Ethical Hacking Defeating Wireless Security

2 Contact Sam Bowne Sam Bowne Computer Networking and Information Technology Computer Networking and Information Technology City College San Francisco City College San Francisco Web: samsclass.info Web: samsclass.info

3 Two Hacking Classes CNIT 123: Ethical Hacking and Network Defense Has been taught since Spring 2007 (four times) Face-to-face and Online sections available Fall 2008 CNIT 124: Advanced Ethical Hacking Taught for the first time in Spring 2008

4 Certified Ethical Hacker Those two classes prepare students for CEH Certification Those two classes prepare students for CEH Certification

5 Certificate in Network Security

6 Associate of Science Degree

Equipment Wireless Network Interface Cards (NICs) and Drivers

8 The Goal All wireless NICs can connect to an Access Point All wireless NICs can connect to an Access Point But hacking requires more than that, because we need to do But hacking requires more than that, because we need to do Sniffing – collecting traffic addressed to other devices Sniffing – collecting traffic addressed to other devices Injection – transmitting forged packets which will appear to be from other devices Injection – transmitting forged packets which will appear to be from other devices

9 Windows v. Linux The best wireless hacking software is written in Linux The best wireless hacking software is written in Linux The Windows tools are inferior, and don't support packet injection The Windows tools are inferior, and don't support packet injection But all the wireless NICs are designed for Windows But all the wireless NICs are designed for Windows And the drivers are written for Windows And the drivers are written for Windows Linux drivers are hard to find and confusing to install Linux drivers are hard to find and confusing to install

Wireless Security

11 Three Security Settings No security No security WEP (Wired Equivalent Privacy) WEP (Wired Equivalent Privacy) Old and broken Old and broken Easily hacked Easily hacked WPA and WPA2 (Wi-Fi Protected Access) WPA and WPA2 (Wi-Fi Protected Access) Very secure Very secure The only significant vulnerability is to a dictionary attack, if the key is a common word The only significant vulnerability is to a dictionary attack, if the key is a common word

Wireless Security in San Francisco Measured by CCSF students on Nov 18, 2008 Measured by CCSF students on Nov 18, 2008 WEP is the most popular security technique! WEP is the most popular security technique! 12

Cracking WEP Tools and Principles

14 A Simple WEP Crack The Access Point and Client are using WEP encryption The Access Point and Client are using WEP encryption The hacker device just listens The hacker device just listens Hacker Listening WEP- Protected WLAN

15 Listening is Slow You need to capture 50,000 to 200,000 "interesting" packets to crack a 64-bit WEP key You need to capture 50,000 to 200,000 "interesting" packets to crack a 64-bit WEP key The "interesting" packets are the ones containing Initialization Vectors (IVs) The "interesting" packets are the ones containing Initialization Vectors (IVs) Only about ¼ of the packets contain IVs Only about ¼ of the packets contain IVs So you need 200,000 to 800,000 packets So you need 200,000 to 800,000 packets It can take hours or days to capture that many packets It can take hours or days to capture that many packets

16 Packet Injection A second hacker machine injects packets to create more "interesting packets" A second hacker machine injects packets to create more "interesting packets" Hacker Listening and Injecting WEP- Protected WLAN

17 Injection is MUCH Faster With packet injection, the listener can collect 200 IVs per second With packet injection, the listener can collect 200 IVs per second 5 – 10 minutes is usually enough to crack a 64-bit key 5 – 10 minutes is usually enough to crack a 64-bit key Cracking a 128-bit key takes an hour or so Cracking a 128-bit key takes an hour or so Link l_14r Link l_14r

Cracking WEP The Attack

19 Airodump Sniffs packets to find networks Sniffs packets to find networks

20 Aireplay Finds an ARP packet and replays it to make cracking faster Finds an ARP packet and replays it to make cracking faster

21 Data This makes the #Data value go up much faster This makes the #Data value go up much faster We need at least 50,000 Data (IVs) to crack WEP We need at least 50,000 Data (IVs) to crack WEP

22 Aircrack The captured IVs make the keyspace much smaller The captured IVs make the keyspace much smaller Aircrack performs a brute-force attack on all remaining keys Aircrack performs a brute-force attack on all remaining keys