher 1234
PlainText Data Is XORed with the WEP Stream Cipher to Produce the Encrypted CipherText PlainText CipherText Cisco WEP XXYYZZ Predicted PlainText Cisco If CipherText Is XORed with Guessed PlainText, the Stream Cipher Can Be Derived CipherText Stream Cipher XXYYZZ WEP 1234

UC Berkeley Study Bit Flipped Frame Sent
Frame Passes ICV Forwarded to Dest MAC Upper Layer Protocol Fails CRC Sends Predictable Error Message to Source MAC AP WEP Encrypts Response and Forwards to Source MAC Attacker Anticipates Response from Upper Layer Device and Attempts to Derive Key

Message Integrity Check (MIC)
The MIC will protect WEP frames from being tampered with The MIC is computed from seed value, destination MAC, source MAC, and payload The MIC is included in the WEP encrypted payload

Message Integrity Check
MIC uses a hashing algorithm to stamp frame The MIC is still pre-standards, awaiting i ratification WEP Frame—No MIC DA SA IV Data ICV WEP Encrypted WEP Frame—MIC DA SA IV Data SEQ MIC ICV WEP Encrypted

Temporal Key Integrity Protocol (TKIP)
Base key and IV hashed Transmit WEP Key changes as IV changes Key hashing is still pre-standards, awaiting i ratification

WEP and TKIP Implementations
WEP today uses an IV and base key; this includes weak IVs which can be compromised TKIP uses the IV and base key to hash a new key—thus a new key every packet; weak keys are mitigated WEP Encryption Today TKIP Base Key Plaintext Data Base Key Plaintext Data IV IV CipherText Data CipherText Data RC4 XOR Hash XOR Packet Key IV Stream Cipher Stream Cipher RC4

Wireless Spoofing

Wireless Spoofing The attacker constructs frames by filling selected fields that contain addresses or identifiers with legitimate looking but non-existent values, or with legitimate values that belong to others. The attacker would have collected these legitimate values through sniffing.

MAC Address Spoofing Probing is sniffable by the sys admins.
Attacker wishes to be hidden. Use MAC address of a legitimate card. APs can filter based on MAC addresses.

IP spoofing Replacing the true IP address of the sender (or, in some cases, the destination) with a different address. Defeats IP address based trust. IP spoofing is an integral part of many attacks.

Frame Spoofing Frames themselves are not authenticated in 802.11.
Construction of the byte stream that constitutes a spoofed frame is facilitated by libraries. The difficulty here is not in the construction of the contents of the frame, but in getting, it radiated (transmitted) by the station or an AP. This requires control over the firmware.

Wireless Network Probing

Wireless Network Probing
Send cleverly constructed packets to a target that trigger useful responses. This activity is known as probing or active scanning. The target can discover that it is being probed.

Active Attacks Attacker can connect to an AP and obtain an IP address from the DHCP server. A business competitor can use this kind of attack to get the customer information which is confidential to an organization.

Detection of SSID Beacon transmission is disabled, and the attacker does not wish to wait … Inject a probe request frame using a spoofed source MAC address. The probe response frame from the APs will contain, in the clear, the SSID and other information similar to that in the beacon frames.

Detection of APs and stations
Certain bits in the frames identify that the frame is from an AP. If we assume that WEP is either disabled or cracked, the attacker can also gather the IP addresses of the AP and the stations.

Detection of Probing The frames that an attacker injects can be sniffed by a sys admin. GPS-enabled equipment can identify the physical coordinates of a transmitting device.

AP Weaknesses

Poorly Constructed WEP key
The default WEP keys used are often too trivial. APs use simple techniques to convert the user’s key board input into a bit vector. Usually 5 or 13 ASCII printable characters are directly mapped by concatenating their ASCII 8-bit codes into a 40-bit or 104-bit WEP key. A stronger 104-bit key can be constructed from 26 hexadecimal digits. It is possible to form an even stronger104 bit WEP key by truncating the MD5 hash of an arbitrary length pass phrase.

