Mohammad Mahmud Kabir, profile picture
Uploaded byMohammad Mahmud Kabir
1,163 views

Security & Privacy in WLAN - A Primer and Case Study

The document presented by Mohammad Mahmud Kabir focuses on security and privacy issues within wireless local area networks (WLAN), providing a theoretical overview and a practical penetration testing case study. It details WLAN security threats, countermeasures, and specifically addresses vulnerabilities within the Wi-Fi Protected Setup (WPS). The objective is to educate on ethical hacking and penetration testing methodologies while emphasizing the importance of security measures in wireless networks.

Technology◦
Related topics:
Penetration-Testing•

Embed presentation

A Primer & Case Study Presented By Mohammad Mahmud KabirPresented By Mohammad Mahmud Kabir Security & Privacy in Wireless Local Area Network [ Prepared As the Presentation on Term Paper Prepared for BIM PGDCS Course 2015 ]
2 Security & Privacy of Wireless Area Network A Primer & Case Study Warning: Hacking is a crime and this document is not responsible for the way it may got used. Disclaimer All data and information provided on this document/Paper/ Presentation are for informational and educational purpose only and is about Ethical Hacking, Security and Penetration Testing.
3 Security & Privacy of Wireless Area Network A Primer & Case Study About Me Mohammad Mahmud Kabir Participant, PGDCS Course (Post Graduate Diploma in Computer Science) BIM (Bangladesh Institute of Management) Student ID 15 CS 013 Session 2015 Career Track: Information security & Assurance Profession: Information Audit, ICCD Currently Deputed as Deputy Team Lead, Quality Assurance Track, Core Banking System Transformation Project, CBT AB Bank Limited
4 Security & Privacy of Wireless Area Network A Primer & Case Study PAPER Introduction Objective The objective of this paper is to illustrate a primer on Wireless Local Area Network (WLAN) security issues along with an experiment on WLAN penetration test in a live network. Scope The study will focus on the theoretical and practical perspectives of today’s wireless local area networks. Limitations The paper is limited to the concepts of “WLAN Security” with a sample experiment. However, the “WLAN Security” is vast and has different perspectives. The Problem & Background Wireless Lan Security and Privacy specifically on WPS vulnerability scopes. Paper Supervisor Ms. Farkhunda Dorin Management Counsellor Computer Science Division BIM, Dhaka
5 Security & Privacy of Wireless Area Network A Primer & Case Study PAPER Introduction Paper Structure There are two parts in this paper, as the title says, (1) A Primer in Part A A theoretical overview and a practical experiment that projects a primer on the Basic Computer Networking, WLAN, Wireless Technologies & standards, WLAN security threats, Countermeasures etc. (2) A case study in Part B This Part portrays a real life case study based on an experimental penetration testing in a local organization.
6 Security & Privacy of Wireless Area Network A Primer & Case Study Content Summary PARTA : The Primer • Computer Networking (Definition, Classifications and Types, OSI layers, LAN) • WLAN Basics (Definition, Benefits, Classification & Types, Components, Basic Operation, Standards) • WLAN security (Security Concepts, Threats /Vulnerabilities, Countermeasure /Defense, Encryption Methods) • WPS (About: “WPS”, WPS authentication, WPS implementation flaw, Security Context)
7 Security & Privacy of Wireless Area Network A Primer & Case Study COMPUTER NETWORKING Definition Classifications and Types OSI layers LAN
8 Security & Privacy of Wireless Area Network A Primer & Case Study COMPUTER NETWORKING A computer network or data network is a telecommunications network which allows computers to exchange data system of interconnected computers and computerized peripherals is called computer network. This interconnection among computers facilitates information sharing among them. The connections between nodes are established using either cable media or wireless media. ” “ Definition Classifications and Types OSI layers LAN
9 Security & Privacy of Wireless Area Network A Primer & Case Study COMPUTER NETWORKING Computer Networks Geographical span PAN LAN WAN MAN Internet Inter-connectivity Point-to-Point Bus Topology Star Topology Ring Topology Mesh Topology Tree Topology Daisy Chain Hybrid Topology Administration Private Network Public Network Architecture Client-Server Peer-to-peer Hybrid Definition Classifications and Types OSI layers LAN
10 Security & Privacy of Wireless Area Network A Primer & Case Study COMPUTER NETWORKING Definition Classifications and Types OSI layers LAN 1 2 3 4 5 6 7 7Layers OfOSI
12 Security & Privacy of Wireless Area Network A Primer & Case Study COMPUTER NETWORKING A computer network spanned inside a building and operated under single administrative system is generally termed as Local Area Network (LAN). Usually, it connects systems from as least as two to as much as 16 million. LANs mostly operates on private IP addresses. LAN works under its own local domain and controlled centrally. LAN can be wired , wireless, or in both forms at once. ” “ Definition Classifications and Types OSI layers LAN
13 Security & Privacy of Wireless Area Network A Primer & Case Study WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards (IEEE 802.11)
14 Security & Privacy of Wireless Area Network A Primer & Case Study WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards Wireless Local Area Networks (WLANs) are groups of wireless networking nodes within a limited geographic area, such as an office building or campus that are capable of radio communications. WLANs are usually implemented as extensions to existing wired local area networks to provide enhanced user mobility. ” “
15 Security & Privacy of Wireless Area Network A Primer & Case Study WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards • Scalability • Reduced installation time• Range of coverage • Mobility • Cost stability • Easy Installation in difficult-areas
16 Security & Privacy of Wireless Area Network A Primer & Case Study WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards Basic WLAN Topology 1. IBSS (Independent Basic Service Set) 2. BSS (Basic Service Set) 3. ESS (Extended Service Set) ESSBSS BISS
17 Security & Privacy of Wireless Area Network A Primer & Case Study The 802.11 Network’s 4 Major Components: • Distribution system • Access points (APs) • Stations (STAs) • Wireless medium WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards
18 Security & Privacy of Wireless Area Network A Primer & Case Study WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards
19 Security & Privacy of Wireless Area Network A Primer & Case Study 32 WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards WLAN Standards & IEEE 802.11 • Service Set Identifier (SSID) • Media Access Control (MAC) Address Filters • Wired Equivalent Privacy (WEP) WEPMAC Filter SSID 1
20 Security & Privacy of Wireless Area Network A Primer & Case Study 31 WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards IEEE 802.11i • Extensible Authentication Protocol (EAP) standard • Robust Security Network (RSN) protocols for RSNAs: • Temporal Key Integrity Protocol (TKIP) and • Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP). • Wi-Fi Protected Access 2 (WPA2)2
21 Security & Privacy of Wireless Area Network A Primer & Case Study 21 WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards 3 IEEE 802.11 Vulnerabilities • MAC Address Authentication • One-way Authentication • Static WEP Keys • SSID • WEP Key Vulnerability • Manual Key Management • Key Size • Initialization Vector (IV) • Decryption Dictionaries
22 Security & Privacy of Wireless Area Network A Primer & Case Study WLAN SECURITY Security Concepts Threats /Vulnerabilities Countermeasure /Defense Encryption Methods
23 Security & Privacy of Wireless Area Network A Primer & Case Study WLAN SECURITY Security Concepts Threats /Vulnerabilities Countermeasure /Defense Encryption Methods Security Mechanics Mechanisms Confidentiality Encryption (Symmetric and Asymmetric) Integrity Digital Signatures (Using one-way hash functions) Availability Defensive technologies to detect/guard against DoS attacks Authentication 802.1x, RADIUS, PAP/CHAP, MS-CHAP, etc. Authorization 802.1x (based on authentication), multiple levels and protocols Access Control Based on authentication, encryption Encryption WEP, CKIP, TKIP, AES Decryption WEP, CKIP, TKIP, AES
24 Security & Privacy of Wireless Area Network A Primer & Case Study WLAN SECURITY WLAN Attacks Passive Attacks Eavesdropping Traffic Analysis Active Attacks Network Access Read Access Write Access DOS Attack Security Concepts Threats /Vulnerabilities Countermeasure /Defense Encryption Methods
25 Security & Privacy of Wireless Area Network A Primer & Case Study WLAN SECURITY Security Concepts Threats /Vulnerabilities Countermeasure /Defense Encryption Methods Eavesdropping Unauthorized Access Key Cracking Wi-Phishing Honeypots External APs External Use Rouge AP Misconfigured AP Ad hoc Connections Wireless DoS Firewall Internet
26 Security & Privacy of Wireless Area Network A Primer & Case Study WLAN SECURITY Security Concepts Threats /Vulnerabilities Countermeasure /Defense Encryption Methods
28 Security & Privacy of Wireless Area Network A Primer & Case Study WLAN SECURITY Security Concepts Threats /Vulnerabilities Countermeasure /Defense Encryption Methods
30 Security & Privacy of Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup About: “WPS” WPS authentication WPS implementation flaw Security Context
31 Security & Privacy of Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup Wi-Fi Protected Setup (WPS) is Wi- Fi alliance’s specification for secure association of wireless LAN devices to mutually authenticate the enrolling device with the Wi-Fi network and to deliver network access keys to these device by having the enrolling device interact with a device known as the “registrar” which is responsible for controlling the Wi-Fi network. The registrar may be located in the Wi-Fi access point itself.” ” “ About: “WPS” WPS authentication WPS implementation flaw Security Context
32 Security & Privacy of Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup WPS Setup Process Push Button Configuration PIN entry Internal Registrar External Registrar Out-of-Band Push Button Router Pin Device Pin About: “WPS” WPS authentication WPS implementation flaw Security Context 1 2 3
33 Security & Privacy of Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup WPS Setup Process Push Button Configuration About: “WPS” WPS authentication WPS implementation flaw Security Context 1 2 3
34 Security & Privacy of Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup WPS Setup Process PIN entry (In-band configuration) About: “WPS” WPS authentication WPS implementation flaw Security Context 1 2 3
35 Security & Privacy of Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup WPS Setup Process Out-of-Band 1. Exchange of public key commitments 2. Unencrypted key transfer 3. Encrypted key transfer About: “WPS” WPS authentication WPS implementation flaw Security Context 1 2 3
36 Security & Privacy of Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup Option / Authentication Physical Access Web Interface PIN Push-button-connect √ Internal Registrar √ External Registrar √ * * Potentially Vulnerable to brute force attacks as the External Registrar option does not require any kind of authentication apart from providing the PIN WPS Options & Authentication type About: “WPS” WPS authentication WPS implementation flaw Security Context
37 Security & Privacy of Wireless Area Network A Primer & Case Study 8 Digit Security Key 1 2 3 4 5 6 7 0 Checksum 1st half of PIN 2nd half of PIN WPS Wi-Fi Protected Setup Authentication (PIN – External Registrar) IEEE 802.11/EAP Expanded Type, Vendor ID: WFA (0x372A), Vendor Type: SimpleConfig (0x01) * If the WPS-authentication fails at some point, the AP will send an EAP-NACK message About: “WPS” WPS authentication WPS implementation flaw Security Context
38 Security & Privacy of Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup 8 Digit Security Key 1 2 3 4 5 6 7 0 Checksum 1st half of PIN 2nd half of PIN Trial Incorrect if EAP-NACK message received after sending M4. Incorrect if EAP-NACK message received after sending M6. Maximum possible authentication attempts 108 =100,000,000 104 + 103 =10,000 + 1,000 =11,000 About: “WPS” WPS authentication WPS implementation flaw Security Context
