7/31/2002Black Hat 2002, Las Vegas NV Advanced Attack Michael Lynn & Robert Baird

7/31/2002 Black Hat 2002, Las Vegas NV What Is NOT Covered b MAC address spoofing WEP vulnerabilities WEP Key cracking techniques Radio signal amplification

7/31/2002 Black Hat 2002, Las Vegas NV What Will Be Covered Attack Scenarios – Denial of service using forged management frames – Using shared key auth. to generate IP traffic. – layer Man-In-The-Middle attack Practical Application – Fun with custom management frames

7/31/2002 Black Hat 2002, Las Vegas NV Attack Scenarios Denial of Service - Forged frames – Management frames not authenticated – Use MAC address of AP – Send de-authenticate and disassociate frames Send continuously Send to broadcast address – AP users are unable to re-associate with AP

7/31/2002 Black Hat 2002, Las Vegas NV Attack Scenarios Denial of Service – forged frames – Requirements Air-jack drivers WLAN-jack

7/31/2002 Black Hat 2002, Las Vegas NV Attack Scenarios Shared key authentication attack – Observe plain text challenge – Observe cipher text response – XOR plain text with cipher text to get key stream – XOR IP packet with key stream re-using IV – Broadcast ping

7/31/2002 Black Hat 2002, Las Vegas NV Attack Scenarios Man-In-The-Middle attack – layer insertion – Victim attack machine AP – In line for key exchanges VPN/IPSEC tunnel setup SSL connection setup SSH connection setup – Effects on wireless authentication gateways

7/31/2002 Black Hat 2002, Las Vegas NV Mitigation Strategies Wireless IDS – Air Defense VPN + strong two way Authentication RF signal shaping (antenna radiation patterns) – Helps avoid signal leakage from property A big guy with a stick

7/31/2002Black Hat 2002, Las Vegas NV Advanced Attack Robert Baird & Michael Lynn