Demonstration of Wireless Insecurities Presented by: Jason Wylie, CISM, CISSP

Demonstration of Wireless Insecurities Demonstration of Wireless Insecurities Agenda: Demonstrate ease of access to unprotected WLAN Setup standard security roll-out (SSID and MAC restrictions) Demonstrate ability to locate an AP and spoof MAC Adresses Set up WEP on AP and demonstrate WEP weaknesses Discuss methods of providing security over wireless

Equipment Layout Equipment Layout

Equipment / Tools Linksys Access Point Laptop with Linksys PCMCIA Wlan Cards Unauthorized “Hacker” Client System NetStumbler, SMAC, WEPCrack, and Ethereal Web Server

Rogue (unprotected) Access Point No Security Measures in place Access Point Advertises SSID Casual Users can browse your network Typical of departmental or “personal “ access points An intruder starts with internal access to your network

Baseline Wireless Security Disabling SSID Broadcast –Service Set Identifier Broadcasting MAC Restrictions –Limit participation to only allowed MAC addresses WEP –Wired Equivalent Privacy

Baseline Wireless Security ~ Disabling SSID Broadcast ~ ADDED SECURITY: SSID is not broadcast to unknown clients. CONS: Requires manual input of SSID on all client systems. SSID information is sent in “plain-text” from the client to the AP.

Getting past SSID Obscurity Sniffing traffic on the WLAN Identify SSID broadcast from employee system during AP association. Configure Wireless card with discovered SSID.

Baseline Wireless Security ~ MAC Filtering ~ ADDED SECURITY: WLAN association is restricted from unknown MAC addresses. CONS: Requires manual input of all client system MAC addresses into the AP. MAC “spoofing” is a trivial task.

Getting past MAC Filtering Sniffing traffic on the WLAN Identify valid MAC addresses from employee WLAN interaction. Spoof the MAC address of the employee’s system.

Baseline Wireless Security ~ WEP Encryption ~ ADDED SECURITY: Traffic is encrypted during transmission CONS: Requires distribution of WEP keys to employees. WEP keys can be broken easily

Getting past WEP Sniffing traffic on the WLAN Gather at least 500MB of traffic Process through Wepcrack Keys to the kingdom are revealed

Alternatives Limit Broadcast Range of Access Points Put the Access Points outside the Firewall –Use strong authentication –Encrypt traffic with IPSEC VPN (3DES or AES) Use proprietary Key Rotation Methods –EAP (LEAP – Cisco, EAP-TLS, EAP-TTS) Manually Scan for “Rogue” Access Points Install IDS for WLANs –Detects MAC Spoofing –Identifies “Rogue” Access Points.

Extensible Authentication Protocol (RFC 2284) Provides a flexible link layer security framework Simple encapsulation protocol –No dependency on IP –ACK/NAK, no windowing –No fragmentation support Few link layer assumptions –Can run over any link layer (PPP, 802, etc.) –Does not assume physically secure link Assumes no re-ordering –Can run over lossy or lossless media –Retransmission responsibility of authenticator (not needed for 802.1X or )

URLs for More Information IEEE 802 web page: IETF web page: The “Unofficial Security” Web Site: Planet