Defeating MAC Filtering
Typical APs permit access to only those stations with known MAC addresses. Easily defeated by the attacker Spoofs his frames with a MAC address that is registered with the AP from among the ones that he collected through sniffing. That a MAC address is registered can be detected by observing the frames from the AP to the stations.

Rogue AP What is a rogue AP? A rogue AP is an unauthorized access point. Traditionally, in a closed network, this is an access point that allows unauthorized entry into the network. This can be a user standing up their own wireless access point for the sake of convenience, attached to the corporate network, providing an unintentional back-door. Or this can be a competing company one floor up slipping 20 bucks to a janitor for dropping an AP on your LAN so they can perform a bit of corporate espionage by pointing an antenna at their floor / your ceiling. Either way, it’s a network security officer’s nightmare. Another obvious use for rogue APs is open or public networks. This can be as hands-off as dropping an overpowered AP in the midst of a public network with a redirect to a splash page stating, “Save the Moose!” , thereby creating a denial of service. Or this can be as involved as walking around in a coffee house with a wireless-capable PDA in AP mode duping users into giving up their hotspot usernames and passwords. As always, users are the simple way into a network. Wireless or not. But wait, here’s a new twist to using rogue APs for network penetration…

Rogue Networks Rogue AP = an unauthorized access point
Network users often set up rogue wireless LANs to simplify their lives Rarely implement security measures Network is vulnerable to War Driving and sniffing and you may not even know it

Access Point SSID: “goodguy” SSID: “badguy” Stronger or Closer
Wi-Fi Card SSID: Let’s say we have an access point with an SSID of “goodguy”. If a wireless client with their SSID set to “ANY” enters the range of the access point “goodguy”, they will associate to “goodguy” and the client’s SSID will effectively become “goodguy”. However, if another access point with an SSID of “badguy” enters the picture, and in relation to the wireless client, “badguy” is either physically closer or it’s signal is stronger than “goodguy”, then there is the potential for the client to re-associate to the closer and stronger access point “badguy”, and the client’s SSID will effectively become “badguy”. It is possible for the mis-association pictured here to happen without the user’s knowledge. Even worse, the badguy access point here could just have easily set its SSID to “goodguy”, making it even easier for the mis-association to occur, and making it that much more difficult for the user to detect. Such is the threat of rogue APs in wireless environments. “goodguy” “ANY” “badguy”

Trojan AP Corporate back-doors Corporate espionage

Trojan AP Mechanics Create a competing wireless network.
AP can be actual AP or HostAP of Linux Create or modify captive portal behind AP Redirect users to “splash” page DoS or theft of user credentials, or WORSE Bold attacker will visit ground zero. Not-so-bold will drive-by with an amp. So what are the mechanics behind a rogue access point? Basically, the idea is to simply create a competing wireless network. A rogue AP is essentially a wireless network of its own, but with a purpose other than providing legitimate service to the Intranet. Instead, the main purpose is to steal credentials from unsuspecting users and use those credentials for illegitimate access to the target legitimate network. The AP component of a rogue AP can be an actual access point or a simple wireless card running HostAP. Off the backend of the AP, an attacker can create a captive portal, which accepts DNS and web queries, but redirects all users to a “splash” page of some sort. Depending on how open the wireless network is to begin with, we can simply sit as a “man in the middle” acting as a “repeater” of sorts, brokering wireless connections from the rogue wireless network, to the legitimate wireless network. An attacker can simply deny service to all users or go so far as to steal usernames and passwords—perhaps even provide no interaction with the user and simply make the user a vector for some infection into the wired network. If the attacker is bold, they can do this intermittently while using the network. One day, they are a legitimate user, the next, a rogue AP—yet another new insider threat for you. A big antenna and amp can facilitate a drive-by rogue AP. Let’s see an example rogue AP setup in action.

