Wireless Security


Rob Flickenger

Hacker Friendly LLC

Why is security a problem?

Long distance attack

Invisible intruder

Security risks

Who creates security problems?

wifimaps.com

Protecting your network

Basic tools you can use to protect your wireless networks (by increasing protection and complexity):

Closed networks

By turning off beacons, you can prevent your network from being shown in network scan utilities.

Advantages: Standard security feature supported by virtually all access points.

Disadvantages: "Closed" networks are not easily found in a site survey, and are easily found by passive monitoring tools.

MAC filtering

A MAC filter may be applied to an access point to control which devices may be permitted to associate.

Advantages: Standard security feature supported by virtually all access points.

Disadvantages: MAC tables are inconvenient to maintain. Also, MAC addresses are transmitted in the clear (even when using WEP encryption), and are easily copied and reused.

Encryption basics

Microsoft / Verisign PKI exploit

"In late January 2001, VeriSign erroneously issued two Class 3 code-signing certificates to someone falsely claiming to represent Microsoft. The certificates were issued in Microsoft's name, specifically "Microsoft Corporation". After issuing the certificates, a routine VeriSign audit uncovered the error in mid-March, about 6 weeks later."

http://amug.org/~glguerin/opinion/revocation.html

WEP encryption

Part of the 802.11 standard, Wired Equivalent Privacy provides encryption at layer two.

Advantages: Standard security feature supported by virtually all access points.

Disadvantages: Shared key, numerous security flaws, long-term maintenance impossible on large networks.

WEP problems in detail

Advanced 802.11 features

WPA

WPA encryption

While WPA (802.11i) will likely become the standard for protected Wi-Fi access, we are not there yet.

Advantages: Significantly stronger protection than WEP, open standard.

Disadvantages: Vendor interoperability problems, complex configuration, protection only on layer two.

WPA-PSK

PSK stands for Pre-Shared Key. The intent behind WPA-PSK was to provide a simple WPA solution comparable to WEP, but more secure.

Strong encryption software

Good end-to-end security software should provide strong Authentication, Encryption, and Key Management.

Examples include:

Man-in-the-middle

The main problem with implementing encryption at layer two is the possibility of man-in-the-middle (MITM) attacks.

Encrypted tunnels

End-to-end encryption provides protection all the way to the remote end of the connection.

SSH

In addition to providing simple shell access, SSH is a general-purpose tunneling tool.

Security tools

There are hundreds of free tools that will show you lots of information about your network:

Network ESSID scanners

NetStumbler: find networks

NetStumbler: signal strength

MiniStumbler

MacStumbler

Wellenreiter

Protocol analyzers

There are a variety of wireless protocol analyzers available. Some include:

AiroPeek

KisMac: details

KisMac: traffic

Kismet: networks

Kismet: info

Kismet: clients

Kismet on a Zaurus

Wireshark and Kismet: beacons

Wireshark and Kismet: filters

Wireshark and Kismet: WEP

nmap

Wireshark


http://www.wireshark.org/

Wireshark: http decode

Wireshark: TCP session

Etherpeg

Driftnet

ngrep

ettercap

airsnort

ntop

ntop: flows

ntop: info

In Summary

Using the proper tools, you can see precisely what is happening on your network.

By using strong end-to-end encryption, you can prevent others from using these tools to attack your networks.

The use of strong end-to-end encryption can also make it safe to use completely untrusted networks (from a public wireless AP all the way to the Internet).

Credits

Portions of this talk were adapted from Wireless Networking in the Developing World, http://wndw.net/