Wireless Hacking

Wireless LANs and footprinting Wireless LANs l see basic conceptsbasic concepts Linux versus Windows footprinting l you need a card that works with the tools l the tools need to make the card work in promiscuous mode (sniffing) l many cards and few chipsets

Building a war-drive kit Footprinting : locating APs l passive: listening to AP broadcasts l active: transmitting client beacons in search of AP responses Equipment l cards ( b, 11.g) -- choose the software first l Antennas (e.g. HyperLink Tech)HyperLink Tech l GPS Software (Windows) l NetStumbler (set SSID to ANY) active mode. Counter- measure: set AP not to reply to probes. NetStumbler

More in footprinting software Windows l StumbVerter: download. Uses MapPoint to plot data from NetStumbler StumbVerterdownloadMapPoint Linux l Kismet : both war-drive and sniffer. Uses passive mode (counter-measures difficult). Kismet l GPSMap : comes with Kismet and plots AP locations in maps, using ImageMagick, but is command-line intensive.ImageMagick l Dstumbler (requires kernel patch), better in BSD. Dstumbler

Wireless Scanning and Enumeration Packet-Capture and Analysis l Review of sniffing: FAQ, tools, concept.FAQtoolsconcept l Linux support not covered (too technical) l Ethereal is a good tool in Linux, we used in Hacking Linux. Ethereal l Windows: OmniPeekOmniPeek l requires custom driver, commercial but can download demo l channel scanning, decryption of WEP (needs key) l provides a Peer Map view of hosts found What you are looking for l SSID -- APs respond to a client ANY SSID with their SSID, and you are in if no username and password required. l MAC access control - OmniPeek maps MAC addressesmaps MAC addresses l WEP - war-drive tools indicate if used (e.g. NetStumbler).NetStumbler

Gaining access in SSID l easy to setup from the ward-drive information l just create a profile MAC Access Control l use the sniff information to identify valid MAC addresses. l spoof the MAC address of your wireless card (Read this article for counter-measures).article WEP (Wired Equivalent Privacy) l protects data from eavesdropping, not authentication l uses key between AP and card transmissions l brute-force, key and packet cracking off-line (e.g. Aircrack-ng)Aircrack-ng EAP (Extensible Authentication Protocol) Methods EAPMethods l A client finds an AP and is prompted for a username and password l Keys are create dynamically after login

Counter measures Some basic ideas: l recommendations to secure a WLAN.secure a WLAN l suggestions to minimize WLAN threats.minimize WLAN threats l overview of weakness and solutions for WLANs (old, but good).weakness and solutions l some commercial solutions: AirDefense, AirTight, SmartPass.AirDefenseAirTightSmartPass State-of-the-art solutions l WPA and WPA2: review and WindowsreviewWindows l Using a Radius server for authenticationRadius server l The IAS Radius service in Windows.IAS Radius l FreeRadius home page and tutorialhome pagetutorial 4 Some WLAN security guides. George Ou guide NIST draft