This document discusses the security of Wi-Fi enterprise networks. It describes the Wi-Fi protocol which uses authentication and encryption methods. It analyzes vulnerabilities in some common authentication protocols like EAP-FAST and PEAP that allow brute-force cracking of passwords. The document demonstrates how an attacker can intercept user credentials with a fake access point and RADIUS server to crack captured PEAP passwords. It also notes that EAP-TLS is more secure since it uses certificates instead of passwords.

2. Is Wi-Fi Enterprise
so perfect?
2
Demchenko Oleksandr
Wargaming.NET | Persha Studia
08 Oct 2016

3. 3
About me
• IT Security Specialist at Persha Studia
• 7 years in IT
• 4 years in Information Security

4. 4
Wireless vs Wired

5. 5
Wi-Fi protocol
Protocol =
Authentication + Encryption

6. 6
Encryption
• None
• RC4 (WEP)
• TKIP (WPA)
• CCMP-AES (WPA2)

7. 7
Authentication
• Open – no password
• Shared – one password
• EAP – multi passwords

8. 8
EAP in Wi-Fi
Wi-Fi Client
4. Auth OK
1. Secret
2. Secret 3. Auth OK
Access Point
Network
RADIUS Server

9. 9
EAP methods
EAP-FAST
PEAP
EAP-TLS
LEAP
PEAP
EAP-TLS
EAP-MD5
EAP-POTP
EAP-PSK
EAP-PWD
EAP-TTLS
EAP-IKEv2
EAP-FAST
EAP-SIM
EAP-AKA
EAP-AKA Prime
EAP-GTC
EAP-EKE

10. 10
EAP-FAST
• Q. Why did Cisco develop EAP-FAST?
• A. Cisco developed EAP-FAST to support customers who cannot
enforce a strong password policy and wish to deploy an 802.1X EAP
type that does not require digital certificates…
@Cisco Q&A at http://goo.gl/1ACNXa

11. 11
PEAP
TLS Tunnel
MS-CHAPv2
Wi-Fi Client Corp Network RADIUS Server
TLS Tunnel
MS-CHAPv2

12. 12
Brute-force
• CPU
• GPU
• Special devices

13. 13
Brute-force
Password
• 8 characters (********)
• [a-z], [A-Z], [0-9], [ ~!@... ]
• 85 options per character
• Total 2,7 × 1015 passwords
GPU
• AMD 7970
• Price 250 $
• 7,3 × 109 hash / sec
vs
102 hours

14. 14
Password length
8
9
10
11
Length Time
102 hours
1 year
85 years
17270 years

15. 15
Time to guess the pass
30%
70%
After 30 minutes
Cracked UnCracked
75%
25%
After 96 hours
Cracked UnCracked

16. 16
PEAP Attack
Wi-Fi Client
Corp Access Point RADIUS Server
TLS Tunnel
MS-CHAPv2
Corp Access Point
(Fake)
RADIUS Server
(Fake)
Attacker

17. 17
Audit steps
1. Detect authorization type
2. Start fake RADIUS and Access Point
3. Intercept user credentials
4. Brute-force the credentials
Life Demo!

18. 18
EAP-TLS
TLS Tunnel
Certificates
Wi-Fi Client Corp Network
RADIUS Server
PKI Server

19. THANK YOU!