Choose your Wi-Fi weapon...
Senao 200mW (23dBm) Cisco 100mW (20dBm) Use a 15dBd antenna with a Senao for 38dBd total... 6 WATTS! Vs 25mW? No contest! Normal 25mW (14dBm)

Airsnarf Nothing special
Simplifies HostAP, httpd, dhcpd, Net::DNS, and iptables setup Simple example rogue AP Airsnarf is a rogue AP setup utility we will now demonstrate. Simply put, it’s just a shell script that integrates and sets up several fairly standard Linux utilities to create a rogue access point, specifically: HostAP for AP functionality, httpd to serve up the splash page, dhcpd to give out IPs/DNS/gateway, a simple Perl-based Net::DNS::Nameserver DNS redirect, and iptables to funnel all the DNS requests the gateway sees to a local port All of these Linux utilities are publicly available. (Demonstration)

Equipment Flaws Numerous flaws in equipment from well-known manufacturers Search on with “access point vulnerabilities” Ex 1: by requesting a file named config.img via TFTP, an attacker receives the binary image of the AP configuration. The image includes the administrator’s password required by the HTTP user interface, the WEP encryption keys, MAC address, and SSID. Ex 2: yet another AP returns the WEP keys, MAC filter list, administrator’s password when sent a UDP packet to port containing the string “gstsearch”.

Denial of Service

Denial of Service A system is not providing services to authorized clients because of resource exhaustion by unauthorized clients. DOS attacks are difficult to prevent Difficult to stop an on-going attack Victim and its clients may not even detect the attacks. Duration may range from milliseconds to hours. A DOS attack against an individual station enables session hijacking.

Jamming The hacker can use a high power RF signal generator to interfere with the ongoing wireless connection, making it useless. Can be avoided only by physically finding the jamming source.

Flooding with Associations
AP inserts the data supplied by the station in the Association Request into a table called the association table. specifies a maximum value of 2007 concurrent associations to an AP. The actual size of this table varies among different models of APs. When this table overflows, the AP would refuse further clients. Attacker authenticates several non-existing stations using legitimate-looking but randomly generated MAC addresses. The attacker then sends a flood of spoofed associate requests so that the association table overflows. Enabling MAC filtering in the AP will prevent this attack.

Deauth/Disassoc Management frame
Attacker must spoof AP MAC address in Src Addr and BSSID Sequence Control field handled by firmware (not set by attacker)

Forged Dissociation Attacker sends a spoofed Disassociation frame where the source MAC address is set to that of the AP. To prevent Reassociation, the attacker continues to send Disassociation frames for a desired period.

Forged Deauthentication
When an Association Response frame is observed, the attacker sends a spoofed Deauthentication frame where the source MAC address is spoofed to that of the AP. The station is now unassociated and unauthenticated, and needs to reconnect. To prevent a reconnection, the attacker continues to send Deauthentication frames for a desired period. Neither MAC filtering nor WEP protection will prevent this attack.

First Stage – Deauth Attack
Airopeek Trace of Deauth Attack

Decode of Deauthentication Frame

Power Management Power-management schemes place a system in sleep mode when no activity occurs The MS can be configured to be in continuous aware mode (CAM) or Power Save Polling (PSP) mode.

Power Saving Attacker steals packets for a station while the station is in Doze state. The protocol requires a station to inform the AP through a successful frame exchange that it wishes to enter the Doze state from the Active state. Periodically the station awakens and sends a PS-Poll frame to the AP. The AP will transmit in response the packets that were buffered for the station while it was dozing. This polling frame can be spoofed by an attacker causing the AP to send the collected packets and flush its internal buffers. An attacker can repeat these polling messages so that when the legitimate station periodically awakens and polls, AP will inform that there are no pending packets.