39 Security & Privacy of Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup Advantages of Attacking WPS (over the direct attack on WPA/WPA2 ) 1. Faster: Cracking the WPS PIN is considerably faster and not as luck-dependent. 2. Recovering of The Passphrase Knowledge of PIN enables recovering of the passphrase instantly even if the owner changes it. (with ‘wpscrack’ or ‘Reaver’). 3. Multiple radios use the same WPS pin Access points with multiple radios (2.4/5GHz) can be configured with multiple WPA keys. Since the radios use the same WPS pin, knowledge of the pin allows an attacker to recover all WPA keys. About: “WPS” WPS authentication WPS implementation flaw Security Context
40 Security & Privacy of Wireless Area Network A Primer & Case Study Content Summary PARTB: The Case Study • Theoretical Methodology (Preface, Penetration Testing, WPS Review, Brute Force Methodology) • Preparation & Testing (Hardware & Software, Reaver, Test environment, Considerations) • Live Operations (Live environment, Operation in Area B1, Operation in Area M1) • Observations and recommendations (Observations, Recommendations)
41 Security & Privacy of Wireless Area Network A Primer & Case Study Objective Penetration Testing WPS scope Brute Force Methodology THEORETICAL METHODOLOGY
42 Security & Privacy of Wireless Area Network A Primer & Case Study The objective was to perform successful penetration testing through brute force attack methodology against a WPS PIN and describe the whole process and to execute several tests on APs in two different areas to find out how many of the APs used there were vulnerable to the attack. ” “ THEORETICAL METHODOLOGY Objective Penetration Testing WPS scope Brute Force Methodology
43 Security & Privacy of Wireless Area Network A Primer & Case Study 1 Determine feasibility -of a particular set of attack vectors 2 Identify high-risk vulnerabilities -from a combination of lower-risk vulnerabilities exploited in a particular sequence -that may be difficult to detect with automated vulnerability scanning software 3 Assess the magnitude of potential business and operational impacts of successful attacks 4 Test the ability of network defenders to detect and respond to attacks 5 Provide evidence to support increased investments in security personnel and technology. The goals of penetration tests Def. A software attack on a computer system looking for security weaknesses & gaining access on system and data. ” “ THEORETICAL METHODOLOGY Objective Penetration Testing WPS scope Brute Force Methodology
44 Security & Privacy of Wireless Area Network A Primer & Case Study 8 Digit Security Key 1 2 3 4 5 6 7 0 Checksum 1st half of PIN 2nd half of PIN Trial Incorrect if EAP-NACK message received after sending M4. Incorrect if EAP-NACK message received after sending M6. Maximum possible authentication attempts 108 =100,000,000 104 + 103 =10,000 + 1,000 =11,000 THEORETICAL METHODOLOGY Objective Penetration Testing WPS scope Brute Force Methodology
45 Security & Privacy of Wireless Area Network A Primer & Case Study 802.11 Auth 802.11 Assoc EAP Initiation … 802.11 Deauth Send M4 Increment 1st half PIN Receive Send M4 Receive Dump AP Configuration (M7) Increment 2nd half of PIN/ Fix Checksum M5 NACK NACK M7 THEORETICAL METHODOLOGY Objective Penetration Testing WPS scope Brute Force Methodology
46 Security & Privacy of Wireless Area Network A Primer & Case Study PREPARATION & TESTING Hardware & Software About: Reaver Test environment Test Considerations
47 Security & Privacy of Wireless Area Network A Primer & Case Study PREPARATION & TESTING Reaver Brute-force Attacking AirCrack-ng Monitoring WireShark Packet Monitoring SOFTWARE OS Debian HARDTWARE Wireless Network Adapter Atheros AR5B91 System/Laptop // Acer Aspire 5738z Hardware & Software About: Reaver Test environment Test Considerations
48 Security & Privacy of Wireless Area Network A Primer & Case Study PREPARATION & TESTING “Reaver is an open source tool for Linux distributions which implements the brute force attack against WPS PIN in order to receive the PSK. The source and free download can be found in. ” Factors influencing the length of the recovery process AP type Signal strength Lockout policy "Reaver has been designed to be a robust and practical attack against WPS, and has been tested against a wide variety of access points and WPS implementations.” Hardware & Software About: Reaver Test environment Test Considerations Reaver Brute-force Attacking Reaver
49 Security & Privacy of Wireless Area Network A Primer & Case Study PREPARATION & TESTING AP configured for WPA2-PSK with 14-60 characters passphrase Hardware & Software About: Reaver Test environment Test Considerations
50 Security & Privacy of Wireless Area Network A Primer & Case Study PREPARATION & TESTING The wireless card was put into monitor mode Monitor the network traffic, the airodump-ng tool Reaver performs a brute force attack against PIN This provided us with the list of wireless networks in range of our laptop. After finding the BSSID of the targeted network, Hardware & Software About: Reaver Test environment Test Considerations
51 Security & Privacy of Wireless Area Network A Primer & Case Study Example // Frame exchange during the attacking process
52 Security & Privacy of Wireless Area Network A Primer & Case Study Example Successful attack shows PIN, PSK & SSID
53 Security & Privacy of Wireless Area Network A Primer & Case Study PREPARATION & TESTING Random amount of time taken for 10 different attacks No. PSK Length Duration 1 14 96 minutes 2 14 77 minutes 3 63 226 minutes 4 63 119 minutes 5 47 204 minutes 6 47 112 minutes 7 25 84 minutes 8 25 265 minutes 9 20 189 minutes 10 20 106 minutes “The time needed to successfully complete the attack in same conditions is basically random; depends mostly on how fast is the first half of PIN guessed.” Hardware & Software About: Reaver Test environment Test Considerations
54 Security & Privacy of Wireless Area Network A Primer & Case Study PREPARATION & TESTING Random amount of time taken for 10 different attacks Ideal conditions for performing an attack: • Maximum strength signal, • Decent router CPUs capabilities, and • No error messages (no lost frames, no timeouts occurred) -resulted in very fast PIN attempts (a little less than 2 seconds per one). At this rate, even the worst possible scenario (11,000 possible trial) would take less than 6 hours to complete. Hardware & Software About: Reaver Test environment Test Considerations
55 Security & Privacy of Wireless Area Network A Primer & Case Study LIVE Operation Live environment & Client Profile Operation in Area B1 Operation in Area M1
56 Security & Privacy of Wireless Area Network A Primer & Case Study LIVE EXPRIMENT - The Penetration testing was operated more than one WLAN. - Permission obtained from an organization to perform attacks on their two sister concerns. - Two concerns office is located in two different locations located in- - Banani (B1) and - Mohammadpur (M1) - Due to security reasons the operation was not permitted any data (organization’s name, Location, Technical particulars etc.) that may indicate the identity of the organization. Live environment & Client Profile Operation in Area B1 Operation in Area M1
57 Security & Privacy of Wireless Area Network A Primer & Case Study LIVE EXPRIMENT 8wireless networks detected in the building. - 4potential targets (using WPA/WPA2 in PSK mode) - 3networks were encrypted by WEP - 1was not using any encryption at all. (Attacks performs from the public area of the building caused considerably weaker signal strength varied from 34%-76%.) 4 1 3 ‘B1’ 8 Wireless Networks (APs) Encrypted with WEP No encryption Not Targated Live environment & Client Profile Operation in Area B1 Operation in Area M1
58 Security & Privacy of Wireless Area Network A Primer & Case Study Public Front OfficeOffice Office Office Office Office Office Office Pantry Office OfficeMeetingRoom2 MeetingRoom1 Store RestroomRestroom RestroomMechanical Attacker Aps 8 Secured AP 3 Target AP 3 Compr. AP 1 Public AP 1
59 Security & Privacy of Wireless Area Network A Primer & Case Study LIVE EXPRIMENT 11wireless networks detected in the building. - 6potential targets (using WPA/WPA2 in PSK mode) - 2networks were encrypted by WEP - 2potential targets (using WPA/WPA2 in enterprise mode) - 1was not using any encryption at all. 6 2 2 1 ‘M1’ 8 Wireless Networks (APs) Targets WEP Encrypted WPA/WPA2 Encrypted No Encryption Live environment & Client Profile Operation in Area B1 Operation in Area M1
60 Security & Privacy of Wireless Area Network A Primer & Case Study Reception Meeting Room Store Mechanical Veranda Restroom Pantry Dining Meeting Room Office Office OfficeOffice Space Office Office Office Office Restroom Restroom Attacker APs Secured AP 6 Target AP 4 Compr. AP 2 Public AP 1
61 Security & Privacy of Wireless Area Network A Primer & Case Study CASE OBSERVATIONS
64 Security & Privacy of Wireless Area Network A Primer & Case Study CASE OBSERVATIONS Majority of the WLAN users (people using any kind of LAN) can connect and use the WLAN safely, since the biggest (and most used) networks were being used in the Enterprise mode. The small local WLANs, which were vulnerable to our attacks, are being used only by small groups of users. It does not automatically imply that there is low or no chance of capturing important data, but it can be assumed that with more users being potential targets the attacker’s chances would be considerably higher.
65 Security & Privacy of Wireless Area Network A Primer & Case Study CASE OBSERVATIONS Any attack in the network whether it is unsuccessful or not, it is most probably caused by one of the following reasons: Any AP should have a lockout policy, which makes a brute force attack impractical/impossible. (However, during our tests there was no such a device targeted. Either the attack got going and did successfully end or it did not start.) The target AP does not support WPS or it is turned off manually on the device. Since the WPS is enabled by default on majority of devices which support WPS and regular users would not turn it off, the unsuccessful attack is more likely caused by the fact that the device is older and it does not support WPS at all. AP was used in an Enterprise mode for enhanced security, which is not vulnerable to WPS PIN brute force attack.
66 Security & Privacy of Wireless Area Network A Primer & Case Study CASE RECOMMANDATIONS The organization should be concerned that it is possible to abuse the WPS implementation flaw to get full access to the wireless network. The organization should also be concerned regarding the risk level as to get into the network all the potential attacker needs minimal resource. The organization is recommended to acknowledge the followings: Any AP should have a lockout policy, which makes a brute force attack impractical/impossible. If The AP supports WPS, it may turn off manually on the device. Any AP should be used in an Enterprise mode for enhanced security
67 Security & Privacy of Wireless Area Network A Primer & Case Study FUTURE SCOPES Future work should focus on some of the following issues:  Detailed work in- » WLAN standards » WLAN Security flows » Active attacks on WLAN » Hardware and software countermeasures on WLAN security » WLAN Security Encryption methods » WPS authentication mechanism  Other pentation testing from different environments with different other mechanisms.  Reducing and eliminating the risks attacks that can be happened on WLAN networks such as Man-in-the Middle attacks, Denial of Service (DoS) attacks and Identity theft (MAC spoofing).  Penetration testing from mobile devises (e.g. Kali Linux/nethunter equipped Android devices).
68 Security & Privacy of Wireless Area Network A Primer & Case Study Security & Privacy of Wireless Area Network A Primer & Case Study Thank You for your Time, passion and interest » Questions » Discussions » Recap Thank You > Questions > Discussions > Recap ====================================================== This presentation is a part of the paper submitted for BIM PGDCS 2015 Course. This presentation is also available in www.MahmudKabir.com/pgdcsppt and also in the following sites: > // SlideShare.com || YouTube.com || MS PowerPoint Live

