1. 7/31/2002Black Hat 2002, Las Vegas NV Advanced 802.11 Attack Michael Lynn & Robert Baird

2. 7/31/2002 Black Hat 2002, Las Vegas NV What Is NOT Covered 802.11b MAC address spoofing WEP vulnerabilities WEP Key cracking techniques Radio signal amplification

3. 7/31/2002 Black Hat 2002, Las Vegas NV What Will Be Covered Attack Scenarios – Denial of service using forged management frames – Using shared key auth. to generate IP traffic. – 802.11 layer Man-In-The-Middle attack Practical Application – Fun with custom management frames

4. 7/31/2002 Black Hat 2002, Las Vegas NV Attack Scenarios Denial of Service - Forged frames – Management frames not authenticated – Use MAC address of AP – Send de-authenticate and disassociate frames Send continuously Send to broadcast address – AP users are unable to re-associate with AP

5. 7/31/2002 Black Hat 2002, Las Vegas NV Attack Scenarios Denial of Service – forged frames – Requirements Air-jack drivers WLAN-jack

6. 7/31/2002 Black Hat 2002, Las Vegas NV Attack Scenarios Shared key authentication attack – Observe plain text challenge – Observe cipher text response – XOR plain text with cipher text to get key stream – XOR IP packet with key stream re-using IV – Broadcast ping

7. 7/31/2002 Black Hat 2002, Las Vegas NV Attack Scenarios Man-In-The-Middle attack – 802.11 layer insertion – Victim attack machine AP – In line for key exchanges VPN/IPSEC tunnel setup SSL connection setup SSH connection setup – Effects on wireless authentication gateways

8. 7/31/2002 Black Hat 2002, Las Vegas NV Mitigation Strategies Wireless IDS – Air Defense VPN + strong two way Authentication RF signal shaping (antenna radiation patterns) – Helps avoid signal leakage from property A big guy with a stick

9. 7/31/2002Black Hat 2002, Las Vegas NV Advanced 802.11 Attack Robert Baird & Michael Lynn