Wireless Network Monitoring Plan B Project Sandeep P Karanth Advisor: Prof. Anand Tripathi

Outline Overview of Konark IEEE 802.11 Wireless LANs Introduction Overview of Konark IEEE 802.11 Wireless LANs Potential Threats to a Wireless LAN Modes of Operation Detection Logic Conclusions and Future work

Introduction Network Monitoring issues: Large Networks Heterogeneous components Distributed monitoring Centralized event-viewing and control Quick Response to alerts Response against attackers/intruders Response against misconfigurations/failures Robust and Secure system

Konark: Overview Script based detection techniques Mobile-Agent based network monitoring Object capable of migration first-class objects – altered remotely Programming framework – Ajanta Script based detection techniques tedious to install, debug and modify coarse-grained protection

Konark: Overview (Contd..) Goals: Dynamically Extensible Addition of new monitoring components Modification of existing monitoring policies Integration of tools Active Monitoring Modification of policies in response to events Online Monitoring Event monitoring in real-time

Konark: Overview (Contd..) Goals (contd..): Resilience by diverse monitoring sources Secure System itself has to be secure Robust Automated recovery of failed system components Scalable Acceptable System Performance

Konark: Overview (Contd..) Publish-Subscribe network monitoring system Monitoring agents equipped with detectors Publisher-subscriber relationship is dynamic Event model for information flow Automated agent and detector recovery Uses self-monitoring schemes Authenticated inter-agent communication (RMI) Challenge-response protocol

Konark: Overview (Contd..)

IEEE 802.11 Wireless LAN IEEE 802.11 operates at PHY and MAC Operating modes: Infrastructure Ad hoc Carrier Sense Multiple Access (CSMA) Collision Avoidance (CA) Binary Exponential Back-off algorithm

IEEE 802.11 Wireless LAN (contd..) Terminology: Access Point (AP) Service Set Identifier (SSID) Basic Service Set (BSS) Independent BSS (IBSS) – Adhoc network Extended Service Set (ESS) – APs having same SSID Distribution System (DS) – connects APs Wired Equivalent Privacy (WEP)

IEEE 802.11 Wireless LAN (contd..) Generic 802.11 frame format

IEEE 802.11 Wireless LAN (contd..) Generic Management frame

IEEE 802.11 Wireless LAN (contd..) Association Process

IEEE 802.11 Wireless LAN (contd..) Frame types: Beacon Frame – AP advertisement Probe Request / Response Reassociation Request / Response Authentication: Open Authentication (MAC ACLs used) Shared Key authentication

Potential Threats and Management Issues MAC Address Spoofing: Attacker impersonates a legitimate client Attacker fakes as a legitimate AP (Fake AP) Attacker sends spoofed deauthenticate/disassociate frames Denial-Of-Service Attacks: Authenticate/Associate message floods on AP RTS frame floods

Potential Threats and Management issues (contd..) Network Misconfigurations / Failures AP failure Unauthorized or Rogue APs May not conform to security policies Policy Conformance Acceptable signal strengths Acceptable data rate Correct SSIDs Attack Tools: macchanger, FakeAP, LibRadiate

Design Goals Monitoring Objectives Service Provisioning Objectives: Attack Detection and response Unauthorized use detection and response Component failure detection Service Provisioning Objectives: User tracking service – Pervasive applications

Modes of Monitoring System Operation: Notebooks/PCs executing a monitoring daemon Statically placed Strategically placed to get entire network coverage Mode 2: A PDA/handheld running a monitoring daemon

Modes of Monitoring System Operation(Contd…) Mode 2: (contd..) Campus walk taken by wireless security auditor Mode 3: Access Points log information to a syslog file Syslog file analyzed for event generation

Modes of Monitoring System Operation(Contd…)

Detection Logic and Response Sequence number Analysis: Each frame has a 12-bit sequence number Put in by the firmware Range of sequence numbers: 0 - 4095 Sequence numbers of 2 stations are not likely to be the same Fake and legitimate station will have out-of-order sequence numbers

Detection Logic and Response (contd..) Sequence number analysis (contd..): Packet capturing software and dump analyzer used to analyze Dump analyzer slower than capturing software (packets captured are dropped) Only 1 in 10 beacon frames analyzed to account for slow analysis Threshold of 20 chosen for difference in seq. no. for the same source

Detection Logic and Response (contd..) Sequence number analysis (contd..): Detection Capabilities: Faking client detection Fake AP detection Forced disassociation/deauthentication Fails if unauthorized user connects in a disjoint time frame Likely time policy Inform users when they connect

Detection Logic and Response (contd..) Sequence number analysis (contd..): Fails if unauthorized user connects to another BSS in an ESS Konark monitoring agents perform distributed correlations to detect this Correlation of events among AP logs helps us detect this

Detection Logic and Response (contd..) Packet counting and analysis Packets sent to an AP are recorded Many packets in a small adjustable interval indicate a DOS attack AP logs also examined to detect such attacks

Detection Logic and Response (contd..) Misconfiguration/Failure detection Missing beacons imply AP failure Beacons may be disabled in an AP (policy) Ping every AP with a probe request Extraneous beacons/ frames with unknown BSSID implies Rogue APs Network baseline fed to the daemon at startup Repeated associations, DHCP denials or unknown frame transmittals imply brute force attacks or client misconfiguration

Detection Logic and Response (contd..)

Experimental Setup Experiments conducted on the EECS building wireless LAN (802.11b) Cisco Access Points (Aironet 340/350 series) Notebook PCs running Linux used to conduct experiments Cisco 340/350 wireless cards used for wireless connectivity

Experimental Setup (contd..) Packet capturing software used Kismet (Development version 2.8.1) Dump analyzer – Ethereal Named pipe Pipe Kismet Ethereal Monitoring Daemon Capture packets Decode packets Analyze decoded packets

Experimental Setup About 90-95% of the frames observed are IEEE 802.11 management frames Beacon frames form 90% of the management frames Beacon interval is 0.1024 seconds

Experimental Setup Mon May 26 15:31:00 2003 Deauthentication SrcAddr:00:40:96:47:99:13 DestAddr:00:40:96:33:4c:8c BSSID:00:40:96:47:99:13 Mon May 26 15:31:00 2003 Authentication SrcAddr:00:40:96:33:4c:8c DestAddr:00:40:96:47:e6:ec BSSID:00:40:96:47:e6:ec Mon May 26 15:31:01 2003 Sequence number mismatch: SrcAddr:00:40:96:41:d4:01 Details:Unauthorized Client suspected Mon May 26 15:31:01 2003 Reassociation Request SrcAddr:00:40:96:33:4c:8c DestAddr:00:40:96:47:e6:ec BSSID:00:40:96:47:e6:ec Mon May 26 15:31:04 2003 Sequence number mismatch: SrcAddr: 00:40:96:41:d4:01 Details:Unauthorized Client suspected

Conclusions A MAC layer monitoring tool is required A proof-of-concept monitoring tool is implemented Such tools can be easily integrated with existing monitoring systems (Konark)

Future Directions Cost efficient ways of monitoring MAC layer need to be determined Efficient methodologies for building intrusion detection systems for thin clients are required Ajanta agents need to be customized to run on handhelds and wearable computers