Ehternet Security "Unplugged" .pptx

8/9/2022 Copyright © 2002 DFW Wireless Dot Org
Ethernet Security
“Unplugged”
Anthony Lauro | Founder
DFW Wireless Dot Org
Anthony.Lauro@dfwwireless.org
IEEE / APS 10/15/02

Challenges with Wireless
 Interference
 Vendor Interoperability
 Quality of Service
 Security

The Threats
Theft of proprietary information
Sabotage (DOS)
Attack Gateway (launching point)
Industrial Espionage
Terrorist Activity
Abuse of network resources (spam,
p0rn, illegal software)

Security Measures
And How They Fail…

Information Security Begins With You...

Fresnel Zone
 The radius of the Fresnel Zone at its widest point can be calculated by
the formula listed above, where d is the link distance in miles, f is the
frequency in GHz, and r is the radius off of the center line of the link in
feet.
Typically, 20% Fresnel Zone blockage introduces little signal loss to the
link. Beyond 40% blockage, signal loss will become significant.

Free Space Loss
Free Space Loss = 20Log10(Frequency in
MHz) + 20Log10 (Distance in Miles) + 36.6

802.11 Frame Types
 Data Frames - Carry user data
 Control Frames - Used for lower layer MAC functions
 Acknowledging frames (ACK Packet)
 Determining if it’s ok to transmit data (RTS, CTS)
 Management Frames - Used for managing membership to
the BSS
 Finding available access points
 Joining and leaving the BSS

Ministumbler
Listens for Beacon
probes and responses
sent out from APs and
records information
contained in the Control
Frame.
Information can be
exported from
Ministumbler and
imported into mapping
programs to create
detailed maps with an
overlay of all AP
information.

How Does Dallas Stand Up?

Statistics
 Of the 2,454 APs surveyed only 859 were running
encryption
 Over 65% of access points in the Dallas area are
running without encryption.
 Over 56% of those access points are running with
the default configurations.
IS YOURS?

MAC Filtering
Pros:
 Allows control of what MAC addresses are allowed to associate
with your network.
Cons:
 On most operating systems, MAC addresses can be easily
spoofed.
 An attacker can determine which MAC addresses are allowed by
monitoring network traffic.
 An attacker can still monitor communication on the network
without associating to your access point.

Examples of Spoofed MAC
Addresses
ifconfig eth0 hw ether 01:02:03:04:05:06

Closed Network Mode
Pros:
 Requires connecting clients to supply correct SSID and
channel to associate to the AP.
 Beacon Packets are not sent out to listening clients (will
prevent “accidental associations” and casual stumblers)
Cons:
 Through sniffing probe request and response frames the AP
can still be detected.
 Traffic can still be monitored and captured.

Examples of Closed Network mode being
Sniffed to find ESSID and other info.

Attacks Against Wireless
Proof of concept code:
Air-jack
 wlan-jack
 essid-jack
 monkey-jack
 kracker-jack
abaddon@802.11ninja.net

WLAN-Jack- De-Authentication – DOS
 Spoofs MAC address of Access Point
 Send de-authenticate frames to all clients within radio range.
 Sends continuously.
 Can send to broadcast address or specific MAC
 Users are unable to re-associate with Access Point

MonkeyJack - Man in the Middle Attack
Attack takes place in layers 1 and 2
Attack machine sits between access point and victim.
Deauthenticate victim from real Access Point
 Send deauthenticate frames to the victim using the access point’s MAC address as
the source
Victim’s card scans channels searching for new AP
 Victim’s 802.11 card associates with fake AP on the attack machine
Fake AP is on a different channel than the real one
 Attack machine’s fake AP is duplicating MAC address and ESSID of real AP
 Attack machine associates with real AP
 Attack machine duplicates MAC address of the victim’s machine.
 Attack machine is now inserted and can pass frames through in a manner that is
transparent to the upper level protocols

Code presented by Robert Baird & Mike Lynn @ Blackhat 2002

IP Level Countermeasures
Pros
 SSL, SSH, IPSec/VPN etc encrypts data being sent
to and from wireless nodes
 Additional levels of authentication can be used to
provide access controls to your wired network
Cons
 Big overhead for software based encryption
 Attackers may still have access to attack wireless
clients

Rouge Client Access

"We've had audits of customer sites that have
turned up 50, sometimes 100, rogue access
points they didn't know about,"
-Dave Safford, manager of the global security analysis lab at
IBM Research in Hawthorne, N.Y.

Rouge Client Scenarios

RF Signal Surveying
 Test signal strength through
walls of building and verify
how far beyond physical
boundaries of your building
your wireless signal can be
monitored.
 All it takes is 30% signal
strength to establish and
maintain a connection.

Mobilized Menace or Attacker?

Port Scanning, On the go….
 2002/06/04,11:26:40 -5:00 GMT,X.41.35.XX:49060,4.41.34.111:771,TCP (flags:S)

Discovery Tools
Netstumbler
AP Sniff
AP Tools
Airopeek
Sniffer Pro
WlanDump
AirTraf
Kismet
Dstumbler
PrismDump
AirSnort
MiniStumbler
CEniffer
VXSniffer

Attack Tools
 BSD Air-Tools
dstumbler v1.0
dweputils v0.1
prism2ctl v0.1
prism2dump v0.01
bsd source-mods v0.2
 wlan-jack
 essid-jack
 monkey-jack
 kracker-jack
 WEP Crack
 AirSnort

Security Measures
 LEAP (Radius) Authentication
 TKIP (Temporal Key Integrity Protocol)
 EAP/TLS
 SSH / SSL
 AES (Advanced Encryption Standard)
 VPN
 PSPF (Publicly Secure Packet Forwarding)
 Restrict Beacon and Probe responses
 WEP Plus (Weak IV-Solution)
 Broadcast Key Rotation
 RF Radiation Monitoring
 MAC address filtering
 Appropriate antenna placement and signal strength

Conclusions
 Use 802.11b security safeguards but do not rely on them
 Treat your wireless network as fully untrusted
 Use strong mutual authentication
 Use pass-through auth. devices whenever possible
 Restrict access by MAC address
 Enable WEP - Wired equivalent privacy
 With Key rotation if hardware supports it
 Use VPN technology
 Disable broadcast of ESSID
 Use crypto accordingly
 Block null ESSID connection

Questions? Comments?
 AirJack- Alpha http://802.11ninja.net
 Agere Orinoco – WEP Plus
http://www.orinocowireless.com/upload/documents/WEPplusWhitepaper.pdf
 AirSnort http://airsnort.shmoo.com/
 AirTraf http://airtraf.sourceforge.net
 CEniffer http://www.epiphan.com/products_ceniffer.html
 Cisco – PSPF
http://www.cisco.com/univercd/cc/td/doc/product/wireless/airo_350/350brdgs/brscg/br350ch1.htm
 Dachb0den Labs – Air Tools http://www.dachb0den.com/projects/bsd-airtools.html
 Internet Security Systems – (Wireless LAN Security FAQ)
http://documents.iss.net/whitepapers/wireless_LAN_security.pdf
 Marius Milner –MiniStumbler http://home.pacbell.net/mariusm/ and http://www.netstumbler.com
 NetStumbler http://www.netstumbler.com

Ehternet Security "Unplugged" .pptx

Recommended

Recommended

More Related Content

Similar to Ehternet Security "Unplugged" .pptx

Similar to Ehternet Security "Unplugged" .pptx (20)

Recently uploaded

Recently uploaded (20)

Ehternet Security "Unplugged" .pptx