OWASP Delhi November Meet - Hacking Wireless Networks by Mandeep Singh Jadon

1. HACKING WIRELESS
NETWORKS
THE IN DEPTH STORY OF WHAT ARE WE HACKING
BY : MANDEEP SINGH JADON
( InfoSec enthusiastic)

2. WHO AM I ?
 Mandeep Singh jadon
 Unfortunate things about me :
 Doing a unique thing called “BTECH”
 From UPTU
 Fortunate things about me
 I troll 
 Founder at Ultimate 1337 trolls (https://www.facebook.com/1337trolls/)
 Am into the Infosec field
 Part time bug bounty hunter
 Eager to learn new stuff
 I am passionate about singing 
 I am a Facebook Addict 

3. What this session will cover
 What is WLAN .
 Basic Terminologies .
 Wireless Sniffing
 Details Of Wlan from a networking perspective
 Security Measures Like Mac SSID Hiding and Mac Filters
 Bypassing them
 WLAN Authentication
 WEP And WPA in detail
 Cracking Them
 Introduction to WPS Attack
 New trends in Wireless Attacks (Takeaways)
 Security tips
 And Trolls …. Lot Of Trolls ……

4. What is WLAN ??
 A Wireless local area network (WLAN) links two or more devices
using some wireless distribution method and usually providing a
connection through an access point to the wider Internet .
 Most modern WLANs are based on IEEE 802.11 standards, marketed
under the Wi-Fi brand name.

5. Terminologies in WLAN
Access Point (AP) - A network device that serves as a
communications "hub" for wireless clients. (basically known as router) .
Basic service set (BSS) - It is a set of all stations that can communicate
with each other. Every BSS has an identification (ID) called the BSSID,
which is the MAC address of the access point servicing the BSS.
SSID (Service Set Identity) - It is also known as the "wireless
network name", the SSID is a 32 character, case sensitive name given
to a Basic Service Set established by an access point.

6. Continued …
WEP (Wireless Encryption Protocol) - WEP is a mechanism for
authenticating WLAN clients and for end data encryption in 802.11wireless
LANs.
WPA (Wi-Fi Protected Access) – It is introduced during 2006 by the Wi-
Fi Alliance, WPA employs techniques developed by Cisco and others,
namely TKIP and MIC, to generate unique and dynamic keys for WEP's
RC4-based encryption.
Beacon frame - It is one of the management frames in IEEE 802.11 based
WLANs. It contains all the information about the network. Beacon frames
are transmitted periodically to announce the presence of a wireless LAN.
Beacon frames are transmitted by the Access Point (AP) in an
infrastructure BSS.

7. Continued ..
 IEEE 802.11 – It is a set of media access control (MAC)
and physical layer (PHY) specifications for implementing wireless
local area network (WLAN)
 4 Way Handshake – It’s a cryptographic message exchange
between the AP and The client which authenticates the client to
connect to the AP

8. SO WHY WIRELESS SECURITY????
• Everyday we’ve been using wifi for our day to day
work such as Social media , banking ,
development, research , education and endless
other things.
• Sensitive information is literally flowing in air
inviting hackers to intrude them .

9. The awful challenges in wireless !!
 You can’t see it , so how will you protect it :p
 With the arrival of wireless cards , the malicious guy can break into
the network miles away !!! (Passive)
 Very difficult to locate the attacker .
 (Directional Antennae )

10. Wireless Sniffing
 Exactly same as wired sniffing .
 “The promiscuous mode” 
 Listens all the traffic whether it is destined to that or not .
HOW DO WE DO ???
AIRMON-NG 
DEMO !!

11. The Band and Channel theory
 WLAN Operate following bands
 2.4 GHz (802.11b/g/n)
 3.6 GHz (802.11y)
 4.9 GHz (802.11y) Public Safety WLAN
 5 GHz (802.11a/h/j/n/ac)
 Each band is divided to various channels .
 AT ANY TIME YOUR WIRELESS INTERFACE CAN BE ONY AT ONE
CHANNEL
 Problem ??? Lets Hop with airodump-ng 

12. Channel Ranges for the Bands

13. DEMO TIME

14. WLAN PACKET TYPES
 3 Types
i. Management
ii. Control
iii. Data
 Read more :
http://www.wildpackets.com/resources/compendium/wireless_lan/
wlan_packet_types
 In case you’re thirsty
http://standards.ieee.org/about/get/802/802.11.html

15. Beacon frame
 Beacon frame is one of the management frames in IEEE 802.11 based
WLANs. It contains all the information about the network. Beacon frames are
transmitted periodically to announce the presence of a wireless
LAN. Beacon frames are transmitted by the Access Point (AP) in an
infrastructure Basic service set (BSS). (wikipedia)
 YES . . . . EVERYTHING IS IN PLAINTEXT

16. Demo time !!
ANALYSIS Of Beacon Frames
Analysis of Beacon Frames
Injecting Arbitrary Beacon frames in the
network (MDK)

17. AP AND CLIENT COMMUNICATION
The behind the scenes of whats
happening .
Courtesy : IEEE docs

18. Don’t believe until you see ….

19. Now we HACK !!!!!!!!! 
 Security measure : Hidden SSID
 Blocking the SSID broadcasting in the beacon frames
 But is it a security measure ? ? ?
 Really ??
 I mean really ?? :p
 Lets see a DEMO

