VIKAS SINGH BHADOURIA, profile picture
Uploaded byVIKAS SINGH BHADOURIA
PDF, PPTX4,663 views

Wireless Hacking

The document discusses wireless hacking, focusing on the mechanics of Wi-Fi, its vulnerabilities, and methods of attack. It highlights the importance of lawful use and the risks associated with hacking into private networks, while explaining various Wi-Fi standards, protocols, and security measures including WEP, WPA, and WPA2. It also outlines the weaknesses in these security protocols and provides insights into effective hacking techniques and tools.

Internetâ—¦

Embed presentation

Download as PDF, PPTX
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Wireless HackingWireless Hacking Edri GuyEdri Guy Mar 04 ,2013Mar 04 ,2013
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux DISCLAIMERDISCLAIMER 1 – The following discussion is for informational and education1 – The following discussion is for informational and education purpose only.purpose only. 2 – Hacking into private network without the written permission2 – Hacking into private network without the written permission from the owner is Illegal and strictly forbidden.from the owner is Illegal and strictly forbidden. 3 – Misused could result in breaking the law so use it at your own3 – Misused could result in breaking the law so use it at your own risk.risk.
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Overview ● We're going to learn how WiFi (802.11) works ● Start with terminology ● Types ● Vulnerabilities ● Attacking them ● Surprise demonstration of....:) Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Terminology ● AP - Access Point ● MAC – Media Access Control a unique id assigned to wireless adapters and routers. It comes in hexadecimal format (ie 00:11:ef:22:a3:6a) Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Terminology ● BSSID – Access Point's MAC Address ● ESSID - Access Point’s Broadcast name. (ie linksys, default, belkin etc) Some AP’s will not broadcast their name,But Airodump-ng can guess it. Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Gear - Antennas ●  Dipole – Standar, Omni directional ●  Hyperbolic  – Mushroom Shaped signal ●  Yaggi  – Very directional (Japanese R&D) ●  Pringles – Improvised(Hacker Style) Yaggi ●  WindSurfer – Improvised hyperbolic Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Gear - Antennas ●  WindSurfer – Improvised hyperbolic Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Channels ● The physical frequency of the wireless transmissions ● Channels are between 1-14 (1-11 in the USA) ● 802.11 is the wireless communication standard by IEEE Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Channels Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Standards ● 802.11a – 5 GHZ rate : upto 54Mbps ● 802.11b – 2.4 GHZ rate : upto 11Mbps ● 802.11g – 2.4 GHZ rate : upto 54Mbps ● 802.11n – 2.4 GHZ rate : upto 300Mbps ● 802.11ac(draft) – 5 GHZ rate : upto 1.73Gps !!! Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Transmission Power ● Transmit power, or txpower, regulated by country. ● txpower has a max of 0.5 Watts ● Coded into the Linux Kernel ● Easier than changing the kernel is to move to another country Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux A little backdoor Move to Bolivia (Almost no restrictions there) iw reg get iw reg set BO iwconfig wlan0 txpower 30(only if your card support it) Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux A little backdoor – more than 30dbm apt-get install libgcrypt11-dev python-m2crypto libnl1 libnl-dev cd ~ mkdir custom-rdb cd custom-rdb wget http://kernel.org/pub/software/network/wireless-regdb/wireless-regdb-2013.02.13.tar.bz2 cd ~ tar –xvjf wireless-regdb-2013.02.13.tar.bz2 cd wireless-regdb-2013.02.13 Now edit the file db.txt (2402 - 2494 @ 40), (N/A, 35) (4910 - 5835 @ 40), (N/A, 35) make && make install Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux A little backdoor – more than 30dbm Backup and copy new key. cp /usr/lib/crda/regulatory.bin /usr/lib/crda/regulatory.bin.bak cp regulatory.bin /usr/lib/crda/ cd ~/custom-rdb wget http://wireless.kernel.org/download/crda/crda-1.1.3.tar.bz2 tar -xvjf crda-1.1.3.tar.bz2 cd crda-1.1.3 Copy the generated keys from regdb folder: cp ~/custom-rdb/wireless-regdb-2013.02.13/*.key.pub.pem pubkeys make && make install http://www.rapidtables.com/convert/power/dBm_to_Watt.htm#table Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WiFi has 6 modes ● Master - Access Point or Base Station ● Managed - Infrastructure Mode (Client) ● Ad-Hoc – Device to Device ● Mesh (Mesh Cloud/Network) ● Repeater - Range Extender ● Monitor (RFMON) Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Terminology ● Packet – an amount of data transferred in a network. ● Frame – a container which the packet is transfered within Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Frame Structure ● Frames: Simply Data Packets Typically made up of: Header, Payload, Integrity Check (CRC) ● Frame Header: Source and Destination Ether Type (What Protocol) Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Protocols ● ARP – Address Resolution Protocol ● MAC – Media Access Control ● IP – Internet Protocol Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux ARP Packets Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WiFi Frames ● Management Frames ● Control Frames ● Data Frames Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Management Frames ● Beacons ● Probes ● Associations ● Authentications Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Beacon Frames ● Advertise the network ● Specify SSID, Channels and other capabilities ● View those frames: gksudo wireshark & disown ● Wireshark filter: wlan.fc.subtype == 0x08 Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Probe Frames ● Probe Request - Are you my friend? wlan.fc.type_subtype == 0x04 ● Probe Response - Includes capability info wlan.fc.type_subtype == 0x05 ●Demo: Viewing probes airmon­ng start wlan2 airodump­ng mon0 Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Management Frames – Beacon Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Management Frames – Probe Request Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Management Frames – Probe Response Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Association Frames ● Association ● Association Request - Can we be friends? ● Association Response ● Disassociation Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Authentication Frames ● Authentication ● De-Authentication Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Control Frames ● Request to Send ­ RTS:    ­ May I speak sir ? ● Clear to Send ­ CTS:    ­ Everything all right soldier ●  Acknowledgement – ACK:   ­ Got it sir Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Attack Vectors ● Direct Attack Injectable? WEP WPA1/2 (excluding WPA2-Enterprise) ● DOS attacks (De-Auth) ● Rouge Access Point (Caffe-Latte/Hirte/KoRek) ● Karma ● Much much more (...) Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP ● Wired Equivalent Privacy ● WEP uses 64,128 and 256bit(very rare) keys ● Everything but layer 2 ● Uses IV (Initialization Vector) ● Uses RC4 for encryption ● WEP uses CRC instead of MAC(Message Authentication Code) Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP - Flaws ● RC4 is a stream cipher and same key should not be used twice! - The length of the IV is 24Bit ● WEP uses a 64/128 bit key which is concatenated with a 24­bit initialization vector (IV) to form the RC4 traffic key. - 64Bit key is made of 24bit IV + 48bit key (12 hex characters)    ­128Bit key is made of 24bit IV + 104bit key (26 hex characters)    Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP - Flaws ●  The purpose of an IV, which is transmitted as plain text,Is to prevent    any repetition,  But a 24­bit IV is not long enough to ensure this on a busy network. ●  BUT... Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP - Flaws Statistically for a 24-bit IV, there is a 50% probability the same IV will repeat after 5000 packets. Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP – Schema Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Authentication methods - Open ●  Open system ­ Any client, regardless of its WEP keys,  can authenticate itself with the AP and then attempt to associate. ●  All you need is the right keys for authentication and association,   WEP can be used for encrypting the data frames. ●  Bottom line, no authentication occurs... Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Authentication methods – Shared Key Four way handshake: AR – Authentication Request AP send back Clear-Text challenge Encrypted Challenge AP Decrypts and knows if the client knows the key or not Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Shared Key - Vulnerability ●  Share key is less secure because it   allows the attacker to get IVs using   the challenge through response    mechanism! Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Authentication – Challenge Text Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP - Authentication Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA - Stats ● WPA TKIP (Temporal Key Integrity Protocol) was built upon WEP. The idea was to close all the vulnerabilities and use the same hardware. Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA - Stats ● WPA still using RC4(Like WEP) but the keys were changed to Temporal Key Intergrity Protocol(TKIP). ● All regular WLAN devices that worked with WEP are able to be simply upgraded and no new equipment needs to be bought. ● TKIP basically works by generating a sequence of WEP keys based on a master key,and re-keying periodically before enough volume of data. Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA - Stats ● TKIP changes the Key every 10,000 packets,which is quick enough to combat statistical methods to analyze the cipher. ● TKIP also adds Message Integrity Code(MIC).The transmission’s CRC,ICV(Integrity Check Value) is checked. If the packet was tampered with. WPA will stop using the current keys and re­key Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA - Weakness ● WPA is crackable,It just requires slightly more effort from the attacker. The process if as follows : 1 - Send a De-Auth to AP 2 - AP Re-Auth the Client 3 - Capture the Handshake 4 - Brute force on the Handshake ● In 2009 Beck-Tew attack was discovered,It allows to decrypt a packet without knowing the key(Base on ChopChop Attack) Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA Your best solution is WPA2–AES !!! Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA2 Replaced WEP and WPA1 at June 2004 Uses CCMP(strong AES base encryption) Solves many issues aroused with WEP/WPA1 Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA2 ● WPA2 is still vulnerable to brute force attack. Weak password may cause insecure network. We still have to choose strong password in order to achieve good security. Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA2 ● There is no known attack on the cipher ● However... Handshake is vulnerable to attack ● Once we got the 4-way handshake,We are good to go Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA2 – Weakness ● It is possible to crack WPA2 with very high chances of success.But it depends on the length and complexity of the password. ● Elcomsoft developed an application that uses GPU power to attempt over 120,000 passwords per second. Depending on the key, it can take anywhere from seconds to the next big bang!!! Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPS (Worst Protection System) WiFi Protected Setup ● PIN Method – Remotely while authenticating ● Push-Button-Method – As it sounds ● Near-Field-Communication - As it sounds ● USB – Shared Information on USB stick Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPS ● The WPS code is built out of 8 digits. ● No authentication is needed to try pin codes ● The pin code is 8 digits ● The first 4 are immediately checked ● The last digit is a check sum Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPS Original combinations should be: 10^8 (100 million) After considering 4 digit check: 10^4+10^4 = 20,000 After checksum digit: 10^4+10^3 = 11,000 Assuming only 100 tries a minute (low) 11,000/100 = 110 minutes = almost 2 hours Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP Attacks ● It is possible to recover a 104Bit WEP key with probability 50% using only 40,000 captured packets. ● 60,000 captured packet rise the probability to 80%. ● 80,000 captured packets rise the probability to 95% ● The actual computation takes about 3 seconds and 3 MB of main memory on a Pentium­M 1.7 GHz ... Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Attacking Methods  Passive – Silence Mode     sniffing the air for packets without      sending any data to the AP or clients.   Active ­        breaking the key while sending data to        the AP or client. Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Attacking Methods   ARP Replay    Caffe­Latte   Hirte    ChopChop / KoRek    FMS Attack   PTW Attack Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Demo time !!! ● ARP Replay Attack steps 1 - Start capturing first Pockets : airodump-ng --channel $CH --bssid $BSSID --write dump-to-crack mon0 2 - Starting ARP Reply Attack : aireplay-ng --arpreplay -b $ESSID -x 100 -h $ORIGINAL-MAC mon0 3 – Start De-Auth Attack(Until you get ARP packets) : aireplay-ng --deauth 1 -a $BSSID -h $CLIENT-MAC mon0 4 – Start cracking the CAP file. aircrack-ng dump-to-crack.cap Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Demo time !!! ● Hirte Attack(Extends for Caffe-Latte) steps 1 – Find a probe you want to hack and start the Hirte Attack : airbase-ng -W 1 -c 6 -N --essid $ESSID-TO-HACK mon0 2 – Start saving the packets : airodump-ng --channel $CH --bssid $BSSID --write dump-to-crack mon0 3 – Start cracking the CAP file aircrack-ng dump-to-crack.cap Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Attacks inside the network  MiTM ( Man In The Middle ) Attack  SSL MiTM Attack  Downgrade encryption 1 – HTTPS to HTTP 2 – POP3s/SMTPs to POP3/SMTP 3 – NTLMv2 to NTLMv1 Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Man In The Middle Introduction WiFi Classes Vulnerabilities Attack Brad Jennifer
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Man In The Middle Introduction WiFi Classes Vulnerabilities Attack Brad Jennifer
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Cool Tools Aircrack-ng package including: Airmon-ng Airodump-ng Aireplay-ng Aircrack-ng Airebase-ng Airdeclock-ng Airdriver-ng And more :) Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Cool Tools ● Wireshark ● Reaver ● Kismet ● WiGLE ● Gerix Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Getting aircrack-ng Get Backtrack OR Get compact-wireless drivers And compile your aircrack-ng Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Wireshark – Cheat Sheets Introduction WiFi Classes Vulnerabilities Attack ● Probe Request wlan.fc.type_subtype == 0x04 ● Probe Response wlan.fc.type_subtype == 0x05 ● Association Request wlan.fc.type_subtype == 0x00 ● Association Response wlan.fc.type_subtype == 0x01 ● Disassociate wlan.fc.type_subtype == 0x0a ● Authentication wlan.fc.type_subtype == 0x0b
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Let's Practice WEP BSSID: ESSID: Haifux-01 WPA2 BSSID: ESSID: WeLoveMS Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Contact info Cheat Sheet Introduction WiFi Classes Vulnerabilities Attack Password: l33t_hax0rs! Email – guy@pclabs.co.il Facebook – www.facebook.com/pclabs Twitter - @pc_labs , twitter.com/pc_labs LinkedIN - https://www.linkedin.com/pub/guy-edri/1/3a8/961 Hacking Define Experts course – www.see-security.com See Consulting – www.see-secure.com Video of this lecture - ● Part I ● Part II
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux One more thing !!! Introduction WiFi Classes Vulnerabilities Attack
Wireless Hacking – Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Thanks Introduction WiFi Classes Vulnerabilities Attack