More Related Content

PPTX
CCNA Course Training Presentation
byRohit Singh
 
PPTX
CCNA ppt Day 1
byVISHNU N
 
PPT
Training ppt bsnl
bymanish katara
 
PPT
Ngn
bySaroj Kumar Gochhayat
 
PPTX
Cdma2000
byvivek kumar
 
PPT
Ccna summer training ppt
bysaroj choudhary
 
PPTX
Wide Area Networking
byIndian Space Research Organisation
 
PPTX
Wi-max Technology PPT
byVinay Krishna
 
CCNA Course Training Presentation
byRohit Singh
 
CCNA ppt Day 1
byVISHNU N
 
Training ppt bsnl
bymanish katara
 
Ngn
bySaroj Kumar Gochhayat
 
Cdma2000
byvivek kumar
 
Ccna summer training ppt
bysaroj choudhary
 
Wide Area Networking
byIndian Space Research Organisation
 
Wi-max Technology PPT
byVinay Krishna
 

What's hot

PPT
Wimax
byShayan Asadbeygi
 
PPT
Classification of Computer Networks
byNazren Wak
 
PPTX
Bluetooth.ppt
byHina Saxena
 
PDF
Mobile network structure
byAhmed Hussien Ali Gomaa Bebars
 
PPTX
Introduction to SDN: Software Defined Networking
byAnkita Mahajan
 
PDF
Optimizing Aruba WLANs for Roaming Devices
byAruba, a Hewlett Packard Enterprise company
 
PPTX
BSNL TRAINING PPT
byManideep Srirangam
 
PPTX
tri gate transistors
byChetan Kataria
 
PPTX
Physical layer interface & standards
bySrashti Vyas
 
PDF
Wireless networking_ASRao
byBalaji Institute of Engineering & Sciences
 
PPTX
ccna summer training ppt ( Cisco certified network analysis) ppt. by Traun k...
byTarun Khaneja
 
PPT
Computer networks
byDr. Jaison Mammen
 
PDF
How will sidelink bring a new level of 5G versatility.pdf
byQualcomm Research
 
DOCX
Hub vs-switch
byNitesh Singh
 
PDF
Lecture 3 trunking theory and other issues with cells
byUmairKhalil16
 
PPTX
Lecture5 teletraffic
bymazlina1202
 
PPT
Local multipoint distribution service(lmds)
byVivek Kumar
 
PPTX
Wireless communication
byDarshan Maru
 
PPTX
Wireless communication ppt by dinesh
byDINESH TAMBE
 
PPTX
Transmission media (data communication)
byPritom Chaki
 
Wimax
byShayan Asadbeygi
 
Classification of Computer Networks
byNazren Wak
 
Bluetooth.ppt
byHina Saxena
 
Mobile network structure
byAhmed Hussien Ali Gomaa Bebars
 
Introduction to SDN: Software Defined Networking
byAnkita Mahajan
 
Optimizing Aruba WLANs for Roaming Devices
byAruba, a Hewlett Packard Enterprise company
 
BSNL TRAINING PPT
byManideep Srirangam
 
tri gate transistors
byChetan Kataria
 
Physical layer interface & standards
bySrashti Vyas
 
Wireless networking_ASRao
byBalaji Institute of Engineering & Sciences
 
ccna summer training ppt ( Cisco certified network analysis) ppt. by Traun k...
byTarun Khaneja
 
Computer networks
byDr. Jaison Mammen
 
How will sidelink bring a new level of 5G versatility.pdf
byQualcomm Research
 
Hub vs-switch
byNitesh Singh
 
Lecture 3 trunking theory and other issues with cells
byUmairKhalil16
 
Lecture5 teletraffic
bymazlina1202
 
Local multipoint distribution service(lmds)
byVivek Kumar
 
Wireless communication
byDarshan Maru
 
Wireless communication ppt by dinesh
byDINESH TAMBE
 
Transmission media (data communication)
byPritom Chaki
 

Viewers also liked

PDF
Computer Networks.Wireless
bySabin Buraga
 
PPT
Wireless LAN Network Topologies (ENG)
byie-net ingenieursvereniging vzw
 
PPTX
File 1389424591
byBrij_Modi95
 
PDF
Infographic: Penetration Testing - A Look into a Full Pen Test Campaign
byPratum
 
PDF
Air defense wireless_vulnerability_assessement_module_spec_sheet
byAdvantec Distribution
 