20. Where is the actual problem ?
 The “probe request ” and “Probe response” contains the SSID
 Whenever a legitimate client connects to the AP it has previously
connected to , it will send these probe request packets .
 Airodump would see these packets and would figure out the things
for us 
 ATTACK SENARIO
a. Non violence type
b. Violence type
AGAIN DEMO 

21. Security Measure : Mac Filters
 In computer networking, MAC Filtering (or GUI filtering, or layer 2
address filtering) refers to a security access control method whereby
the 48-bit address assigned to each network card is used to
determine access to the network. (wiki)
 How does it work in wireless ?
 Whitelisting the allowed mac in the AP .
but ……………
Are they really secure ….. Really ?? :p

22. The Problem
 Mac address cannot be changed , but can be spoofed very easily
 Since Mac will be the only auth mechanism in the current case , so
once it is spoofed we can enter the network .
 Mac addresses are visible in the WLAN Header so the attacker can
easily get the legitimate MAC .
 In the wireless world it simply does not make sense :p
 TWO ATTTACK scenarios
a) Gandhi Attack
b) Bhagat singh Attack

23. WLAN AUTHENTICATION
 Two types :
i. Open Auth
ii. Shared Auth
 OPEN AUTH
No auth at all
Simple 2 packet exchange between the client and the AP 

24. Shared Authentication

25. WEP ? Why care for it ?

26. WEP Algorithm !!
Two processes are applied to the plaintext
data. One encrypts the plaintext; the other
protects the data from being modified by
unauthorized personnel. The 40-bit secret key
is connected with a 24-bit Initialization Vector
(IV) resulting in a 64-bit total key size
The PRNG ( RC4 ) outputs a pseudo random
key sequence based on the input key. The
resulting sequence is used to encrypt the
data by doing a bitwise XOR.
To prevent unauthorized data modification,
an integrity algorithm , CRC-32 operates on
the plaintext to produce the ICV
1. WEP ENCRYPTION

27. The IV, plaintext, and ICV triplet forms the
actual data sent in the data frame.

28. 2. WEP Decryption
The IV of the incoming message is used to
generate the key sequence necessary to
decrypt the incoming message.
Combining the ciphertext with the proper
key sequence will give the original
plaintext and ICV .
The decryption is verified by performing
the Integrity check algorithm on the
recovered plaintext and comparing the
output of the ICV' to the ICV submitted
with the message.
If the ICV' is not equal to the ICV, the
received message is in error, and an error
indication is sent to the MAC
management and back to the sending
station

29. WEP CRACKING
 The IVS are not all strong . Some are “Weak IV” (cryptographically) .
 So to crack WEP collect a large no. of these weak IVS (not uniformly
distributed) .
 DEMO TIME !!

30. WPA/WPA2 (The Current Trend)

31. Prerequisite ….
 PBKDF2 (Used to generate PSKs Dynamically each time the
supplicant connects to the authenticator )
 key = PBKDF2(passphrase, SSID, 4096, 256)
 It uses the HMAC algorithm to create a digest of the input.
http://www.ietf.org/rfc/rfc2898.txt :)

32. Yeah !!!! The 4 way handshake

33. Don’t believe until you see !!!
Lets see the 4 way handshake
with the eyes of wireshark !!

34. WPA PSK Cracking
Things we know :
 SNONCE 
 ANONCE 
 AP MAC 
 CLIENT MAC 
Things we don’t know
 The Damn Passphrase 
We’ll capture the handshake and generate our
own PTK and match with the PTK of the current
session . That’s it .

35. DEMO TIME (Cracking WPA/WPA2
PSK)
STEPS :
1. Start up the monitor mode .
2. Capture the air .
3. Get the handshake
4. Use aircrack to do the dictionary attack against
the handshake 

36. IF you are lucky : WPS enabled AP
 WPS stands for Wi-Fi Protected Setup and it is a wireless networking
standard that tries to make connections between a router and
wireless devices faster and easier. It works only for wireless networks
that have WPA Personal or WPA2 Personal security .
 How WPS Works
o Every router that supports WPS has a an eight-digit device pin printed
on the back. When you try to connect a wireless laptop or wireless
printer to your wireless network, it will ask you for that 8 digit pin
o They Split the 8 digits into 2 sets of 4. All that has to happen now is the
first 4 have to be found first. 4 digits only have a 10,000 possible
number combination. Once the first 4 numbers are found, the router
proclaims “ You've found the first four “ 
o Short Demo ……

37. Advanced Attacks … (Takeaways)
 The most recent one . PIXIEWPS (https://github.com/wiire/pixiewps) .
 Evil Twin attack .
 Rogue AP Attack .
 Jamming
 Cloud Cracking (eg using Amazon EC2 engine)

38. Safety Techniques .
Keep in mind you can be hacked Anytime …… :p
 Always use WPA2 PSK encryption accompanied
by Mac Filtering .
 Turn off WPS .
 Do keep an eye on the network in which you are
currently connected to .
 Keep a check on the connected clients .
 Periodically change the SSID as well as the Key .
 Change the Default Router Password .
 Laptop physical security should be maintained
 Use VPN in public WIFI .
 Disable DHCP if you can . (My personal tip  )

39. Acknowledgements .
 standards.ieee.org
 www.securitytube.net
 Wikipedia.org

40. Ways to reach me
 https://www.facebook.com/mandeep.jadon.5
 https://twitter.com/1337tr0lls
 https://www.linkedin.com/in/mandeepjadon
 https://github.com/mandeepjadon (I do a bit coding too  )
Feedbacks are always a motivational force


41. THANKS 