More Related Content

PPTX
Wireless hacking
byarushi bhatnagar
 
PDF
Wireless Cracking using Kali
byn|u - The Open Security Community
 
PPTX
How Hack WiFi through Aircrack-ng in Kali Linux Cyber Security
byAhmad Yar
 
PPTX
Wi-FI Hacking
byMehul Jariwala
 
PPT
Ch04 Network Vulnerabilities and Attacks
byInformation Technology
 
PPTX
Aircrack
byMuhammadHanzalah6
 
DOCX
Ethical Hacking (CEH) - Industrial Training Report
byRaghav Bisht
 
PPTX
Network scanning
byoceanofwebs
 
Wireless hacking
byarushi bhatnagar
 
Wireless Cracking using Kali
byn|u - The Open Security Community
 
How Hack WiFi through Aircrack-ng in Kali Linux Cyber Security
byAhmad Yar
 
Wi-FI Hacking
byMehul Jariwala
 
Ch04 Network Vulnerabilities and Attacks
byInformation Technology
 
Aircrack
byMuhammadHanzalah6
 
Ethical Hacking (CEH) - Industrial Training Report
byRaghav Bisht
 
Network scanning
byoceanofwebs
 

What's hot

PDF
01- intro to firewall concepts
byMostafa El Lathy
 
PPTX
Wi Fi Security
byyousef emami
 
PDF
11 palo alto user-id concepts
byMostafa El Lathy
 
ODP
Web Application Firewall
byChandrapal Badshah
 
PPTX
Wifi Security
byShital Kat
 
PPTX
WiFi Secuiry: Attack & Defence
byPrakashchand Suthar
 
PPTX
Beyaz Şapkalı Hacker CEH Eğitimi - Bölüm 19
byBGA Cyber Security
 
PPTX
IPSec and VPN
byAbdullaziz Tagawy
 
PPTX
OWASP Top 10 2021 Presentation (Jul 2022)
byTzahiArabov
 
PDF
7 palo alto security zones & interfaces concepts
byMostafa El Lathy
 
PDF
2 what is the best firewall (sizing)
byMostafa El Lathy
 
PPT
Introduction To OWASP
byMarco Morana
 
PPTX
Palo Alto Networks 28.5.2013
byBelsoft
 
PDF
Application Security | Application Security Tutorial | Cyber Security Certifi...
byEdureka!
 