Man-in-the-Middle Attacks

Man-in-the-Middle Attacks
Attacker on host X inserts X between all communication between hosts B and C, and neither B nor C is aware of the presence of X. All messages sent by B do reach C but via X, and vice versa. The attacker can merely observe the communication or modify it before sending it out.

MITM Via Deauth/DeAssoc
A hacker may use a Trojan AP to hijack mobile nodes by sending a stronger signal than the actual AP is sending to those nodes. The MS then associates with the Trojan AP, sending its data into the wrong hands.

MITM Attack Attacker takes over connections at layer 1 and 2
Attacker sends Deauthenticate frames Race condition between attacker and AP Attacker associates with client Attacker associates with AP Attacker is now inserted between client and AP Example: Monkey jack, part of AirJack ( )

Wireless MITM Assume that station B was authenticated with C, a legitimate AP. Attacker X is a laptop with two wireless cards. Through one card, he presents X as an AP. Attacker X sends Deauthentication frames to B using the C’s MAC address as the source, and the BSSID he has collected. B is deauthenticated and begins a scan for an AP and may find X on a channel different from C. There is a race condition between X and C. If B associates with X, the MITM attack succeeded. X will re-transmit the frames it receives from B to C. These frames will have a spoofed source address of B.

The Monkey - Jack Attack
attacker victim Before Monkey-Jack

The Monkey - Jack Attack
After Monkey-Jack

Attack machine uses vulnerabilities to get information about AP and clients. Attack machine sends deauthentication frames to victim using the AP’s MAC address as the source

Second Stage – Client Capture
Victim’s card scans channels to search for new AP Victim’s card associates with Trojan AP on the attack machine Attack machine’s fake AP is duplicating MAC address and ESSID of real AP Fake AP is on a different channel than the real one

Third Stage – Connect to AP
Attack machine associates with real AP using MAC address of the victim’s machine. Attack machine is now inserted and can pass frames through in a manner that is transparent to the upper level protocols

The Monkey – Jack Attack

Monkey-Jack Detection
Why do I hear my MAC Address as the Src Addr? Is this an attack? Am I being spoofed?

Beginning of a MITM IDS Algorithm

ARP Poisoning ARP poisoning is an attack technique that corrupts the ARP cache that the OS maintains with wrong MAC addresses for some IP addresses. ARP cache poisoning is an old problem in wired networks. ARP poisoning is one of the techniques that enables the man-in-the-middle attack. ARP poisoning on wireless networks can affect wired hosts too.

Session Hijacking Session hijacking occurs when an attacker causes a user to lose his connection, and the attacker assumes his identity and privileges for a period. An attacker disables temporarily the user’s system, say by a DOS attack or a buffer overflow exploit. The attacker then takes the identity of the user. The attacker now has all the access that the user has. When he is done, he stops the DOS attack, and lets the user resume. The user may not detect the interruption if the disruption lasts no more than a couple of seconds. Hijacking can be achieved by forged disassociation DOS attack. Corporate wireless networks are set up so that the user is directed to an authentication server when his station attempts a connection with an AP. After the authentication, the attacker employs the session hijacking described above using spoofed MAC addresses.

War Driving

War Driving “The benign act of locating and logging wireless access points while in motion.” -- ( This “benign” act is of course useful to the attackers.

War chalking

Typical Equipment

“Special” Equipment Possible: 8 mile range using a 24dB gain parabolic dish antenna. PC cards vary in power. Typical: 25mW (14dBm) Cisco: 100mW (20dBm) Senao: 200mW (23dBm)

War Driving Default installation allows any wireless NIC to access the network Drive around (or walk) and gain access to wireless networks Provides direct access behind the firewall

Software Tools

802.11 Attack Tools The following are all freeware Airsnort (Linux)
WEPcrack (Linux) Kismet (Linux) Wellenreiter (Linux) NetStumbler (windows) MiniStumbler (PocketPC) BSD – Airtools (*BSD) Aerosol (Windows) WiFiScanner (Linux)

802.11 Network Security Tools
AiroPeek / AiroPeek NX: Wireless frame sniffer / analyzer, Windows AirTraf: Wireless sniffer / analyzer / “IDS” AirSnort: WEP key “cracker” BSD Airtools: Ports for common wireless tools, very useful NetStumbler: Access point enumeration tool, Windows, free

Ettercap Ettercap is a suite for man in the middle attacks on LAN. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols (even ciphered ones) and includes many feature for network and host analysis.