PDF
11. wireless-penetration-testing-training-cyber51
byDoree Garcia, CCNA, OSWP
 
PPT
Lucthur
by11mm22hh
 
PDF
LokiPi: Small form factor wireless auditing and penetration testing toolkit
byJonathan O'Brien
 
PPTX
Networking & Security Ettercap
byNick Beattie
 
KEY
New School Man-in-the-Middle
byTom Eston
 
PDF
Axoss Wireless Penetration Testing Services
byBulent Buyukkahraman
 
PPTX
Handover Management In Integrated Wlan And Mobile Wimax
byPradeep Thomas Thundiyil
 
PPT
RSA - WLAN Hacking
byJohn Rhoton
 
PPTX
Client side exploits
bynickyt8
 
PDF
MITM Attacks with Ettercap : TTU CyberEagles Club
byShritesh Bhattarai
 
PPT
Star delta trsformation
byHem Bhattarai
 
PPTX
The magic of ettercap
byn|u - The Open Security Community
 
PPT
Ch03
bygofortution
 
PPTX
Ettercap
byTensor
 
PPT
Penetration testing, What’s this?
byDmitry Evteev
 
Computer Networks.Wireless
bySabin Buraga
 
Wireless LAN Network Topologies (ENG)
byie-net ingenieursvereniging vzw
 
File 1389424591
byBrij_Modi95
 
Infographic: Penetration Testing - A Look into a Full Pen Test Campaign
byPratum
 
Air defense wireless_vulnerability_assessement_module_spec_sheet
byAdvantec Distribution
 
11. wireless-penetration-testing-training-cyber51
byDoree Garcia, CCNA, OSWP
 
Lucthur
by11mm22hh
 
LokiPi: Small form factor wireless auditing and penetration testing toolkit
byJonathan O'Brien
 
Networking & Security Ettercap
byNick Beattie
 
New School Man-in-the-Middle
byTom Eston
 
Axoss Wireless Penetration Testing Services
byBulent Buyukkahraman
 
Handover Management In Integrated Wlan And Mobile Wimax
byPradeep Thomas Thundiyil
 
RSA - WLAN Hacking
byJohn Rhoton
 
Client side exploits
bynickyt8
 
MITM Attacks with Ettercap : TTU CyberEagles Club
byShritesh Bhattarai
 
Star delta trsformation
byHem Bhattarai
 
The magic of ettercap
byn|u - The Open Security Community
 
Ch03
bygofortution
 
Ettercap
byTensor
 
Penetration testing, What’s this?
byDmitry Evteev
 

Similar to Security & Privacy in WLAN - A Primer and Case Study

PPTX
Wireless LAN Security by Arpit Bhatia
byArpit Bhatia
 
PPTX
Wireless Communication and MobileCo5.pptx
byAbdurehmanDawud
 
PPT
wireless lan security.ppt
bySagarBedarkar3
 
PPT
Wifi
bynil65
 
PPTX
Wireless network security
byVishal Agarwal
 
PPTX
Wireless_Networks_Paragraph_Style_Final.pptx
bySheshnaBoolakee1
 
PPT
4 wifi security
byal-sari7
 
PPT
wireless lan security for their all details
bySatyamPrakash38
 
PPT
Wireless Device and Network level security
byChetan Kumar S
 
PPTX
Wireless Network security
byFathima Rahaman
 
PPT
254460979-ishant abcd-098765432222-1.ppt
byzainabsaiyad566
 
PDF
Wireless Security – From A to Z – Types, Threats, To How to Secure.pdf
bySeanHussey8
 
PPTX
Chapter 7 - Wireless Network Security.pptx
byAmanuelZewdie4
 
PDF
Pentesting Your Own Wireless Networks, June 2011 Issue
byIshan Girdhar
 
PPTX
Wireless Security Best Practices for Remote Monitoring Applications
bycmstiernberg
 
PPT
Chapter08
byMuhammad Ahad
 
PPT
Shashank wireless lans security
byShashank Srivastava
 
PPTX
Wireless Security null seminar
byNilesh Sapariya
 
PPT
chapter 7 -wireless network security.ppt
byabenimelos
 
PPTX
Wireless Security
byUniversità Degli Studi Di Salerno
 
Wireless LAN Security by Arpit Bhatia
byArpit Bhatia
 
Wireless Communication and MobileCo5.pptx
byAbdurehmanDawud
 
wireless lan security.ppt
bySagarBedarkar3
 
Wifi
bynil65
 
Wireless network security
byVishal Agarwal
 
Wireless_Networks_Paragraph_Style_Final.pptx
bySheshnaBoolakee1
 
4 wifi security
byal-sari7
 
wireless lan security for their all details
bySatyamPrakash38
 
Wireless Device and Network level security
byChetan Kumar S
 
Wireless Network security
byFathima Rahaman
 
254460979-ishant abcd-098765432222-1.ppt
byzainabsaiyad566
 
Wireless Security – From A to Z – Types, Threats, To How to Secure.pdf
bySeanHussey8
 
Chapter 7 - Wireless Network Security.pptx
byAmanuelZewdie4
 
Pentesting Your Own Wireless Networks, June 2011 Issue
byIshan Girdhar
 
Wireless Security Best Practices for Remote Monitoring Applications
bycmstiernberg
 
Chapter08
byMuhammad Ahad
 
Shashank wireless lans security
byShashank Srivastava
 
Wireless Security null seminar
byNilesh Sapariya
 
chapter 7 -wireless network security.ppt
byabenimelos
 
Wireless Security
byUniversità Degli Studi Di Salerno
 

Recently uploaded

PDF
Towards a Vibrant AI Hardware Accelerator Ecosystem, invited talk at the 4th ...
byMichiaki Tatsubori
 
PPTX
GenerationAI Paris 2025 | AI in Tech: Beyond Expectations, Into Execution
byapidays
 
PDF
final.pdf
byomarbishtawi04
 
PDF
HOW TO OVERCOME THE THREATS OF ARTIFICIAL INTELLIGENCE AGAINST HUMANITY.pdf
byFaga1939
 
PDF
Empower your IT team with cloud-based PC management using Dell Management Por...
byPrincipled Technologies
 
PDF
apidays Paris 2025 | Zero Trust By Design
byapidays
 
PDF
Constraint Collapse and Fidelity Decay in Scaled Language Models
bySemantic Fidelity Lab | A. Jacobs
 
PDF
Spec-Driven Development with Kiro: Elevating Software Quality, Traceability, ...
byHaim Michael
 
PDF
UiPath Automation Developer Associate Training Series 2026 - Session 3
byDianaGray10
 
PDF
Chapter 5 Security Mechanisms iin computer security.pdf
byGetnet Tigabie Askale -(GM)
 
PPTX
The Transformative Technology in Contemporary Businesses
bygreyaudrina
 
PPTX
Spacecraft Guidance Quick Research Guide by Arthur Morgan
byArthur Morgan
 
PDF
shayk.online - Anonymous chat with Sinatra and WebSockets
byEleanor McHugh
 
PDF
GenerationAI_Paris_2025_Architecting_Intelligence.pdf
byapidays
 
PDF
20260212 Security-JAWS activity results for 2025 and activity goals for 2026
byTyphon 666
 
PDF
February 2026 Patch Tuesday hosted by Chris Goettl and Todd Schell
byIvanti
 
PDF
From Artificial Intelligence to African Intelligence: Transforming Research &...
byMoses Kemibaro
 
PDF
AI Vector Search Best Practices Multicloud Feb 2026
bySandesh Rao
 
PDF
Escape from the Forbidden Zone: Smuggling green and inclusive tech past the g...
byBookNet Canada
 
PDF
Explaining the flow of purpose-specific BOM
byakipii ogaoga
 
Towards a Vibrant AI Hardware Accelerator Ecosystem, invited talk at the 4th ...
byMichiaki Tatsubori
 
GenerationAI Paris 2025 | AI in Tech: Beyond Expectations, Into Execution
byapidays
 
final.pdf
byomarbishtawi04
 
HOW TO OVERCOME THE THREATS OF ARTIFICIAL INTELLIGENCE AGAINST HUMANITY.pdf
byFaga1939
 
Empower your IT team with cloud-based PC management using Dell Management Por...
byPrincipled Technologies
 
apidays Paris 2025 | Zero Trust By Design
byapidays
 
Constraint Collapse and Fidelity Decay in Scaled Language Models
bySemantic Fidelity Lab | A. Jacobs
 
Spec-Driven Development with Kiro: Elevating Software Quality, Traceability, ...
byHaim Michael
 
UiPath Automation Developer Associate Training Series 2026 - Session 3
byDianaGray10
 
Chapter 5 Security Mechanisms iin computer security.pdf
byGetnet Tigabie Askale -(GM)
 
The Transformative Technology in Contemporary Businesses
bygreyaudrina
 
Spacecraft Guidance Quick Research Guide by Arthur Morgan
byArthur Morgan
 
shayk.online - Anonymous chat with Sinatra and WebSockets
byEleanor McHugh
 
GenerationAI_Paris_2025_Architecting_Intelligence.pdf
byapidays
 
20260212 Security-JAWS activity results for 2025 and activity goals for 2026
byTyphon 666
 
February 2026 Patch Tuesday hosted by Chris Goettl and Todd Schell
byIvanti
 
From Artificial Intelligence to African Intelligence: Transforming Research &...
byMoses Kemibaro
 