PDF
Firepower ngfw internet
byRony Melo
 
PPTX
Network-security-ppt.pptx...............
byAkilSayyad2
 
PDF
Ch 5: Port Scanning
bySam Bowne
 
PDF
User expert forum user-id
byAlberto Rivai
 
PDF
12 palo alto app-id concept
byMostafa El Lathy
 
PPTX
Network security
byEstiak Khan
 
01- intro to firewall concepts
byMostafa El Lathy
 
Wi Fi Security
byyousef emami
 
11 palo alto user-id concepts
byMostafa El Lathy
 
Web Application Firewall
byChandrapal Badshah
 
Wifi Security
byShital Kat
 
WiFi Secuiry: Attack & Defence
byPrakashchand Suthar
 
Beyaz Şapkalı Hacker CEH Eğitimi - Bölüm 19
byBGA Cyber Security
 
IPSec and VPN
byAbdullaziz Tagawy
 
OWASP Top 10 2021 Presentation (Jul 2022)
byTzahiArabov
 
7 palo alto security zones & interfaces concepts
byMostafa El Lathy
 
2 what is the best firewall (sizing)
byMostafa El Lathy
 
Introduction To OWASP
byMarco Morana
 
Palo Alto Networks 28.5.2013
byBelsoft
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
byEdureka!
 
Firepower ngfw internet
byRony Melo
 
Network-security-ppt.pptx...............
byAkilSayyad2
 
Ch 5: Port Scanning
bySam Bowne
 
User expert forum user-id
byAlberto Rivai
 
12 palo alto app-id concept
byMostafa El Lathy
 
Network security
byEstiak Khan
 

Viewers also liked

PPT
How To Hack Wireless Internet Connections
byguest85e156e
 
PDF
Wi-fi Hacking
byPaul Gillingwater, MBA
 
PPTX
WIFI Hacking
bySuraj Bohara
 
PDF
Wifi Password Hack v2.85 - The best software to hack the Wifi networks !
byHome
 
PDF
Hack wifi password using kali linux
byHelder Oliveira
 
PPT
Wlan security
bySajan Sahu
 
PDF
Wireless LAN Security, Policy, and Deployment Best Practices
byCisco Mobility
 
PPT
Wireless LAN security
byRajan Kumar
 
PPTX
Wlan security
byUpasona Roy
 
PPT
Wireless security presentation
byMuhammad Zia
 
PDF
Wireless Networking Security
byAnshuman Biswal
 
How To Hack Wireless Internet Connections
byguest85e156e
 
Wi-fi Hacking
byPaul Gillingwater, MBA
 
WIFI Hacking
bySuraj Bohara
 
Wifi Password Hack v2.85 - The best software to hack the Wifi networks !
byHome
 
Hack wifi password using kali linux
byHelder Oliveira
 
Wlan security
bySajan Sahu
 
Wireless LAN Security, Policy, and Deployment Best Practices
byCisco Mobility
 
Wireless LAN security
byRajan Kumar
 
Wlan security
byUpasona Roy
 
Wireless security presentation
byMuhammad Zia
 
Wireless Networking Security
byAnshuman Biswal
 

Similar to Wireless Hacking

PDF
Kablosuz Ä°letiĹźim ve GĂĽvenlik
bySiber GĂĽvenlik ToplululuÄźu
 
PPTX
Wirelessnetwork models and hacking .pptx
byssuser52a19e
 
PPTX
DevLink - WiFu: You think your wireless is secure?
byRob Gillen
 
PPTX
What Is Wifi ? Wifi History ? Wifi Hacking .pptx
byrupakhaire841973
 
DOC
Ichci13 submission 104 (1)
bySaravana Kumar
 
PDF
B-Sides Asheville 2014: Wifi...WTF?!?!
byTim Fowler
 
PPTX
Wireless Security null seminar
byNilesh Sapariya
 
PPTX
Lecture 3 SPI-08-Wifi Security.pptx culs
byxmark114
 
PPT
Securing wireless network
bySyed Ubaid Ali Jafri
 
PDF
Security PWNing 2018 - Penthertz: The use of radio attacks during redteam tests
by📡 Sebastien Dudek
 
PPTX
Wireless Penetration Testing
byMohammed Adam
 
PPTX
Wireless and how safe are you
byMarcus Dempsey
 
PDF
Ch 11: Hacking Wireless Networks
bySam Bowne
 
PPTX
WiFi security
byIhor Uzhvenko
 
PPTX
R1x g12 wifi i
bycairo university
 
PPTX
Wireless hacking
byMihir Shah
 
PPT
wi-fi
byAparajeetaWithSalu
 
PDF
Wi-Fi Denver OWASP Presentation Feb. 15, 2017
bykeyalea
 
PPT
W I R E L E S S F I D E L I T Y
bygou145
 
PPTX
Wi-Fi
bysukhdeepK
 
Kablosuz Ä°letiĹźim ve GĂĽvenlik
bySiber GĂĽvenlik ToplululuÄźu
 
Wirelessnetwork models and hacking .pptx
byssuser52a19e
 
DevLink - WiFu: You think your wireless is secure?
byRob Gillen
 
What Is Wifi ? Wifi History ? Wifi Hacking .pptx
byrupakhaire841973
 
Ichci13 submission 104 (1)
bySaravana Kumar
 
B-Sides Asheville 2014: Wifi...WTF?!?!
byTim Fowler
 
Wireless Security null seminar
byNilesh Sapariya
 
Lecture 3 SPI-08-Wifi Security.pptx culs
byxmark114
 
Securing wireless network
bySyed Ubaid Ali Jafri
 
Security PWNing 2018 - Penthertz: The use of radio attacks during redteam tests
by📡 Sebastien Dudek
 