Weapons Of Mass Disruption
Many tools are new and notable in the world of wireless attacking: libradiate – a library airtraf kismet air-jack family thc-rut - The Hacker's Choice

libradiate Radiate is a C library similar in practice to Libnet but designed for " frame reading, creation and injection." Libnet builds layer 3 and above Libradiate builds frames Disperse, an example tool built using libradiate, is fully functional

libradiate Radiate allows construction of these frames very easily.
Frame types and subtypes Beacon transmitted often announcing a WLAN Probe request: A client frame- "anyone out there?" Association: client and server exchange- "can i play?" Disassociate: "no soup for you!" RTS/CTS: ready/clear to send frames ACK: Acknowlegement Radiate allows construction of these frames very easily.

airtraf more a tool for the good guys, but noteworthy none the less
(Elixar, Inc)

netstumbler ‘stumbler certainly deserves a mention, as it is and was the most popularized wireless network detection tool around windows based, it supports GPS but lacks in many features required by a REAL wireless security hacker...

stumbler vs. stumbverter
thanks to for map data!

kismet A wireless network sniffer that Segregates traffic
Detects IP blocks decloaks SSID’s Detects factory default configurations Detects netstumbler clients Maps wireless points

kismet

kismet - gpsmap Included with kismet, gpsmap gives a great look at captured wireless nodes. ./gpsmap –S 2 –s 12 -r

kismet - gpsmap Included with kismet, gpsmap gives a great look at captured wireless nodes. ./gpsmap –S 2 –s 14 –r -t

kismet - gpsmap Included with kismet, gpsmap gives a great look at captured wireless nodes. ./gpsmap –r –t

air-jack Not a tool, a family of post-detection tools based on the air-jack driver. wlan-jack: spoofs a deauthentication frame to force a wireless user off the net. Shake, repeat forever. Victim is GONE! essid-jack: wlan-jacks a victim then sniffs the SSID when the user reconnects. Monkey-jack: wlan-jacks a victim, then plays man-in-the-middle between the attacker and the target. kracker-jack: monkey-jacks a WLAN connection protected by MAC protected, IPSec secured VPN!

air-jack http://802.11ninja.net/
Robert Baird & Mike Lynn’s excellent presentation lays out the attacks available to air-jack users.

thc-rut a set of post-detection tools

Wireless Security Best Practices

Location of the APs Network segmentation RF signal shaping
Treat the WLAN as an untrusted network RF signal shaping Continually check for unauthorized (“rogue/Trojan”) APs

Proper Configuration Change the default passwords
Use WEP, however broken it may be Don't use static keys, change them frequently Don't allow connections with an empty SSID Don't broadcast your SSID Use a VPN and MAC address filtering with strong mutual authentication Wireless IDS/monitoring (e.g.,

Proper Configuration Most devices have multiple management interfaces
HTTP Telnet FTP TFTP SNMP Disable unneeded services / interfaces Stay current with patches

Remedies Secure Protocol Techniques Use strong authentication
Encrypted messages Digitally signed messages Encapsulation/tunneling Use strong authentication

Wireless IDS A wireless intrusion detection system (WIDS) is often a self-contained computer system with specialized hardware and software to detect anomalous behavior. The special wireless hardware is more capable than the commodity wireless card, including the RF monitor mode, detection of interference, and keeping track of signal-to-noise ratios. It also includes GPS equipment so that rogue clients and APs can be located. A WIDS includes one or more listening devices that collect MAC addresses, SSIDs, features enabled on the stations, transmit speeds, current channel, encryption status, beacon interval, etc.

