1. Access Control and Site Security (Part 2) (January 28, 2015) © Abdou Illia – Spring 2015

2. 2 Learning Objectives Discuss Site Security Discuss Wireless LAN Security

3. Site Security

4. 4 Building Security Basics Single point of (normal) entry to building Fire doors and alarms Security centers Monitors for closed-circuit TV (CCTV) Videotapes that must be retained (Don’t reuse too much or the quality will be bad) Interior doors to control access between parts of the building Prevent piggybacking, i.e. holding the door open so that someone can enter without identification defeats this protection

5. 5 Building Security Basics Phone stickers with security center phone number Prevent dumpster diving by keeping dumpsters in locked, lighted area Training security personnel Training all employees Enforcing policies: You get what you enforce

6. 6 Reading Questions Answer Reading Questions 1 posted to the course web site (in Notes’ section)

7. 802.11 Wireless LAN Security

8. 8 Wireless telecomm control IEEE* is a professional association that Is dedicated to advancing technological innovations Develops standards for wired LAN devices Develops standards for Wireless LAN (WLAN) devices Wi-Fi Alliance is a trade association that at promotes Wireless LAN technology Certifies products if they conform to certain standards * Institute of Electrical and Electronics Engineers

9. 9 802.11b802.11a802.11g 2.4 GHz5 GHz2.4 GHzUnlicensed Band ≤11 Mbps ≤ 54 Mbps Rated Speed IEEE 802.11 WLAN standards 802.11n 2.4 GHz or 5 GHz ≤ 150 Mbps 31213# of channels13 * Under development AM radio channels have a 10KHz bandwidth FM radio channels: 200KHz bandwidth Service band 2.4 - 2.4835 GHz divided into 13 channels Each channel is 40 MHz wide Channels spaced 5 MHz apart Channel 1 centered on 2412 MHz. Channel 13 centered on 2472 MHz Transmissions spread across multiple channels 802.11b and 802.11g devices use only Channel 1, 6, 11 to avoid transmission overlap. 802.11ac* 2.4/5 GHz? ≤866 Mbps 802.11n

10. 10

11. 11 802.11 Frame Containing Packet 802.11 Wireless LAN operation 802.11 refers to the IEEE Wireless LAN standards Notebook with wireless NIC Ethernet Switch Access Point Server 802.3 Frame Containing Packet (2) (3) Client PC (1)

12. 12 802.11 Wireless LAN (WLAN) Security Basic Operation: Main wired network for servers (usually 802.3 Ethernet) Wireless stations with wireless NICs Access Points for spreading service across the site Access points are internetworking devices that: link 802.11 LANs to 802.3 Ethernet LANs link 802.11 stations to 802.11 stations

13. 13 802.11 Wireless LAN operation Notebook With PC Card Wireless NIC Ethernet Switch Access Point Server 802.11 Frame Containing Packet 802.3 Frame Containing Packet (2) (1) Client PC (3) 1. If the AP is 802.11n-compliant, it can communicate with the notebook even if the notebook has a 802.11a NIC. T F 2. Given what you know about WLAN operation, where (i.e. on which device) security should be implemented to prevent unauthorized devices from gaining access to network services?

14. 14 Summary Question (1) Which of the following is among Wireless Access Points’ functions? a)Convert electric signal into radio wave b)Convert radio wave into electric signal c)Forward messages from wireless stations to devices in a wired LAN d)Forward messages from one wireless station to another e)All of the above f)Only c and d

15. 15 MAC Filtering The Access Point could be configured to only allow mobile devices with specific MAC addresses Today, attack programs exist that could sniff MAC addresses, and then spoof them to gain access Access Point MAC Access Control List O9-2X-98-Y6-12-TR 10-U1-7Y-2J-6R-11 U1-E2-13-6D-G1-90 01-23-11-23-H1-80 ……………………..

16. 16 IP Address Filtering The Access Point could be configured to only allow mobile devices with specific IP addresses Attacker could Get IP address by guessing based on companies range of IP addresses Sniff IP addresses, then spoof them to gain access Access Point IP Address Access Control List 139.67.180.1/24-139.67.180.30/24 139.67.180.75 139.67.180.80 139.67.180.110 ……………………..

17. 17 Access control at EIU What is used at EIU today to control access to the WLAN?