Wireless Penetration Testing
byMohammed Adam
 
Wireless and how safe are you
byMarcus Dempsey
 
Ch 11: Hacking Wireless Networks
bySam Bowne
 
WiFi security
byIhor Uzhvenko
 
R1x g12 wifi i
bycairo university
 
Wireless hacking
byMihir Shah
 
wi-fi
byAparajeetaWithSalu
 
Wi-Fi Denver OWASP Presentation Feb. 15, 2017
bykeyalea
 
W I R E L E S S F I D E L I T Y
bygou145
 
Wi-Fi
bysukhdeepK
 

More from VIKAS SINGH BHADOURIA

PPT
Virtualization
byVIKAS SINGH BHADOURIA
 
DOCX
EDGE DETECTION
byVIKAS SINGH BHADOURIA
 
PPT
TCP /IP
byVIKAS SINGH BHADOURIA
 
PPT
Complete course on wireless
byVIKAS SINGH BHADOURIA
 
PDF
Principles of programming languages. Detail notes
byVIKAS SINGH BHADOURIA
 
PPT
Network Security
byVIKAS SINGH BHADOURIA
 
PPT
Improve your communication skills
byVIKAS SINGH BHADOURIA
 
PPT
Infrared spectroscopy
byVIKAS SINGH BHADOURIA
 
DOC
Speed detection-of-moving-vehicle-using-speed-cameras
byVIKAS SINGH BHADOURIA
 
PPT
Next generation graphics programming on xbox 360
byVIKAS SINGH BHADOURIA
 
DOC
Fingerprint based physical access control vehicle immobilizer
byVIKAS SINGH BHADOURIA
 
PPTX
Intelligent agents
byVIKAS SINGH BHADOURIA
 
PPTX
Interactive voice-response-system
byVIKAS SINGH BHADOURIA
 
PPT
Data compression
byVIKAS SINGH BHADOURIA
 
PPT
Brain computer-interface-ppt
byVIKAS SINGH BHADOURIA
 
PPT
Trees
byVIKAS SINGH BHADOURIA
 
DOCX
Introduction to parallel computing
byVIKAS SINGH BHADOURIA
 
PPT
Bluetooth mobileip
byVIKAS SINGH BHADOURIA
 
DOCX
Parallel computing persentation
byVIKAS SINGH BHADOURIA
 
DOCX
Full report on light peak technology
byVIKAS SINGH BHADOURIA
 
Virtualization
byVIKAS SINGH BHADOURIA
 
EDGE DETECTION
byVIKAS SINGH BHADOURIA
 
TCP /IP
byVIKAS SINGH BHADOURIA
 
Complete course on wireless
byVIKAS SINGH BHADOURIA
 
Principles of programming languages. Detail notes
byVIKAS SINGH BHADOURIA
 
Network Security
byVIKAS SINGH BHADOURIA
 
Improve your communication skills
byVIKAS SINGH BHADOURIA
 
Infrared spectroscopy
byVIKAS SINGH BHADOURIA
 
Speed detection-of-moving-vehicle-using-speed-cameras
byVIKAS SINGH BHADOURIA
 
Next generation graphics programming on xbox 360
byVIKAS SINGH BHADOURIA
 
Fingerprint based physical access control vehicle immobilizer
byVIKAS SINGH BHADOURIA
 