Wireless IDS WIDS computing engine should be powerful enough that it can dissect frames and WEP-decrypt into IP and TCP components. These can be fed into TCP/IP related intrusion detection systems. Unknown MAC addresses are detected by maintaining a registry of MAC addresses of known stations and APs. Can detect spoofed known MAC addresses because the attacker could not control the firmware of the wireless card to insert the appropriate sequence numbers into the frame.

Wireless Auditing Periodically, every wireless network should be audited. Several audit firms provide this service for a fee. A security audit begins with a well-established security policy. A policy for wireless networks should include a description of the geographical volume of coverage. The goal of an audit is to verify that there are no violations of the policy.

Newer Standards and Protocols

WLAN Security Timeline

Cisco LEAP Overview Provides centralized, scalable, user-based authentication Algorithm requires mutual authentication Network authenticates client, client authenticates network Uses 802.1X for authentication messaging APs will support WinXP’s EAP-TLS also Dynamic WEP key support with WEP key session timeouts

LEAP Authentication Process
Client AP RADIUS Server Start AP Blocks All Requests Until Authentication Completes Request Identity Identity Identity RADIUS Server Authenticates Client Client Authenticates RADIUS Server Derive Derive Key Key Broadcast Key AP Sends Client Broadcast Key, Encrypted with Session Key Key Length

802.11i Takes base 802.1X and adds several features
Wireless implementations are divided into two groups: legacy and new Both groups use 802.1x for credential verification, but the encryption method differs Legacy networks must use 104-bit WEP, TKIP and MIC New networks will be same as legacy, except that they must replace WEP/TKIP with advanced encryption standard – operation cipher block (AES-OCB)

Wi-Fi Protected Access (WPA)
Security solution based on IEEE standards Replacement for WEP Designed to run on existing hardware as a software upgrade, Wi-Fi Protected Access is derived from and will be forward-compatible with the upcoming IEEE i standard Two main features are: enhanced encryption using TKIP user authentication via 802.1x and EAP

Other Vulnerabilities
In February 2002, Arunesh Mishra and William Arbaugh described several design flaws in the combination of the IEEE 802.1X and IEEE protocols that permit man-in-the-middle and session hijacking attacks. LEAP-enabled Cisco wireless networks are vulnerable to dictionary attacks (a la “anwrap”) Attackers can compromise other VPN clients within a “wireless DMZ” and piggyback into the protected network.

Secure LAN (SLAN) Intent to protect link between wireless client and (assumed) more secure wired network Similar to a VPN and provides server authentication, client authentication, data privacy, and integrity using per session and per user short life keys Simpler and more cost efficient than a VPN Cross-platform support and interoperability, not highly scaleable, though Supports Linux and Windows Open Source (slan.sourceforge.net)

SLAN Architecture

SLAN Steps Client/Server Version Handshake Diffie-Hellman Key Exchange
Server Authentication (public key fingerprint) Client Authentication (optional) with PAM on Linux IP Configuration – IP address pool and adjust routing table

SLAN Client Client Application ie Web Browser Encrypted Traffic to
SLAN Server Plaintext Traffic Encrypted Traffic SLAN Driver Physical Driver Plaintext Traffic Encrypted Traffic User Space Process

Intermediate WLAN 11-100 users
Can use MAC addresses, WEP and rotate keys if you want. Some vendors have limited MAC storage ability SLAN also an option Another solution is to tunnel traffic through a VPN

Intermediate WLAN Architecture

VPN Provides a scaleable authentication and encryption solution
Does require end user configuration and a strong knowledge of VPN technology Users must re-authenticate if roaming between VPN servers

VPN Architecture

Enterprise WLAN 100+ users Reconfiguring WEP keys not feasible
Multiple access points and subnets Possible solutions include VLANs, VPNs, custom solutions, and 802.1x