AI Vector Search Best Practices Multicloud Feb 2026
bySandesh Rao
 
Escape from the Forbidden Zone: Smuggling green and inclusive tech past the g...
byBookNet Canada
 
Explaining the flow of purpose-specific BOM
byakipii ogaoga
 

Security & Privacy in WLAN - A Primer and Case Study

  • 1.
    A Primer &Case Study Presented By Mohammad Mahmud KabirPresented By Mohammad Mahmud Kabir Security & Privacy in Wireless Local Area Network [ Prepared As the Presentation on Term Paper Prepared for BIM PGDCS Course 2015 ]
  • 2.
    2 Security & Privacyof Wireless Area Network A Primer & Case Study Warning: Hacking is a crime and this document is not responsible for the way it may got used. Disclaimer All data and information provided on this document/Paper/ Presentation are for informational and educational purpose only and is about Ethical Hacking, Security and Penetration Testing.
  • 3.
    3 Security & Privacyof Wireless Area Network A Primer & Case Study About Me Mohammad Mahmud Kabir Participant, PGDCS Course (Post Graduate Diploma in Computer Science) BIM (Bangladesh Institute of Management) Student ID 15 CS 013 Session 2015 Career Track: Information security & Assurance Profession: Information Audit, ICCD Currently Deputed as Deputy Team Lead, Quality Assurance Track, Core Banking System Transformation Project, CBT AB Bank Limited
  • 4.
    4 Security & Privacyof Wireless Area Network A Primer & Case Study PAPER Introduction Objective The objective of this paper is to illustrate a primer on Wireless Local Area Network (WLAN) security issues along with an experiment on WLAN penetration test in a live network. Scope The study will focus on the theoretical and practical perspectives of today’s wireless local area networks. Limitations The paper is limited to the concepts of “WLAN Security” with a sample experiment. However, the “WLAN Security” is vast and has different perspectives. The Problem & Background Wireless Lan Security and Privacy specifically on WPS vulnerability scopes. Paper Supervisor Ms. Farkhunda Dorin Management Counsellor Computer Science Division BIM, Dhaka
  • 5.
    5 Security & Privacyof Wireless Area Network A Primer & Case Study PAPER Introduction Paper Structure There are two parts in this paper, as the title says, (1) A Primer in Part A A theoretical overview and a practical experiment that projects a primer on the Basic Computer Networking, WLAN, Wireless Technologies & standards, WLAN security threats, Countermeasures etc. (2) A case study in Part B This Part portrays a real life case study based on an experimental penetration testing in a local organization.
  • 6.
    6 Security & Privacyof Wireless Area Network A Primer & Case Study Content Summary PARTA : The Primer • Computer Networking (Definition, Classifications and Types, OSI layers, LAN) • WLAN Basics (Definition, Benefits, Classification & Types, Components, Basic Operation, Standards) • WLAN security (Security Concepts, Threats /Vulnerabilities, Countermeasure /Defense, Encryption Methods) • WPS (About: “WPS”, WPS authentication, WPS implementation flaw, Security Context)
  • 7.
    7 Security & Privacyof Wireless Area Network A Primer & Case Study COMPUTER NETWORKING Definition Classifications and Types OSI layers LAN
  • 8.
    8 Security & Privacyof Wireless Area Network A Primer & Case Study COMPUTER NETWORKING A computer network or data network is a telecommunications network which allows computers to exchange data system of interconnected computers and computerized peripherals is called computer network. This interconnection among computers facilitates information sharing among them. The connections between nodes are established using either cable media or wireless media. ” “ Definition Classifications and Types OSI layers LAN
  • 9.
    9 Security & Privacyof Wireless Area Network A Primer & Case Study COMPUTER NETWORKING Computer Networks Geographical span PAN LAN WAN MAN Internet Inter-connectivity Point-to-Point Bus Topology Star Topology Ring Topology Mesh Topology Tree Topology Daisy Chain Hybrid Topology Administration Private Network Public Network Architecture Client-Server Peer-to-peer Hybrid Definition Classifications and Types OSI layers LAN
  • 10.
    10 Security & Privacyof Wireless Area Network A Primer & Case Study COMPUTER NETWORKING Definition Classifications and Types OSI layers LAN 1 2 3 4 5 6 7 7Layers OfOSI
  • 11.
    12 Security & Privacyof Wireless Area Network A Primer & Case Study COMPUTER NETWORKING A computer network spanned inside a building and operated under single administrative system is generally termed as Local Area Network (LAN). Usually, it connects systems from as least as two to as much as 16 million. LANs mostly operates on private IP addresses. LAN works under its own local domain and controlled centrally. LAN can be wired , wireless, or in both forms at once. ” “ Definition Classifications and Types OSI layers LAN
  • 12.
    13 Security & Privacyof Wireless Area Network A Primer & Case Study WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards (IEEE 802.11)
  • 13.
    14 Security & Privacyof Wireless Area Network A Primer & Case Study WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards Wireless Local Area Networks (WLANs) are groups of wireless networking nodes within a limited geographic area, such as an office building or campus that are capable of radio communications. WLANs are usually implemented as extensions to existing wired local area networks to provide enhanced user mobility. ” “
  • 14.
    15 Security & Privacyof Wireless Area Network A Primer & Case Study WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards • Scalability • Reduced installation time• Range of coverage • Mobility • Cost stability • Easy Installation in difficult-areas
  • 15.
    16 Security & Privacyof Wireless Area Network A Primer & Case Study WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards Basic WLAN Topology 1. IBSS (Independent Basic Service Set) 2. BSS (Basic Service Set) 3. ESS (Extended Service Set) ESSBSS BISS
  • 16.
    17 Security & Privacyof Wireless Area Network A Primer & Case Study The 802.11 Network’s 4 Major Components: • Distribution system • Access points (APs) • Stations (STAs) • Wireless medium WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards
  • 17.
    18 Security & Privacyof Wireless Area Network A Primer & Case Study WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards
  • 18.
    19 Security & Privacyof Wireless Area Network A Primer & Case Study 32 WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards WLAN Standards & IEEE 802.11 • Service Set Identifier (SSID) • Media Access Control (MAC) Address Filters • Wired Equivalent Privacy (WEP) WEPMAC Filter SSID 1
  • 19.
    20 Security & Privacyof Wireless Area Network A Primer & Case Study 31 WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards IEEE 802.11i • Extensible Authentication Protocol (EAP) standard • Robust Security Network (RSN) protocols for RSNAs: • Temporal Key Integrity Protocol (TKIP) and • Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP). • Wi-Fi Protected Access 2 (WPA2)2
  • 20.
    21 Security & Privacyof Wireless Area Network A Primer & Case Study 21 WIRELESS LOCAL AREA NETWORK Definition Benefits Classification & Types Components Basic Operation WLAN Standards 3 IEEE 802.11 Vulnerabilities • MAC Address Authentication • One-way Authentication • Static WEP Keys • SSID • WEP Key Vulnerability • Manual Key Management • Key Size • Initialization Vector (IV) • Decryption Dictionaries
  • 21.
    22 Security & Privacyof Wireless Area Network A Primer & Case Study WLAN SECURITY Security Concepts Threats /Vulnerabilities Countermeasure /Defense Encryption Methods
  • 22.
    23 Security & Privacyof Wireless Area Network A Primer & Case Study WLAN SECURITY Security Concepts Threats /Vulnerabilities Countermeasure /Defense Encryption Methods Security Mechanics Mechanisms Confidentiality Encryption (Symmetric and Asymmetric) Integrity Digital Signatures (Using one-way hash functions) Availability Defensive technologies to detect/guard against DoS attacks Authentication 802.1x, RADIUS, PAP/CHAP, MS-CHAP, etc. Authorization 802.1x (based on authentication), multiple levels and protocols Access Control Based on authentication, encryption Encryption WEP, CKIP, TKIP, AES Decryption WEP, CKIP, TKIP, AES
  • 23.
