1. LM 4. Wireless Network Threats & Vulnerabilities
Dr. Lei Li
Wireless Security

2. Road Map Introduction WLAN Security Mobile Security
Overview
WLAN Threats
& Vulnerabilities
Mobile
Security
Security Auditing & Risk Analysis
Evolution of Wireless Network
Mobile Network
Overview
Infor. Security
Essentials
Cellular Network
Security
WLAN
Security
Mobile Security
Threats
WLAN
Security Tools
Mobile Devices
Security

3. Learning Outcomes After this module, a student will be able to:
Describe different types of attackers
Describe the vulnerabilities of WLAN in general
Describe WEP, WPA and WPA2 and their vulnerabilities.
Explain what’s passive attack and what’s active attack. List two examples of each types attack.
Describe confidentiality, access control, availability, authentication and integrity attacks on WLAN.
Discuss Bluetooth security features
Describe Bluetooth vulnerabilities and threats
Describe the threat models of the Ad Hoc wireless network

4. General Profiles of A Cyber Attacker
Attacker Example Motive Action
Script Kiddie/Skid
People interested in or only partially engaged in understanding offensive tools
Curious, Mischievous, Street Cred
Since they don’t know the tools they may be very noisy when attacking and perform a lot of attempts, may have the most harmful consequences
Expert Attackers
@th3j35t3r, Ed Skodus, Kevin Mitnick,
Various motives, curiosity, money, patriotism, etc.
Only limited by their imagination, can steal, spy, and sell exploits on the unethical market
Activist/Hack tivists
Manning, Snowden, Anonymous
Further a Cause
Reveal Information, further a cause, deface websites, or disrupt progress of opposition
Nation States
Stuxnet
Espionage: Stealing, Disrupting Services Logic Bombs, support law enforcement & military
Gain a greater understanding of allies and enemies
Terrorists
ISIS Defacement of US disabled Veteran websites, DDoS of power grids, Chemical Changes in Water
Infiltrate, destroy data, cause political upheaval, death, manipulate data in order to promote a cause
Cybercrime
Mafia
Money
DOS against financial institutions, steal credentials, sell illegal goods, anything for money, Crime as a Service (CaaS), Ransomware variants, credit card theft, etc.
Insider Attacker
Current or Former Employee
Revenge, could be clueless employees too
Destruction of data, altering data, or stealing information

5. WLAN Vulnerabilities
WLAN-Flexibility, cost-effectiveness, & easy of installation
Use of Radio Frequency
Difficult to contain the signals
Vulnerabilities in security standards
Easy to setup often means more network not properly configured for secure access

6. Security Standards WEP (Wired Equivalent Privacy)
Created in by IEEE b
Provide same level of privacy as that of wired LAN
40/104 bit key are static & IV is short
No effective key management
Encryption algorithm (RC4) Known flaws
Easy target for cryptanalysis
Shouldn’t be used in today’s WLAN

7. Wi-Fi Protected Access (WPA)
Developed in 2004 by i to address issues of WEP
Use 48bits TKIP
Add Integrity protection
Enterprise and personal mode
Enterprise mode use EAP and 802.1x for access control and authentication
Backward compatible with old device employs WEP
Still uses RC4
Vulnerable to dictionary, brute force, and DoS attacks

8. WPA2 Successor to WPA, ratified by IEEE 11i in 2004
Most secure security standard available
Replace RC4 & TKIP with AES and CCMP for encryption and authentication
More seamless roaming
Still have vulnerability

9. Enterprise Mode Vs. Personal Mode
Exist in WPA & WPA2
Same encryption algorithms
Different authentication method
Enterprise mode – 802.1x, designed for organizations
Personal mode – pre-shared keys, designed for home use

10. http://searchnetworking. techtarget

11. Attacks to WLAN Passive attack Unauthorized access Traffic analysis
Active attack
Unauthorized access
Rogue access point

12. Confidentiality Attacks
Traffic analysis
Eavesdropping
Man-in-the-Middle attack
Evil Twin AP

13. Access Control Attacks
War driving
Rogue access point
MAC address spoofing
Unauthorized access

14. Integrity Attack Session hijacking Reply attack
frame injection attack
data replay attack
data deletion

15. Availability Attacks DoS/ Queensland DoS RF Jamming
beacon flood
association flood
de-authentication
Fake SSID
EAPOL flood
AP theft

16. Authentication Attack
Dictionary & brute force
Shared key guessing
PSK cracking
Application login theft
Etc.

17. Bluetooth Security Security mode 1 Security mode 2 Security mode 3

18. Bluetooth Threats & Vulnerabilities
Encryption key length negotiate
No user authentication
Much more
Threats
Bluesnarfing
Bluejacking
Bluebugging
Etc.

19. Ad Hoc Wireless Network Threats
Internal threats
External threats
Routing threats

20. Reference
Praphul Chandra, Bulletproof Wireless Security: GSM, UMTS, , and Ad Hoc Security, ELSEVIER, 2005.
Jim Doherty, Wireless and Mobile Device Security, Jones & Bartlett Learning, 2016.