Chapter 10 – Wireless Security pot

Wireless Problems• Easy to get access to airwaves, hard to restrict!. Wireless Countermeasures• Turn off SSID broadcasts problems?. Transmission Encryption• WPA PSK – Shared password – U

All-In-One Edition Chapter 10 – Wireless Security

Brian E Brzezicki

Look No Wires!

Wireless LAN protocols

802.11 standard

• Wireless LAN networking

• Data Link layer specifications

• Components

– Access point (a type of bridge)

– Wireless Card

– SSID

Wireless Problems

• Easy to get access to airwaves, hard to restrict!

Talk about the attacks next

Wireless Attacks

NetStumbler

War chalking symbols

Man in the Middle

• Airsnarfing, put up a fake access point get people to connect with you

Evesdropping and attaining

non-authorized acess

• Evesdropping

– Air Snort – breaks WEP retrieves encryption keys

(security+ exam reference airsnort, even thought it’s no longer developed)

– aircrack-ng – breaks WEP and WPA-psk

Wireless Countermeasures

• Turn off SSID broadcasts (problems?)

• Enable MAC filtering (problems?)

• Use Encryption (we’ll talk about this next)

• Use Enterprise Mode for authentication

– Easily crack able (due to key reuse)

– Only option for 802.11b

(more)

Transmission Encryption

• WPA PSK

– Shared password

– Uses TKIP normally

• RC4 with changing keys– Can use AES (not certified)

• 128 bit key

• WPA2 PSK

– Uses AES (normally)

• 128 bit key– Can use TKIP

• RC4 with changing keys

(more)

Transmission Encryption

• WPA or WPA2 in Enterprise Mode

– Uses 802.1X authentication to have individual passwords for individual users

• RADIUS – what was radius again?

• 802.11i – the official IEEE wireless security spec, officially supports WPA2

Wireless Device to Device

Communication

Bluetooth

– Allows full use of phone

– Allows one to make calls

– Can eavesdrop on calls

Bluetooth Countermeasures

• Disable it if your not using it

• Disable auto-discovery

• Disable auto-pairing

WAP

Wireless Application Protocol – a protocol developed mainly to allow wireless devices (cell phones)

access to the Internet.

• Requires a Gateway to translate WAP <-> HTML

(see visual)

• Uses WTLS to encrypt data (modified version of

TLS)

• Uses HMAC for message authentication

• WAP GAP problem (see visual and explain)

• A lot of wireless devices don’t need WAP anymore… why?

WAP

WAP GAP

As the gateway decrypts from WTLS and encrypts as SSL/TLS, the data is plaintext If someone could access the gateway, they could capture the communications

Chapter 10 – Review Questions

Q What encryption protocol does WEP use

Q What 2 key lengths does WEP support

Q What encryption protocol does WPA2 use?

Q Why is MAC filtering or turning off SSID

broadcasting not sufficient security?

Q What does WAP use for security?

Chapter 10 – Review Questions

Q What is the WAP GAP

Q Define how to accomplish a MiM attack on a wireless

Wireless security

• Access control

– Turn off SSID broadcasts (problems)

– MAC filtering (problems)