Wireless Networking & Security Greg Stabler

Wireless Networking & Security

• Greg Stabler

• Spencer Smith

Preview

• Brief History of Wireless networking
• Types of Wireless Security
• Unsecured
• WEP
• WPA
• WPA2
• Why use wireless encryption?
• Additional Security Measures for your router
• What to do if on an unsecured network

History of Wireless Networking

• Wireless Local Area Networks (WLAN) have been around since 1970.

•  

• The first model was created at the University of Hawaii by Norman Abramson.

•  

• This was a star topology and connected 7 computers across 4 islands.

•  

•  Today, wireless networking is largely standardized by IEEE and their various versions of 802.11.

Unsecured

• A wireless network with no sort of encryption algorithm applied.

•  

• Any user can readily authenticate and access the internet.

•  

•  Packets are unencrypted and visible.

•  

•  Attacks:
• ARP Spoofing - Associate attacker's MAC address with default gateway's IP. All traffic meant for gateway goes through attacker's machine first. Traffic can be passed through (passive sniff) or modified and passed (MIM). 
• Firesheep - Firefox extension that decodes cookies on unsecured network. Allows log in as user for sites like Facebook and Twitter.

WEP: Wired Equivalent Privacy

• Deprecated security algorithm for IEEE 802.11 networking.
• Introduced as part of original 802.11 protocol in 1997. 
• Standard 64 bit  WEP uses 40 bit key. Other 24 bits is IV.
• Can also use 128/256 bit protocols.
• IV (Initialization Vector) - prepended onto packets and is based on pre-shared key.
• Such short IVs in 64 bit caused reuse of IVs with same key, which significantly shortened key cracking times of WEP.
• Attacks:
• Aircrack-ng - Linux command line tool. Sniffs packets on a network to obtain IVs and breaks WEP key using information present in the IVs. Can be done in less than 10 minutes.

WPA: Wi-Fi Protected Access

• Released by Wi-Fi Alliance in 2004 in IEEE 802.11i standard
• Replaced the exploitable WEP Encryption scheme
• Required support of TKIP protocol 
• Also supported AES encryption
• Designed to be backward compatible with older hardware after firmware upgrades
• 4-Way Handshake and Group Key Handshake
• "Beck-Tews Attack" - TKIP Exploit:
• PhD Candidate in Germany discovered a method for injecting small packets into a network using WPA and TKIP
• Does not reveal full network key though, but can be used to spoof ARP and DNS packets

WPA2: Wi-Fi Protected Access v2

• Released by Wi-Fi Alliance as upgrade to WPA
• Backward compatible with WPA
• Required support of TKIP and AES protocols
• "Hole 196" Attack:
• Allows already authenticated user to spoof mac address of router using the Group Temporal Key (known to all clients)
• Client responds using their Pairwise Transient Key, which is unique to them, allowing attacker to decrypt the clients packets

Why does it matter?

• Unencrypted networks or exploitable encryption schemes allow hackers to:
• Steal login credentials

•  

• Hijack browser sessions by stealing session cookies

•  

• Spoof packets on your network

•  

• Use your network for malicious activity (ie Spam, DDOS)
• Authorities will charge you with the crimes because it's your network

Other Security Measures

• Enable MAC Address filtering
• Prevents unauthorized computers from gaining access even if they have the correct network key 

•  

• Enable router firewall

•  

• Change default Network SSID to something obscure
• Change default router password

•  

• Change encryption password frequently

What to do on Unsecured Wireless

• Setup VPN Tunnel to a secured machine

•  

• Setup an SSH Tunnel to a secured machine 

•  

• Force HTTPS on all possible connections

•  

• Do not transfer sensitive information

Wrap-Up

• WEP is no longer a secure wireless method

•  

• WPA2 with AES encryption is currently the best encryption scheme
• Enable any additional security measures supported by your router
• If on an unsecured network, use SSH or VPN tunneling to secure your data

References

• Fleishman, Glenn. "Battered, but not broken: understanding the WPA crack." 6 Nov 2008. .

•  

• "WPA2 Exploit Vulnerability Discovered." 25 Jul 2010.

•  

• Moran, Joseph ."WEP Security is No Security at All."

•  

• "History of Wireless." John Hopkins Bloomberg School of Public Health