18. 18 SSID: Apparent 802.11 Security Service Set Identifier (SSID) It’s a “Network name” of up to 32 characters Access Points come with default SSID. Example: “tsunami” for Cisco or “linksys” for Linksys All Access Points in a WLAN have same SSID Mobile devices must know the SSID to “talk” to the access points SSID frequently broadcasted by the access point for ease of discovery. SSID in frame headers are transmitted in clear text SSID broadcasting could be disabled but it’s a weak security measure Sniffer programs (e.g. Kismet, inSSIDer) can find SSIDs easily

19. 19 Wired Equivalent Privacy (WEP) Standard originally intended to make wireless networks as secure as wired networks With WEP, mobile devices need to provide a shared key to be authenticated and gain access Typical WEP key length: 40-bit, 128-bit, 256-bit If a hacker intercepts, decrypts, and compares two messages encrypted with the same key, he/she will know the key Question: Besides through hacking, how can a WEP key be leaked? What can be done to limit access by unauthorized users? 1.Wireless station sends authentication request to AP 2.AP sends back a 128 bits challenge text in plaintext 3.Wireless station uses the RC4 encryption scheme to encrypt the challenge text and its WEP key and sends result to AP 4.AP regenerate the WEP key from received result, then compare WEP key to its own WEP key 5.AP sends a success or failure message WEP authentication process aircrack-ng weplab WEPCrack airsnort Open Source WEP Cracking software

20. 20 Wired Equivalent Privacy (WEP) Using a Initialization Vectors (IV) To make the shared key hard to crack, WEP uses a per-frame key that is the shared key plus a 24-bit initialization vector (IV) that is different for each frame/packet. However, many frames “leak” a few bits of the key With high traffic, an attacker using readily available software can crack a shared key in 2 or 3 minutes

21. 21 Wi-Fi Protected Access (WPA) WPA extends the security of WEP/RC4 primarily by: increasing the IV from 24 bits to 48 bits Implementing a system for automatic rekeying called TKIP (Temporal Key Integrity Protocol) Cryptographic Characteristic WEPWPA802.11i (WPA2) Cipher for Confidentiality RC4 with a flawed implementation RC4 with 48-bit initialization vector (IV) AES with 128- bit keys Automatic RekeyingNoneTemporal Key Integrity Protocol (TKIP), which has been partially cracked AES-CCMP Mode Overall Cryptographic Strength NegligibleWeaker but no complete crack to date Extremely strong

22. 22 802.11i (or WPA2) In 2004, the IEEE 802.11 working group developed a security standard called 802.11i to be implement in 802.11 networks. 802.11i tightens security through the use of the AES encryption scheme with a 128-bit key 802.11i can be added to existing AP and NICs The128-bit key changes

23. 23 Other protocols used in 802.11i Authentication and data integrity in 802.11i and 802.11x rely on the Extensible Authentication Protocol (EAP) which has different options: Wireless Transport Layer Security (WTLS) protocol  Server and mobile devices must have digital certificates  Requires that Public Key Infrastructure (PKI) be installed to manage digital certificates Tunneled WTLS  Digital certificates are installed on the server only  Once server is securely authenticated to the client via its Certificate Authority, a secured tunnel is created.  Server authenticates the client through the tunnel.  Client could use passwords as mean of authentication

24. 24 Using Authentication server Access Point 1. Authentication Request 2. Pass on Request to RADIUS Server 3. Get User Lee’s Data (Optional; RADIUS Server May Store Authentication Data) 4. Accept Applicant Key=XYZ 5. OK Use Key XYZ Directory Server or Kerberos Server RADIUS Server / WAP Gateway RADIUS is an AAA (Authentication, Authorization, Accounting) protocol Once user authenticated, AP assigns user individual key, avoiding shared key. Applicant (Lee)

25. 25 Soft Access Point* Notebook With PC Card Wireless NIC Ethernet Switch Access Point Server 802.3 Frame Containing Packet (2) (3) Client PC (1) * Also called Rogue Access Point Soft AP Usually, a soft AP is a laptop loaded with cracking software Soft AP allow the hacker to get passwords, MAC address, etc.

26. 26 Wireless Intrusion Detection Systems Monitor the radio spectrum for the presence of unauthorized access points Conventionally, operate by checking the MAC addresses of the participating access points Use fingerprinting approach to weed out devices with spoofed MAC addresses Compare unique signatures exhibited by the signals emitted by each wireless access point against the known signatures of legitimate access points

27. 27 How Cracking Wireless Networks works? Visit Youtube.com Search for the following video Video name: Cracking Wireless NetworksCracking Wireless Networks Posted by: spektral311 Date: 9/8/2008 Copy of video in Review section of website

28. 28 Basic Terminology Accidental Association Wireless device latching onto a neighboring Access Point when turned on. User may not even notice the association Malicious association Intentionally setting a wireless device to connect to a network Installing rogue wireless devices to collecting corporate info War driving Driving around looking for weak unprotected WLAN

29. 29 Summary Questions What is meant by accidental association? Malicious association? What are the functions of a wireless access point? What is a SSID? How many SSIDs are needed in a WLAN with 3 wireless access points and 13 mobile stations? How good security measure is disabling the broadcasting of a WLAN’s SSID? What is WEP? How secure is a WEP-protected WLAN compared to WPA, WPA2, and 802.11i? Explain the operation of a RADIUS authentication server What is rogue AP? How can you detect a rogue AP? Answer Review Questions 2 in Notes’ section of class Website