1. Wireless Security John Himmelein Erick Andrew Christian Adam Varun Bapna

2. Outline ● 802.11 Overview ● WEP ● Other security measures ● Attacks ● Lab motivation

3. 802.11 Overview ● IEEE 802.11 denotes a set of wireless standards definied by IEEE ● Most popular include 802.11a/b/g ● 802.11a is in the 5GHz band, b/g is in the 2.4GHz band ● 802.11i is intended to improve security

4. Security Features ● Service Set Identifier (SSID) ● Used to differentiate between access points ● Sent out in a beacon frame ● These are plain text messages

5. Associating with an AP ● Two initialization methods ● Shared Key or Open Key ● With Open Key anyone can talk to the AP ● Shared Key requires authentication as soon as association succeeds

6. Wired Equivalent Privacy (WEP) ● WEP uses the stream cipher C4 – RC4 generates a pseudorandom stream of bits (a "keystream") which is combined with the plaintext using xor – Decryption is performed the same way ● WEP uses two key sizes: 40 bit &104 bit – 64 bit and 128 bit WEP ● To each is added a 24-bit initialization vector (IV) which is transmitted in the clear.

7. WEP ● WEP has several weaknesses ● The weakness with RC4 is with the Initialization Vector (IV) ● This lead to several different types of attacks ● We will use a tool that combines two of these attacks, and the appendix will describe another

8. WEP attack #1 ● The 24 bit IV has a numerical limit ● Only 16,777,216 possible IVs ● Listening long enough, and IVs will be repeated ● Enough duplicate IVs and the WEP key can be determined

9. WEP attack #2 ● Another attack relies on the fact that some IVs are weak ● Using a formula, one can take a weak IV and infer part of the WEP key ● Listening to the network long enough and the WEP key can be discovered ● This attack, like the last one, can take a very long time

10. WEP attack #3 ● A new attack was developed by a hacker name KoreK ● This attack relies on gathering enough unique IVs ● This is a statistical attack that requires about 200,000 unique IVs to determine a 40-bit WEP key

11. Default Settings ● Most consumer access points are very easy to setup ● However, their default states have no security and are easy to lookup ● Despite this, many people leave their APs in this state, making them easy targets

12. Protecting Your Network ● There are several methods to increase the security of a wireless network ● Turning off SSID broadcasting ● SSID broadcasting helps attackers find your WLAN ● While not broadcasting will not stop anyone, it will make your network less interesting

13. MAC Address Filtering ● MAC address filtering allows only a set list of hardware devices connect ● In theory every device will have a unique MAC address ● However, using a sniffer the MAC address of a valid client is easily found ● Most wireless cards allow their MAC addresses to be changed

14. WPA - Wi-Fi Protected Access ● By increasing the size of the keys, the number of keys in use, and adding a secure message verification system, WPA makes breaking into a Wireless LAN far more difficult. ● The Michael algorithm was the strongest that WPA designers could come up with that would still work with most older network cards; however it is subject to attack. To limit this risk, WPA networks shut down for 30 seconds whenever an attempted attack is detected.

15. Lab Goals ● Determine router type and defaults ● Examining unencrypted traffic ● Bypassing MAC address filtering ● Cracking WEP using Aircrack ● Setting up a fake AP to steal login information

16. Network Layout

17. Unencrypted Traffic

18. MAC Address Filtering ● Sniff traffic for a valid MAC address ● Change your MAC address to the valid one (Spoofing) ● Full access if no encryption on the network

19. Cracking WEP with Aircrack ● Airodump collects packets ● Aircrack is used on the output file from Airodump ● It uses unique IVs to break the WEP key ● ~330,000 unique IVs and Aircrack broke the key in 1 second ● ~100,000 and it took 21 seconds

20. Fake AP ● The tool suite we will use allows us to setup our wireless card as an access point ● To make this useful we will need to do some work ● By deauthenticating a client from his AP, we can make him connect to our fake one ● By forging a web page we can potentially steal important login information ● This attack is very hard for the victim to realize until it is far to late

21. Links to tools ● Ethereal – – http://www.ethereal.com ● Kismet – – http://www.kismetwireless.net ● Auditor security collection - – http://new.remote-exploit.org/index.php/Auditor_main ● Aircrack – – http://www.cr0.net:8040/code/network/aircrack

22. References ● http://en.wikipedia.org/wiki/RC4 ● http://en.wikipedia.org/wiki/WEP ● http://en.wikipedia.org/wiki/IEEE_802.11 ● http://www.securityfocus.com/infocus/1814 ● http://www.cr0.net:8040/code/network/aircrack/

23. Questions?