- What threats might we encounter
in either our wireless networks,
or what threats can we impose on wireless networks?
We're gonna talk about confidentiality,
integrity, and availability,
the CIA triad,
which you may or may not have heard of
in the coming slides.
So how can we evade access?
We got MAC Spoofing, Ad-hoc Networking,
Misconfigured APs, and Rogue APs.
We're gonna talk about all these in these subsequent slides.
But let's talk about CIA triad stuff first.
Let's talk about integrity.
So what is integrity?
It is the,
I call it an assumption
that the data has not been manipulated.
So how can we compromise the integrity of wireless networks?
We have six strategies listed here on this slide,
from Initialization Vector Replay,
injection of frames into the wireless network,
replaying data, replaying authentication data,
injecting data frames,
replaying RADIUS authentication frames.
On the confidentiality side of things which is,
I have this data, can somebody else see it?
What strategies can be employed
in order to compromise confidentiality?
Several options listed here for that as well.
Machine-in-the-Middle, HoneySpot, cracking WEP,
this would, you know, break the encryption
and you could get access to the data.
Session Hijacking, Evil Twin,
as well as Eavesdropping.
We're gonna talk about a lot of these concepts here
within this lesson.
And then finally, in the CIA triad we have availability
and that is, is the resource or data available
when it needs to be accessed?
What threats are there to compromise availability
of the wireless network itself?
We have Denial of Service, Floods,
both Deauth and Beacon.
That's Deauthentication, that is the forceful kicking off
of a client from a wireless network.
Disassociation attacks,
and then finally the actual physical requisition
of the Access Point itself.
So if you were to pick up the Access Point
and walk away with it,
that is a method to compromise
the availability of the wireless network,
that that particular Access Point is serving.
We have Rogue Access Point attacks and the Evil Twin attack.
Let's talk about both of these.
So if you have a wired network,
we have switches here, we have a router,
we have some access points plugged into that switch.
If I get access to that physical environment
where and I can plug something into the wall,
that is eventually connected to a switch
that is, you know, part of the network,
could I then stick an access point on the network?
Now these wireless networks often extend
past the walls of a building.
So if I get physical access to an environment,
let's say I put on my orange vest,
I put on my hardhat, I grab the ladder,
and I grab my duffle bag full of tools.
Maybe at the bottom of that bag is a wireless access point.
Doesn't need to be anything fancy,
just grab a off the shelf wireless access point.
And let's say I get past that first layer of security,
the person sitting at a desk
when you walk in the front door.
I get past that and I can just freely roam the office space.
I take out that access point, I plug it into that switch,
make sure it's close to a wall,
go get in my car, join the network.
And now I have access to the wired network on the inside.
Completely bypassed any perimeter security that might exist
up towards the internet.
This is the Rogue Access Point attack.
It is the attachment
of a wireless access point to an existing
local area network, which would allow someone to join
and completely bypass any perimeter defenses you might have.
Humans are quite often the weak point
when it comes to network security.
Now, there is a point listed here
at the bottom of the slide,
strict enforcement of access-port
access control policies can prevent this.
That's a bit of a tall order.
Being able to know the MAC address that is commonly used
meaning the MAC OUI prefix,
those first three bites of the MAC address
and blacklisting those.
Meaning you'd have to know all the vendors
that create access points.
You have to know all the OUIs
and then blacklist them across your network,
or do static Mac address permissions on the switch.
It can get extremely complicated.
However, provided you want to go
to that level of detail with your security,
then you could have,
you could protect yourself from this particular attack.
It's more valuable to simply train people.
Question, why are you in my space? (laughs)
And why are you plugging in an access point under my desk.
Misconfigured AP attack.
This isn't, I wouldn't call this necessarily an attack.
It's more of an accident.
So SSIDs are often
assumed to be passwords,
some form of authentication.
However, the SSIDs are freely broadcast in beacon packets
unless you have explicitly disabled that functionality.
So it's easy to know SSIDs.
You can turn on your laptop.
You can click a little dropdown.
You can see all the networks that exist around you.
Don't rely on SSIDs for any form of authentication.
Don't rely on hidden SSIDs
for any form of protection.
Ad-hoc connection attack.
This does rely upon the wired client being infected
by something.
That malicious software could then
turn the particular computer,
in this case is a laptop plugged in with a wire
to a wired network,
could be a desktop with Wi-Fi capability
and then turning on ad-hoc mode.
So most devices today,
whether it's a cell phone, a laptop,
do still have this functionality
to do ad-hoc wireless networking.
And it allows you to do point to point Wi-Fi
between two devices without an access point in the way.
So if you are able to fire up Metasploit,
send that email with a malicious payload.
This particular user happens to click on it,
installs some software, turns on ad-hoc,
and then you have bypassed the perimeter defenses
which might exist sort of out in this area right here.
The HoneySpot attack.
HoneySpot attack is where you take an access point
and you try to replicate an existing wireless network.
Let me give you an example of this.
You go to a popular coffee shop
and they offer free Wi-Fi
because they want you to stay there
and drink as much coffee as possible.
They're offering free Wi-Fi.
They're broadcasting some SSID
for their customers to use.
What would happen if you have an access point
in your backpack,
running off of a battery that used the same SSID
as that coffee shop,
you could potentially lure victims
to join your access point.
Once they have joined your access point,
then you have access
and provided you give them internet access, of course.
Once you have them joined to your access point
you have access to their data.
Data that is flowing from their computer
towards the internet
is now going through a device that you control.
AP MAC spoofing.
We touched on this previously,
when we talked about changing your MAC address
on your computer.
Some wireless services will use the MAC address
as a form of authenticator, in that
when you try to service it says you need to pay to serve.
So you would then enter your credit card information
and it uses your MAC address
as the identification mechanism for that paid-for service.
Once that person disappears
or even while they're still there,
if you assume their Mac address
might you then be able to have free access?
Bypassing that pay wall.
Deauthentication.
This is purposefully built into the Wi-Fi standard.
We have this quote here from Joshua Wright in 2005
"Sanctioned technique to inform a rogue station
that they have been disconnected from the network."
You can fake these things
so you can send a deauth packet to anyone out there
and they will disconnect from the network.
Most of the time.
Provided it reaches the intended destination. (laughs)
It's sent to the host.
You're spoofing the source MAC.
That is the source MAC of the actual BSSID
that they are connected to.
You must be within range of this client
so they can hear you.
And why would we want to do this?
It's because we need to capture
that message integrity check that happens with WPA
and that is only done upon initial connection.
So if we deauth the client while we're capturing packets
they reassociate, deauth them again, reassociate,
we can capture that MIC much faster.
You can also compromise availability
by doing a denial of service
by sending deauths to everyone.
You'll notice in this example here
we have omitted the client when using the aireplay command
with the deauth packet.
And I think on the previous slide, I had an example.
Let's run through this example
and then we'll talk about the next one.
So aireplay deauthentication attack specified here
is one particular frame.
We're gonna send the access point
that we are going to spoof.
And then the client to be deauthenticated,
followed by the wireless network
we want to send this deauth packet on.
So when it comes to deauthing everybody,
we simply omit the client
and we'll send it out wlan0.
This is our access point.
And deauth, if we do a zero as the option.
After the deauth attack
then it will just keep sending deauths to everybody.
Jamming.
Very important to note, this is illegal.
At least here in the United States where I am,
this is illegal.
But these products do exist.
It is possible to procure these
and purposefully interfere with wireless networks,
Wi-Fi cellular, handheld type radios.
You can get a jammer for it.