    24 Security & Privacyof Wireless Area Network A Primer & Case Study WLAN SECURITY WLAN Attacks Passive Attacks Eavesdropping Traffic Analysis Active Attacks Network Access Read Access Write Access DOS Attack Security Concepts Threats /Vulnerabilities Countermeasure /Defense Encryption Methods
  • 24.
    25 Security & Privacyof Wireless Area Network A Primer & Case Study WLAN SECURITY Security Concepts Threats /Vulnerabilities Countermeasure /Defense Encryption Methods Eavesdropping Unauthorized Access Key Cracking Wi-Phishing Honeypots External APs External Use Rouge AP Misconfigured AP Ad hoc Connections Wireless DoS Firewall Internet
  • 25.
    26 Security & Privacyof Wireless Area Network A Primer & Case Study WLAN SECURITY Security Concepts Threats /Vulnerabilities Countermeasure /Defense Encryption Methods
  • 26.
    28 Security & Privacyof Wireless Area Network A Primer & Case Study WLAN SECURITY Security Concepts Threats /Vulnerabilities Countermeasure /Defense Encryption Methods
  • 27.
    30 Security & Privacyof Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup About: “WPS” WPS authentication WPS implementation flaw Security Context
  • 28.
    31 Security & Privacyof Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup Wi-Fi Protected Setup (WPS) is Wi- Fi alliance’s specification for secure association of wireless LAN devices to mutually authenticate the enrolling device with the Wi-Fi network and to deliver network access keys to these device by having the enrolling device interact with a device known as the “registrar” which is responsible for controlling the Wi-Fi network. The registrar may be located in the Wi-Fi access point itself.” ” “ About: “WPS” WPS authentication WPS implementation flaw Security Context
  • 29.
    32 Security & Privacyof Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup WPS Setup Process Push Button Configuration PIN entry Internal Registrar External Registrar Out-of-Band Push Button Router Pin Device Pin About: “WPS” WPS authentication WPS implementation flaw Security Context 1 2 3
  • 30.
    33 Security & Privacyof Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup WPS Setup Process Push Button Configuration About: “WPS” WPS authentication WPS implementation flaw Security Context 1 2 3
  • 31.
    34 Security & Privacyof Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup WPS Setup Process PIN entry (In-band configuration) About: “WPS” WPS authentication WPS implementation flaw Security Context 1 2 3
  • 32.
    35 Security & Privacyof Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup WPS Setup Process Out-of-Band 1. Exchange of public key commitments 2. Unencrypted key transfer 3. Encrypted key transfer About: “WPS” WPS authentication WPS implementation flaw Security Context 1 2 3
  • 33.
    36 Security & Privacyof Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup Option / Authentication Physical Access Web Interface PIN Push-button-connect √ Internal Registrar √ External Registrar √ * * Potentially Vulnerable to brute force attacks as the External Registrar option does not require any kind of authentication apart from providing the PIN WPS Options & Authentication type About: “WPS” WPS authentication WPS implementation flaw Security Context
  • 34.
    37 Security & Privacyof Wireless Area Network A Primer & Case Study 8 Digit Security Key 1 2 3 4 5 6 7 0 Checksum 1st half of PIN 2nd half of PIN WPS Wi-Fi Protected Setup Authentication (PIN – External Registrar) IEEE 802.11/EAP Expanded Type, Vendor ID: WFA (0x372A), Vendor Type: SimpleConfig (0x01) * If the WPS-authentication fails at some point, the AP will send an EAP-NACK message About: “WPS” WPS authentication WPS implementation flaw Security Context
  • 35.
    38 Security & Privacyof Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup 8 Digit Security Key 1 2 3 4 5 6 7 0 Checksum 1st half of PIN 2nd half of PIN Trial Incorrect if EAP-NACK message received after sending M4. Incorrect if EAP-NACK message received after sending M6. Maximum possible authentication attempts 108 =100,000,000 104 + 103 =10,000 + 1,000 =11,000 About: “WPS” WPS authentication WPS implementation flaw Security Context
  • 36.
    39 Security & Privacyof Wireless Area Network A Primer & Case Study WPS Wi-Fi Protected Setup Advantages of Attacking WPS (over the direct attack on WPA/WPA2 ) 1. Faster: Cracking the WPS PIN is considerably faster and not as luck-dependent. 2. Recovering of The Passphrase Knowledge of PIN enables recovering of the passphrase instantly even if the owner changes it. (with ‘wpscrack’ or ‘Reaver’). 3. Multiple radios use the same WPS pin Access points with multiple radios (2.4/5GHz) can be configured with multiple WPA keys. Since the radios use the same WPS pin, knowledge of the pin allows an attacker to recover all WPA keys. About: “WPS” WPS authentication WPS implementation flaw Security Context
  • 37.
    40 Security & Privacyof Wireless Area Network A Primer & Case Study Content Summary PARTB: The Case Study • Theoretical Methodology (Preface, Penetration Testing, WPS Review, Brute Force Methodology) • Preparation & Testing (Hardware & Software, Reaver, Test environment, Considerations) • Live Operations (Live environment, Operation in Area B1, Operation in Area M1) • Observations and recommendations (Observations, Recommendations)
  • 38.
    41 Security & Privacyof Wireless Area Network A Primer & Case Study Objective Penetration Testing WPS scope Brute Force Methodology THEORETICAL METHODOLOGY
  • 39.
    42 Security & Privacyof Wireless Area Network A Primer & Case Study The objective was to perform successful penetration testing through brute force attack methodology against a WPS PIN and describe the whole process and to execute several tests on APs in two different areas to find out how many of the APs used there were vulnerable to the attack. ” “ THEORETICAL METHODOLOGY Objective Penetration Testing WPS scope Brute Force Methodology
  • 40.
    43 Security & Privacyof Wireless Area Network A Primer & Case Study 1 Determine feasibility -of a particular set of attack vectors 2 Identify high-risk vulnerabilities -from a combination of lower-risk vulnerabilities exploited in a particular sequence -that may be difficult to detect with automated vulnerability scanning software 3 Assess the magnitude of potential business and operational impacts of successful attacks 4 Test the ability of network defenders to detect and respond to attacks 5 Provide evidence to support increased investments in security personnel and technology. The goals of penetration tests Def. A software attack on a computer system looking for security weaknesses & gaining access on system and data. ” “ THEORETICAL METHODOLOGY Objective Penetration Testing WPS scope Brute Force Methodology
  • 41.
    44 Security & Privacyof Wireless Area Network A Primer & Case Study 8 Digit Security Key 1 2 3 4 5 6 7 0 Checksum 1st half of PIN 2nd half of PIN Trial Incorrect if EAP-NACK message received after sending M4. Incorrect if EAP-NACK message received after sending M6. Maximum possible authentication attempts 108 =100,000,000 104 + 103 =10,000 + 1,000 =11,000 THEORETICAL METHODOLOGY Objective Penetration Testing WPS scope Brute Force Methodology
  • 42.
    45 Security & Privacyof Wireless Area Network A Primer & Case Study 802.11 Auth 802.11 Assoc EAP Initiation … 802.11 Deauth Send M4 Increment 1st half PIN Receive Send M4 Receive Dump AP Configuration (M7) Increment 2nd half of PIN/ Fix Checksum M5 NACK NACK M7 THEORETICAL METHODOLOGY Objective Penetration Testing WPS scope Brute Force Methodology
  • 43.
    46 Security & Privacyof Wireless Area Network A Primer & Case Study PREPARATION & TESTING Hardware & Software About: Reaver Test environment Test Considerations
  • 44.
    47 Security & Privacyof Wireless Area Network A Primer & Case Study PREPARATION & TESTING Reaver Brute-force Attacking AirCrack-ng Monitoring WireShark Packet Monitoring SOFTWARE OS Debian HARDTWARE Wireless Network Adapter Atheros AR5B91 System/Laptop // Acer Aspire 5738z Hardware & Software About: Reaver Test environment Test Considerations
  • 45.