Intelligent agents
byVIKAS SINGH BHADOURIA
 
Interactive voice-response-system
byVIKAS SINGH BHADOURIA
 
Data compression
byVIKAS SINGH BHADOURIA
 
Brain computer-interface-ppt
byVIKAS SINGH BHADOURIA
 
Trees
byVIKAS SINGH BHADOURIA
 
Introduction to parallel computing
byVIKAS SINGH BHADOURIA
 
Bluetooth mobileip
byVIKAS SINGH BHADOURIA
 
Parallel computing persentation
byVIKAS SINGH BHADOURIA
 
Full report on light peak technology
byVIKAS SINGH BHADOURIA
 

Wireless Hacking

  • 1.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Wireless HackingWireless Hacking Edri GuyEdri Guy Mar 04 ,2013Mar 04 ,2013
  • 2.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux DISCLAIMERDISCLAIMER 1 – The following discussion is for informational and education1 – The following discussion is for informational and education purpose only.purpose only. 2 – Hacking into private network without the written permission2 – Hacking into private network without the written permission from the owner is Illegal and strictly forbidden.from the owner is Illegal and strictly forbidden. 3 – Misused could result in breaking the law so use it at your own3 – Misused could result in breaking the law so use it at your own risk.risk.
  • 3.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Overview ● We're going to learn how WiFi (802.11) works ● Start with terminology ● Types ● Vulnerabilities ● Attacking them ● Surprise demonstration of....:) Introduction WiFi Classes Vulnerabilities Attack
  • 4.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Terminology ● AP - Access Point ● MAC – Media Access Control a unique id assigned to wireless adapters and routers. It comes in hexadecimal format (ie 00:11:ef:22:a3:6a) Introduction WiFi Classes Vulnerabilities Attack
  • 5.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Terminology ● BSSID – Access Point's MAC Address ● ESSID - Access Point’s Broadcast name. (ie linksys, default, belkin etc) Some AP’s will not broadcast their name,But Airodump-ng can guess it. Introduction WiFi Classes Vulnerabilities Attack
  • 6.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Gear - Antennas ●  Dipole – Standar, Omni directional ●  Hyperbolic  – Mushroom Shaped signal ●  Yaggi  – Very directional (Japanese R&D) ●  Pringles – Improvised(Hacker Style) Yaggi ●  WindSurfer – Improvised hyperbolic Introduction WiFi Classes Vulnerabilities Attack
  • 7.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Gear - Antennas ●  WindSurfer – Improvised hyperbolic Introduction WiFi Classes Vulnerabilities Attack
  • 8.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Channels ● The physical frequency of the wireless transmissions ● Channels are between 1-14 (1-11 in the USA) ● 802.11 is the wireless communication standard by IEEE Introduction WiFi Classes Vulnerabilities Attack
  • 9.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Channels Introduction WiFi Classes Vulnerabilities Attack
  • 10.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Standards ● 802.11a – 5 GHZ rate : upto 54Mbps ● 802.11b – 2.4 GHZ rate : upto 11Mbps ● 802.11g – 2.4 GHZ rate : upto 54Mbps ● 802.11n – 2.4 GHZ rate : upto 300Mbps ● 802.11ac(draft) – 5 GHZ rate : upto 1.73Gps !!! Introduction WiFi Classes Vulnerabilities Attack
  • 11.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Transmission Power ● Transmit power, or txpower, regulated by country. ● txpower has a max of 0.5 Watts ● Coded into the Linux Kernel ● Easier than changing the kernel is to move to another country Introduction WiFi Classes Vulnerabilities Attack
  • 12.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux A little backdoor Move to Bolivia (Almost no restrictions there) iw reg get iw reg set BO iwconfig wlan0 txpower 30(only if your card support it) Introduction WiFi Classes Vulnerabilities Attack
  • 13.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux A little backdoor – more than 30dbm apt-get install libgcrypt11-dev python-m2crypto libnl1 libnl-dev cd ~ mkdir custom-rdb cd custom-rdb wget http://kernel.org/pub/software/network/wireless-regdb/wireless-regdb-2013.02.13.tar.bz2 cd ~ tar –xvjf wireless-regdb-2013.02.13.tar.bz2 cd wireless-regdb-2013.02.13 Now edit the file db.txt (2402 - 2494 @ 40), (N/A, 35) (4910 - 5835 @ 40), (N/A, 35) make && make install Introduction WiFi Classes Vulnerabilities Attack
  • 14.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux A little backdoor – more than 30dbm Backup and copy new key. cp /usr/lib/crda/regulatory.bin /usr/lib/crda/regulatory.bin.bak cp regulatory.bin /usr/lib/crda/ cd ~/custom-rdb wget http://wireless.kernel.org/download/crda/crda-1.1.3.tar.bz2 tar -xvjf crda-1.1.3.tar.bz2 cd crda-1.1.3 Copy the generated keys from regdb folder: cp ~/custom-rdb/wireless-regdb-2013.02.13/*.key.pub.pem pubkeys make && make install http://www.rapidtables.com/convert/power/dBm_to_Watt.htm#table Introduction WiFi Classes Vulnerabilities Attack
  • 15.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WiFi has 6 modes ● Master - Access Point or Base Station ● Managed - Infrastructure Mode (Client) ● Ad-Hoc – Device to Device ● Mesh (Mesh Cloud/Network) ● Repeater - Range Extender ● Monitor (RFMON) Introduction WiFi Classes Vulnerabilities Attack
  • 16.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Terminology ● Packet – an amount of data transferred in a network. ● Frame – a container which the packet is transfered within Introduction WiFi Classes Vulnerabilities Attack
  • 17.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Frame Structure ● Frames: Simply Data Packets Typically made up of: Header, Payload, Integrity Check (CRC) ● Frame Header: Source and Destination Ether Type (What Protocol) Introduction WiFi Classes Vulnerabilities Attack
  • 18.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Protocols ● ARP – Address Resolution Protocol ● MAC – Media Access Control ● IP – Internet Protocol Introduction WiFi Classes Vulnerabilities Attack
  • 19.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux ARP Packets Introduction WiFi Classes Vulnerabilities Attack
  • 20.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WiFi Frames ● Management Frames ● Control Frames ● Data Frames Introduction WiFi Classes Vulnerabilities Attack
  • 21.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Management Frames ● Beacons ● Probes ● Associations ● Authentications Introduction WiFi Classes Vulnerabilities Attack