VLANs Combine wireless networks on one VLAN segment, even geographically separated networks. Use 802.1Q VLAN tagging to create a wireless subnet and a VPN gateway for authentication and encryption

VLAN Architecture

Customized Gateway Georgia Institute of Technology
Allows students with laptops to log on to the campus network Uses VLANs, IP Tables, and a Web browser No end user configuration required User access a web site and enters a userid and password Gateway runs specialized code authenticating the user with Kerberos and packet filtering with IPTables, adding the user’s IP address to the allowed list to provide network access

Gateway Architecture

Temporal Key Integrity Protocol (TKIP)
128-bit shared secret – “temporal key” (TK) Mixes the transmitter's MAC address with TK to produce a Phase 1 key. The Phase 1 key is mixed with an initialization vector (iv) to derive per-packet keys. Each key is used with RC4 to encrypt one and only one data packet. Defeats the attacks based on “Weaknesses in the key scheduling algorithm of RC4” by Fluhrer, Mantin and Shamir" TKIP is backward compatible with current APs and wireless NICs

Message Integrity Check (MIC)
MIC prevents bit-flip attacks Implemented on both the access point and all associated client devices, MIC adds a few bytes to each packet to make the packets tamper-proof.

Conclusion Some predictions are that the market for wireless LANs will be $2.2 billion in 2004, up from $771 million in 2000. Current security state is not ideal for sensitive environments. Wireless Networks at home …

References John Bellardo and Stefan Savage, “ Denial-of-Service Attacks: Real Vulnerabilities and Practical Solutions”, 2003, Usenix 2003 Proceedings. Jon Edney and William A. Arbaugh, Real Security: Wi-Fi Protected Access and i, 480 pages, Addison Wesley, 2003, ISBN: Jamil Farshchi, Wireless Intrusion Detection Systems, November 5, 2003, Retrieved Jan 20, 2004 Rob Flickenger, Wireless Hacks: 100 Industrial-Strength Tips & Tools, 286 pages, O'Reilly & Associates, September 2003, ISBN: Matthew S. Gast, Wireless Networks: The Definitive Guide, 464 pages, O’Reilly & Associates, April 2002, ISBN: Vikram Gupta, Srikanth Krishnamurthy, and Michalis Faloutsos, “Denial of Service Attacks at the MAC Layer in Wireless Ad Hoc Networks”, Proceedings of 2002 MILCOM Conference, Anaheim, CA, October 2002. Chris Hurley, Michael Puchol, Russ Rogers, and Frank Thornton, WarDriving: Drive, Detect, Defend, A Guide to Wireless Security, ISBN: , Syngress, 2004. IEEE, IEEE standards documents, Tom Karygiannis and Les Owens, Wireless Network Security: , Bluetooth and Handheld Devices, National Institute of Standards and Technology Special Publication , November nistpubs/800-48/NIST_SP_ pdf Prabhaker Mateti, TCP/IP Suite, The Internet Encyclopedia, Hossein Bidgoli (Editor), John Wiley 2003, ISBN Robert Moskowitz, “Debunking the Myth of SSID Hiding”, Retrieved on March 10, pdf. Bruce Potter and Bob Fleck, Security, O'Reilly & Associates, 2002; ISBN: William Stallings, Wireless Communications & Networks, Prentice Hall, 2001, ISBN: “Collaboratively creating a hobo-language for free wireless networking.” Joshua Wright, “Detecting Wireless LAN MAC Address Spoofing”, Retrieved on Jan 20,

Prabhaker Mateti Wright State University

Similar presentations

Presentation on theme: "Prabhaker Mateti Wright State University"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Prabhaker Mateti Wright State University

Similar presentations

Presentation on theme: "Prabhaker Mateti Wright State University"— Presentation transcript:

Similar presentations

About project

Feedback