    48 Security & Privacyof Wireless Area Network A Primer & Case Study PREPARATION & TESTING “Reaver is an open source tool for Linux distributions which implements the brute force attack against WPS PIN in order to receive the PSK. The source and free download can be found in. ” Factors influencing the length of the recovery process AP type Signal strength Lockout policy "Reaver has been designed to be a robust and practical attack against WPS, and has been tested against a wide variety of access points and WPS implementations.” Hardware & Software About: Reaver Test environment Test Considerations Reaver Brute-force Attacking Reaver
  • 46.
    49 Security & Privacyof Wireless Area Network A Primer & Case Study PREPARATION & TESTING AP configured for WPA2-PSK with 14-60 characters passphrase Hardware & Software About: Reaver Test environment Test Considerations
  • 47.
    50 Security & Privacyof Wireless Area Network A Primer & Case Study PREPARATION & TESTING The wireless card was put into monitor mode Monitor the network traffic, the airodump-ng tool Reaver performs a brute force attack against PIN This provided us with the list of wireless networks in range of our laptop. After finding the BSSID of the targeted network, Hardware & Software About: Reaver Test environment Test Considerations
  • 48.
    51 Security & Privacyof Wireless Area Network A Primer & Case Study Example // Frame exchange during the attacking process
  • 49.
    52 Security & Privacyof Wireless Area Network A Primer & Case Study Example Successful attack shows PIN, PSK & SSID
  • 50.
    53 Security & Privacyof Wireless Area Network A Primer & Case Study PREPARATION & TESTING Random amount of time taken for 10 different attacks No. PSK Length Duration 1 14 96 minutes 2 14 77 minutes 3 63 226 minutes 4 63 119 minutes 5 47 204 minutes 6 47 112 minutes 7 25 84 minutes 8 25 265 minutes 9 20 189 minutes 10 20 106 minutes “The time needed to successfully complete the attack in same conditions is basically random; depends mostly on how fast is the first half of PIN guessed.” Hardware & Software About: Reaver Test environment Test Considerations
  • 51.
    54 Security & Privacyof Wireless Area Network A Primer & Case Study PREPARATION & TESTING Random amount of time taken for 10 different attacks Ideal conditions for performing an attack: • Maximum strength signal, • Decent router CPUs capabilities, and • No error messages (no lost frames, no timeouts occurred) -resulted in very fast PIN attempts (a little less than 2 seconds per one). At this rate, even the worst possible scenario (11,000 possible trial) would take less than 6 hours to complete. Hardware & Software About: Reaver Test environment Test Considerations
  • 52.
    55 Security & Privacyof Wireless Area Network A Primer & Case Study LIVE Operation Live environment & Client Profile Operation in Area B1 Operation in Area M1
  • 53.
    56 Security & Privacyof Wireless Area Network A Primer & Case Study LIVE EXPRIMENT - The Penetration testing was operated more than one WLAN. - Permission obtained from an organization to perform attacks on their two sister concerns. - Two concerns office is located in two different locations located in- - Banani (B1) and - Mohammadpur (M1) - Due to security reasons the operation was not permitted any data (organization’s name, Location, Technical particulars etc.) that may indicate the identity of the organization. Live environment & Client Profile Operation in Area B1 Operation in Area M1
  • 54.
    57 Security & Privacyof Wireless Area Network A Primer & Case Study LIVE EXPRIMENT 8wireless networks detected in the building. - 4potential targets (using WPA/WPA2 in PSK mode) - 3networks were encrypted by WEP - 1was not using any encryption at all. (Attacks performs from the public area of the building caused considerably weaker signal strength varied from 34%-76%.) 4 1 3 ‘B1’ 8 Wireless Networks (APs) Encrypted with WEP No encryption Not Targated Live environment & Client Profile Operation in Area B1 Operation in Area M1
  • 55.
    58 Security & Privacyof Wireless Area Network A Primer & Case Study Public Front OfficeOffice Office Office Office Office Office Office Pantry Office OfficeMeetingRoom2 MeetingRoom1 Store RestroomRestroom RestroomMechanical Attacker Aps 8 Secured AP 3 Target AP 3 Compr. AP 1 Public AP 1
  • 56.
    59 Security & Privacyof Wireless Area Network A Primer & Case Study LIVE EXPRIMENT 11wireless networks detected in the building. - 6potential targets (using WPA/WPA2 in PSK mode) - 2networks were encrypted by WEP - 2potential targets (using WPA/WPA2 in enterprise mode) - 1was not using any encryption at all. 6 2 2 1 ‘M1’ 8 Wireless Networks (APs) Targets WEP Encrypted WPA/WPA2 Encrypted No Encryption Live environment & Client Profile Operation in Area B1 Operation in Area M1
  • 57.
    60 Security & Privacyof Wireless Area Network A Primer & Case Study Reception Meeting Room Store Mechanical Veranda Restroom Pantry Dining Meeting Room Office Office OfficeOffice Space Office Office Office Office Restroom Restroom Attacker APs Secured AP 6 Target AP 4 Compr. AP 2 Public AP 1
  • 58.
    61 Security & Privacyof Wireless Area Network A Primer & Case Study CASE OBSERVATIONS
  • 59.
    64 Security & Privacyof Wireless Area Network A Primer & Case Study CASE OBSERVATIONS Majority of the WLAN users (people using any kind of LAN) can connect and use the WLAN safely, since the biggest (and most used) networks were being used in the Enterprise mode. The small local WLANs, which were vulnerable to our attacks, are being used only by small groups of users. It does not automatically imply that there is low or no chance of capturing important data, but it can be assumed that with more users being potential targets the attacker’s chances would be considerably higher.
  • 60.
    65 Security & Privacyof Wireless Area Network A Primer & Case Study CASE OBSERVATIONS Any attack in the network whether it is unsuccessful or not, it is most probably caused by one of the following reasons: Any AP should have a lockout policy, which makes a brute force attack impractical/impossible. (However, during our tests there was no such a device targeted. Either the attack got going and did successfully end or it did not start.) The target AP does not support WPS or it is turned off manually on the device. Since the WPS is enabled by default on majority of devices which support WPS and regular users would not turn it off, the unsuccessful attack is more likely caused by the fact that the device is older and it does not support WPS at all. AP was used in an Enterprise mode for enhanced security, which is not vulnerable to WPS PIN brute force attack.
  • 61.
    66 Security & Privacyof Wireless Area Network A Primer & Case Study CASE RECOMMANDATIONS The organization should be concerned that it is possible to abuse the WPS implementation flaw to get full access to the wireless network. The organization should also be concerned regarding the risk level as to get into the network all the potential attacker needs minimal resource. The organization is recommended to acknowledge the followings: Any AP should have a lockout policy, which makes a brute force attack impractical/impossible. If The AP supports WPS, it may turn off manually on the device. Any AP should be used in an Enterprise mode for enhanced security
  • 62.
    67 Security & Privacyof Wireless Area Network A Primer & Case Study FUTURE SCOPES Future work should focus on some of the following issues:  Detailed work in- » WLAN standards » WLAN Security flows » Active attacks on WLAN » Hardware and software countermeasures on WLAN security » WLAN Security Encryption methods » WPS authentication mechanism  Other pentation testing from different environments with different other mechanisms.  Reducing and eliminating the risks attacks that can be happened on WLAN networks such as Man-in-the Middle attacks, Denial of Service (DoS) attacks and Identity theft (MAC spoofing).  Penetration testing from mobile devises (e.g. Kali Linux/nethunter equipped Android devices).
  • 63.
    68 Security & Privacyof Wireless Area Network A Primer & Case Study Security & Privacy of Wireless Area Network A Primer & Case Study Thank You for your Time, passion and interest » Questions » Discussions » Recap Thank You > Questions > Discussions > Recap ====================================================== This presentation is a part of the paper submitted for BIM PGDCS 2015 Course. This presentation is also available in www.MahmudKabir.com/pgdcsppt and also in the following sites: > // SlideShare.com || YouTube.com || MS PowerPoint Live