  • 22.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Beacon Frames ● Advertise the network ● Specify SSID, Channels and other capabilities ● View those frames: gksudo wireshark & disown ● Wireshark filter: wlan.fc.subtype == 0x08 Introduction WiFi Classes Vulnerabilities Attack
  • 23.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Probe Frames ● Probe Request - Are you my friend? wlan.fc.type_subtype == 0x04 ● Probe Response - Includes capability info wlan.fc.type_subtype == 0x05 ●Demo: Viewing probes airmon­ng start wlan2 airodump­ng mon0 Introduction WiFi Classes Vulnerabilities Attack
  • 24.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Management Frames – Beacon Introduction WiFi Classes Vulnerabilities Attack
  • 25.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Management Frames – Probe Request Introduction WiFi Classes Vulnerabilities Attack
  • 26.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Management Frames – Probe Response Introduction WiFi Classes Vulnerabilities Attack
  • 27.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Association Frames ● Association ● Association Request - Can we be friends? ● Association Response ● Disassociation Introduction WiFi Classes Vulnerabilities Attack
  • 28.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Authentication Frames ● Authentication ● De-Authentication Introduction WiFi Classes Vulnerabilities Attack
  • 29.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Control Frames ● Request to Send ­ RTS:    ­ May I speak sir ? ● Clear to Send ­ CTS:    ­ Everything all right soldier ●  Acknowledgement – ACK:   ­ Got it sir Introduction WiFi Classes Vulnerabilities Attack
  • 30.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Attack Vectors ● Direct Attack Injectable? WEP WPA1/2 (excluding WPA2-Enterprise) ● DOS attacks (De-Auth) ● Rouge Access Point (Caffe-Latte/Hirte/KoRek) ● Karma ● Much much more (...) Introduction WiFi Classes Vulnerabilities Attack
  • 31.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP ● Wired Equivalent Privacy ● WEP uses 64,128 and 256bit(very rare) keys ● Everything but layer 2 ● Uses IV (Initialization Vector) ● Uses RC4 for encryption ● WEP uses CRC instead of MAC(Message Authentication Code) Introduction WiFi Classes Vulnerabilities Attack
  • 32.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP - Flaws ● RC4 is a stream cipher and same key should not be used twice! - The length of the IV is 24Bit ● WEP uses a 64/128 bit key which is concatenated with a 24­bit initialization vector (IV) to form the RC4 traffic key. - 64Bit key is made of 24bit IV + 48bit key (12 hex characters)    ­128Bit key is made of 24bit IV + 104bit key (26 hex characters)    Introduction WiFi Classes Vulnerabilities Attack
  • 33.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP - Flaws ●  The purpose of an IV, which is transmitted as plain text,Is to prevent    any repetition,  But a 24­bit IV is not long enough to ensure this on a busy network. ●  BUT... Introduction WiFi Classes Vulnerabilities Attack
  • 34.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP - Flaws Statistically for a 24-bit IV, there is a 50% probability the same IV will repeat after 5000 packets. Introduction WiFi Classes Vulnerabilities Attack
  • 35.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP – Schema Introduction WiFi Classes Vulnerabilities Attack
  • 36.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Introduction WiFi Classes Vulnerabilities Attack
  • 37.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Authentication methods - Open ●  Open system ­ Any client, regardless of its WEP keys,  can authenticate itself with the AP and then attempt to associate. ●  All you need is the right keys for authentication and association,   WEP can be used for encrypting the data frames. ●  Bottom line, no authentication occurs... Introduction WiFi Classes Vulnerabilities Attack
  • 38.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Authentication methods – Shared Key Four way handshake: AR – Authentication Request AP send back Clear-Text challenge Encrypted Challenge AP Decrypts and knows if the client knows the key or not Introduction WiFi Classes Vulnerabilities Attack
  • 39.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Shared Key - Vulnerability ●  Share key is less secure because it   allows the attacker to get IVs using   the challenge through response    mechanism! Introduction WiFi Classes Vulnerabilities Attack
  • 40.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Authentication – Challenge Text Introduction WiFi Classes Vulnerabilities Attack
  • 41.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP - Authentication Introduction WiFi Classes Vulnerabilities Attack
  • 42.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA - Stats ● WPA TKIP (Temporal Key Integrity Protocol) was built upon WEP. The idea was to close all the vulnerabilities and use the same hardware. Introduction WiFi Classes Vulnerabilities Attack
  • 43.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA - Stats ● WPA still using RC4(Like WEP) but the keys were changed to Temporal Key Intergrity Protocol(TKIP). ● All regular WLAN devices that worked with WEP are able to be simply upgraded and no new equipment needs to be bought. ● TKIP basically works by generating a sequence of WEP keys based on a master key,and re-keying periodically before enough volume of data. Introduction WiFi Classes Vulnerabilities Attack
  • 44.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA - Stats ● TKIP changes the Key every 10,000 packets,which is quick enough to combat statistical methods to analyze the cipher. ● TKIP also adds Message Integrity Code(MIC).The transmission’s CRC,ICV(Integrity Check Value) is checked. If the packet was tampered with. WPA will stop using the current keys and re­key Introduction WiFi Classes Vulnerabilities Attack
  • 45.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA - Weakness ● WPA is crackable,It just requires slightly more effort from the attacker. The process if as follows : 1 - Send a De-Auth to AP 2 - AP Re-Auth the Client 3 - Capture the Handshake 4 - Brute force on the Handshake ● In 2009 Beck-Tew attack was discovered,It allows to decrypt a packet without knowing the key(Base on ChopChop Attack) Introduction WiFi Classes Vulnerabilities Attack
  • 46.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA Your best solution is WPA2–AES !!! Introduction WiFi Classes Vulnerabilities Attack
  • 47.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA2 Replaced WEP and WPA1 at June 2004 Uses CCMP(strong AES base encryption) Solves many issues aroused with WEP/WPA1 Introduction WiFi Classes Vulnerabilities Attack
  • 48.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA2 ● WPA2 is still vulnerable to brute force attack. Weak password may cause insecure network. We still have to choose strong password in order to achieve good security. Introduction WiFi Classes Vulnerabilities Attack
  • 49.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA2 ● There is no known attack on the cipher ● However... Handshake is vulnerable to attack ● Once we got the 4-way handshake,We are good to go Introduction WiFi Classes Vulnerabilities Attack
  • 50.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Introduction WiFi Classes Vulnerabilities Attack
  • 51.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPA2 – Weakness ● It is possible to crack WPA2 with very high chances of success.But it depends on the length and complexity of the password. ● Elcomsoft developed an application that uses GPU power to attempt over 120,000 passwords per second. Depending on the key, it can take anywhere from seconds to the next big bang!!! Introduction WiFi Classes Vulnerabilities Attack
  • 52.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPS (Worst Protection System) WiFi Protected Setup ● PIN Method – Remotely while authenticating ● Push-Button-Method – As it sounds ● Near-Field-Communication - As it sounds ● USB – Shared Information on USB stick Introduction WiFi Classes Vulnerabilities Attack
  • 53.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPS ● The WPS code is built out of 8 digits. ● No authentication is needed to try pin codes ● The pin code is 8 digits ● The first 4 are immediately checked ● The last digit is a check sum Introduction WiFi Classes Vulnerabilities Attack
  • 54.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WPS Original combinations should be: 10^8 (100 million) After considering 4 digit check: 10^4+10^4 = 20,000 After checksum digit: 10^4+10^3 = 11,000 Assuming only 100 tries a minute (low) 11,000/100 = 110 minutes = almost 2 hours Introduction WiFi Classes Vulnerabilities Attack
  • 55.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux WEP Attacks ● It is possible to recover a 104Bit WEP key with probability 50% using only 40,000 captured packets. ● 60,000 captured packet rise the probability to 80%. ● 80,000 captured packets rise the probability to 95% ● The actual computation takes about 3 seconds and 3 MB of main memory on a Pentium­M 1.7 GHz ... Introduction WiFi Classes Vulnerabilities Attack
  • 56.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Attacking Methods  Passive – Silence Mode     sniffing the air for packets without      sending any data to the AP or clients.   Active ­        breaking the key while sending data to        the AP or client. Introduction WiFi Classes Vulnerabilities Attack
  • 57.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Attacking Methods   ARP Replay    Caffe­Latte   Hirte    ChopChop / KoRek    FMS Attack   PTW Attack Introduction WiFi Classes Vulnerabilities Attack
  • 58.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Demo time !!! ● ARP Replay Attack steps 1 - Start capturing first Pockets : airodump-ng --channel $CH --bssid $BSSID --write dump-to-crack mon0 2 - Starting ARP Reply Attack : aireplay-ng --arpreplay -b $ESSID -x 100 -h $ORIGINAL-MAC mon0 3 – Start De-Auth Attack(Until you get ARP packets) : aireplay-ng --deauth 1 -a $BSSID -h $CLIENT-MAC mon0 4 – Start cracking the CAP file. aircrack-ng dump-to-crack.cap Introduction WiFi Classes Vulnerabilities Attack
  • 59.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Demo time !!! ● Hirte Attack(Extends for Caffe-Latte) steps 1 – Find a probe you want to hack and start the Hirte Attack : airbase-ng -W 1 -c 6 -N --essid $ESSID-TO-HACK mon0 2 – Start saving the packets : airodump-ng --channel $CH --bssid $BSSID --write dump-to-crack mon0 3 – Start cracking the CAP file aircrack-ng dump-to-crack.cap Introduction WiFi Classes Vulnerabilities Attack
  • 60.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Attacks inside the network  MiTM ( Man In The Middle ) Attack  SSL MiTM Attack  Downgrade encryption 1 – HTTPS to HTTP 2 – POP3s/SMTPs to POP3/SMTP 3 – NTLMv2 to NTLMv1 Introduction WiFi Classes Vulnerabilities Attack
  • 61.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Man In The Middle Introduction WiFi Classes Vulnerabilities Attack Brad Jennifer
  • 62.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Man In The Middle Introduction WiFi Classes Vulnerabilities Attack Brad Jennifer
  • 63.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Cool Tools Aircrack-ng package including: Airmon-ng Airodump-ng Aireplay-ng Aircrack-ng Airebase-ng Airdeclock-ng Airdriver-ng And more :) Introduction WiFi Classes Vulnerabilities Attack
  • 64.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Cool Tools ● Wireshark ● Reaver ● Kismet ● WiGLE ● Gerix Introduction WiFi Classes Vulnerabilities Attack
  • 65.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Getting aircrack-ng Get Backtrack OR Get compact-wireless drivers And compile your aircrack-ng Introduction WiFi Classes Vulnerabilities Attack
  • 66.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Wireshark – Cheat Sheets Introduction WiFi Classes Vulnerabilities Attack ● Probe Request wlan.fc.type_subtype == 0x04 ● Probe Response wlan.fc.type_subtype == 0x05 ● Association Request wlan.fc.type_subtype == 0x00 ● Association Response wlan.fc.type_subtype == 0x01 ● Disassociate wlan.fc.type_subtype == 0x0a ● Authentication wlan.fc.type_subtype == 0x0b
  • 67.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Let's Practice WEP BSSID: ESSID: Haifux-01 WPA2 BSSID: ESSID: WeLoveMS Introduction WiFi Classes Vulnerabilities Attack
  • 68.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Contact info Cheat Sheet Introduction WiFi Classes Vulnerabilities Attack Password: l33t_hax0rs! Email – guy@pclabs.co.il Facebook – www.facebook.com/pclabs Twitter - @pc_labs , twitter.com/pc_labs LinkedIN - https://www.linkedin.com/pub/guy-edri/1/3a8/961 Hacking Define Experts course – www.see-security.com See Consulting – www.see-secure.com Video of this lecture - ● Part I ● Part II
  • 69.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux One more thing !!! Introduction WiFi Classes Vulnerabilities Attack
  • 70.
    Wireless Hacking –Haifux See-Security Mar 04 2013 – Wireless Hacking - Haifux Thanks Introduction WiFi Classes Vulnerabilities Attack