Editor's Notes

  • #20 To counter security issues, the original IEEE802.11 specification defined two means to validate the identities of wireless devices attempting to gain access to a WLAN – open system authentication (Service Set Identifiers and Media Access Control address filtering) and shared key authentication (Wired Equivalent Protocol); neither of these is secure. Service Set Identifier (SSID) The SSID acts as a WLAN identifier; it allows STAs to distinguish one WLAN from another. All devices trying to connect to a WLAN must use the same SSID. A client device cannot communicate with an established wireless network unless it is configured with the correct SSID. Because the SSID is broadcast in plaintext by the AP by default, an attacking node can read the SSID from beacon frames and use it to join the network as a legitimate node. Even if the APs beacon frames are disabled, since the SSID is transmitted in cleartext in the message headers, any node listening to the traffic can sniff it. Media Access Control (MAC) Address Filters A MAC address is a unique 48-bit value that is assigned to a particular wireless network interface by the network card's vendor. Many WLAN implementations allow administrators to specify a list of authorized MAC addresses; the AP will permit devices with those MAC addresses only to use the WLAN. This is known as MAC address filtering. However, since the MAC address is not encrypted, it is simple to intercept traffic and identify MAC addresses that are allowed past the MAC filter. Unfortunately, almost all WLAN adapters allow applications to set the MAC address, so it is relatively trivial to spoof a MAC address, meaning attackers can gain unauthorized access easily. Wired Equivalent Privacy (WEP) According to the IEEE802.11 standard, WEP was supposed "to provide data confidentiality that is subjectively equivalent to the confidentiality of a wired local area network". WEP relies on the RC4 cipher and a static secret key that is manually shared between all of the nodes in a wireless LAN. WEP was plagued with security issues in relation to the actual implementation of the encryption algorithm, the key lengths, poor key management, authentication and message integrity. WEP has now been proven to be easily breached and cannot be relied upon to secure WLANs. Extensible Authentication Protocol (EAP) IEEE802.11i references the Extensible Authentication Protocol (EAP) standard, which is a means for providing mutual authentication between STAs and the WLAN infrastructure, as well as performing automatic cryptographic key distribution. Robust Security Network (RSN) The IEEE802.11i specification introduces the concept of a Robust Security Network (RSN), which is defined as a wireless security network that allows the creation of Robust Security Network Associations (RSNA) only. A RSNA is a logical connection between communicating IEEE802.11 entities established through the IEEE802.11i key management scheme, called the 4-Way Handshake, which is a protocol that validates that both entities share a pairwise master key (PMK), synchronizes the installation of temporal keys, and confirms the selection and configuration of data confidentiality and integrity protocols.
  • #21 To counter security issues, the original IEEE802.11 specification defined two means to validate the identities of wireless devices attempting to gain access to a WLAN – open system authentication (Service Set Identifiers and Media Access Control address filtering) and shared key authentication (Wired Equivalent Protocol); neither of these is secure. Service Set Identifier (SSID) The SSID acts as a WLAN identifier; it allows STAs to distinguish one WLAN from another. All devices trying to connect to a WLAN must use the same SSID. A client device cannot communicate with an established wireless network unless it is configured with the correct SSID. Because the SSID is broadcast in plaintext by the AP by default, an attacking node can read the SSID from beacon frames and use it to join the network as a legitimate node. Even if the APs beacon frames are disabled, since the SSID is transmitted in cleartext in the message headers, any node listening to the traffic can sniff it. Media Access Control (MAC) Address Filters A MAC address is a unique 48-bit value that is assigned to a particular wireless network interface by the network card's vendor. Many WLAN implementations allow administrators to specify a list of authorized MAC addresses; the AP will permit devices with those MAC addresses only to use the WLAN. This is known as MAC address filtering. However, since the MAC address is not encrypted, it is simple to intercept traffic and identify MAC addresses that are allowed past the MAC filter. Unfortunately, almost all WLAN adapters allow applications to set the MAC address, so it is relatively trivial to spoof a MAC address, meaning attackers can gain unauthorized access easily. Wired Equivalent Privacy (WEP) According to the IEEE802.11 standard, WEP was supposed "to provide data confidentiality that is subjectively equivalent to the confidentiality of a wired local area network". WEP relies on the RC4 cipher and a static secret key that is manually shared between all of the nodes in a wireless LAN. WEP was plagued with security issues in relation to the actual implementation of the encryption algorithm, the key lengths, poor key management, authentication and message integrity. WEP has now been proven to be easily breached and cannot be relied upon to secure WLANs. Extensible Authentication Protocol (EAP) IEEE802.11i references the Extensible Authentication Protocol (EAP) standard, which is a means for providing mutual authentication between STAs and the WLAN infrastructure, as well as performing automatic cryptographic key distribution. Robust Security Network (RSN) The IEEE802.11i specification introduces the concept of a Robust Security Network (RSN), which is defined as a wireless security network that allows the creation of Robust Security Network Associations (RSNA) only. A RSNA is a logical connection between communicating IEEE802.11 entities established through the IEEE802.11i key management scheme, called the 4-Way Handshake, which is a protocol that validates that both entities share a pairwise master key (PMK), synchronizes the installation of temporal keys, and confirms the selection and configuration of data confidentiality and integrity protocols.
  • #22 To counter security issues, the original IEEE802.11 specification defined two means to validate the identities of wireless devices attempting to gain access to a WLAN – open system authentication (Service Set Identifiers and Media Access Control address filtering) and shared key authentication (Wired Equivalent Protocol); neither of these is secure. Service Set Identifier (SSID) The SSID acts as a WLAN identifier; it allows STAs to distinguish one WLAN from another. All devices trying to connect to a WLAN must use the same SSID. A client device cannot communicate with an established wireless network unless it is configured with the correct SSID. Because the SSID is broadcast in plaintext by the AP by default, an attacking node can read the SSID from beacon frames and use it to join the network as a legitimate node. Even if the APs beacon frames are disabled, since the SSID is transmitted in cleartext in the message headers, any node listening to the traffic can sniff it. Media Access Control (MAC) Address Filters A MAC address is a unique 48-bit value that is assigned to a particular wireless network interface by the network card's vendor. Many WLAN implementations allow administrators to specify a list of authorized MAC addresses; the AP will permit devices with those MAC addresses only to use the WLAN. This is known as MAC address filtering. However, since the MAC address is not encrypted, it is simple to intercept traffic and identify MAC addresses that are allowed past the MAC filter. Unfortunately, almost all WLAN adapters allow applications to set the MAC address, so it is relatively trivial to spoof a MAC address, meaning attackers can gain unauthorized access easily. Wired Equivalent Privacy (WEP) According to the IEEE802.11 standard, WEP was supposed "to provide data confidentiality that is subjectively equivalent to the confidentiality of a wired local area network". WEP relies on the RC4 cipher and a static secret key that is manually shared between all of the nodes in a wireless LAN. WEP was plagued with security issues in relation to the actual implementation of the encryption algorithm, the key lengths, poor key management, authentication and message integrity. WEP has now been proven to be easily breached and cannot be relied upon to secure WLANs. Extensible Authentication Protocol (EAP) IEEE802.11i references the Extensible Authentication Protocol (EAP) standard, which is a means for providing mutual authentication between STAs and the WLAN infrastructure, as well as performing automatic cryptographic key distribution. Robust Security Network (RSN) The IEEE802.11i specification introduces the concept of a Robust Security Network (RSN), which is defined as a wireless security network that allows the creation of Robust Security Network Associations (RSNA) only. A RSNA is a logical connection between communicating IEEE802.11 entities established through the IEEE802.11i key management scheme, called the 4-Way Handshake, which is a protocol that validates that both entities share a pairwise master key (PMK), synchronizes the installation of temporal keys, and confirms the selection and configuration of data confidentiality and integrity protocols.
  • #24 Confidentiality Ensure that communications cannot be read by unauthorized parties. Confidentiality "is the property, that information is not made available or disclosed to unauthorized individuals, entities, or processes". Integrity Detect any intentional or unintentional changes to data that occur in transit. Data integrity means maintaining and assuring the accuracy and completeness of data over its entire life-cycle Availability Ensure that devices and individuals can access a network and its resources whenever needed. For any information system to serve its purpose, the information must be available when it is needed. Security Mechanics & Key Mechanisms Definitions Mechanisms Confidentiality Capability to protect information from unauthorized entities. The capability to send/receive data without divulging any information to unauthorized entities during the transmission of data. Encryption (Symmetric and Asymmetric) Integrity Capability to protect data content from unauthorized modifications. Capability to send/receive data such that unauthorized entities cannot change any part of the exchanged data without the sender/receiver detecting the change. Digital Signatures (Using one-way hash functions) Availability Capability to send/receive data without disruption. Ensures that a system or data is accessible/available when needed. Defensive technologies to detect/guard against DoS attacks Authentication Capability to validate the identity of the sender/receiver of information. 802.1x, RADIUS, PAP/CHAP, MS-CHAP, etc. Authorization Usually follows an authentication procedure, and establishes what capabilities and information a user can access. 802.1x (based on authentication), multiple levels and protocols Access Control Capability ensuring users see only the information for which they are authorized. Based on authentication, encryption Encryption Capability to transform data (or plain text) into meaningless bytes (Cipher text) based on some algorithm. WEP, CKIP, TKIP, AES Decryption Capability to transform the meaningless bytes (Cipher text) back to meaningful data (or plain text). WEP, CKIP, TKIP, AES Key Management Process and capability of generating, storing, and distributing keys.  
  • #36 The standard emphasizes usability and security, and allows four modes in a home network for adding a new device to the network: PIN method, in which a personal identification number (PIN) has to be read from either a sticker or display on the new wireless device. This PIN must then be entered at the "representant" of the network, usually the network's access point. Alternately, a PIN provided by the access point may be entered into the new device. This method is the mandatory baseline mode and everything must support it. The Wi-Fi Direct specification supersedes this requirement by stating that all devices with a keypad or display must support the PIN method.[7] Push button method, in which the user has to push a button, either an actual or virtual one, on both the access point and the new wireless client device. On most devices, this discovery mode turns itself off as soon as a connection is established or after a delay (typically 2 minutes or less), whichever comes first, thereby minimizing its vulnerability. Support of this mode is mandatory for access points and optional for connecting devices. The Wi-Fi Direct specification supersedes this requirement by stating that all devices must support the push button method.[8] Near field communication method, in which the user has to bring the new client close to the access point to allow a near field communication between the devices. NFC Forum–compliant RFID tags can also be used. Support of this mode is optional. USB method, in which the user uses a USB flash drive to transfer data between the new client device and the network's access point. Support of this mode is optional, but deprecated. The last two modes are usually referred to as out-of-band methods as there is a transfer of information by a channel other than the Wi-Fi channel itself. Only the first two modes are currently[when?] covered by the WPS certification. The USB method has been deprecated and is not part of the Alliance's certification testing. Certain wireless access points have a dual-function WPS button, and holding this button for a long enough time will cause a factory-reset.[9] Some manufacturers use a different logo and/or name for Wi-Fi Protected Setup such as Netgear;[10] the Wi-Fi Alliance recommends the use of the Wi-Fi Protected Setup Identifier Mark on the hardware button for this function.[11]
  • #38 >>>> Enrollee = AP Registrar = Supplicant = Client/Attacker PKE = Diffie-Hellman Public Key Enrollee PKR = Diffie-Hellman Public Key Registrar Authkey and KeyWrapKey are derived from the DiffieHellman shared key. Authenticator = HMAC{Authkey}(last message || current message) E{KeyWrapKey} = Stuff encrypted with KeyWrapKey (AESCBC) PSK1 = first 128 bits of HMACAuthKey(1 st half of PIN) PSK2 = first 128 bits of HMACAuthKey(2nd half of PIN) E-S1 = 128 random bits E-S2 = 128 random bits E-Hash1 = HMACAuthKey(E-S1 || PSK1 || PKE || PKR) E-Hash2 = HMACAuthKey(E-S2 || PSK2 || PKE || PKR) R-S1 = 128 random bits R-S2 = 128 random bits R-Hash1 = HMACAuthKey(R-S1 || PSK1 || PKE || PKR) R-Hash2 = HMACAuthKey(R-S2 || PSK2 || PKE || PKR)