Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address...
Transcript of Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address...
![Page 1: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/1.jpg)
The basics to 802.11
Wireless 101
![Page 2: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/2.jpg)
Agenda
●Basic Wireless Definitions●Wireless Attacker Kit●Demonstration●Defense Strategy Against Attacks●Questions
![Page 3: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/3.jpg)
●SSID–BSSID–MAC Address
●Encryption / Authentication
–WEP–WPA–802.11i–802.1x
●Fade / Freznel Zone
●Channel
●Frequency
Requires Wireless Definitions
![Page 4: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/4.jpg)
SSID BSSID
●“Service Set Identifier”
●Your “Wireless Network Name”
●Human Readable●Can be disabled,
but still discoverable
●“Basic Service Set Identification”
●AP Identification by MAC Address
●(ESSID Share the same SSID & BSSID)
![Page 5: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/5.jpg)
MAC Address“Data Link” Layer
●Media Access Control
–Each device has one that is “unique”
–ExampleDE:AD:BE:EF:00:00
–Multiple MAC’s for WiFi
●BSSID●Destination●Source
![Page 6: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/6.jpg)
Encryption
●WEP–Though worthless for encryption, still useful as
identifying a “private” network●WPA
–PSK (typically version 1)● Broken using Rainbow tables (takes about ~10
minutes)● Can be made secure!
–Enterprise (typically version 2)● Uses dynamic key exchanges● Much stronger encryption (AES)
![Page 7: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/7.jpg)
Fade / Fresnel Zone
●Fade–The area where the
signal strength begins to degrade the link’s performance
●Fresnel Zone–the area around the
visual line-of-sight that radio waves spread out into after they leave the antenna.
![Page 8: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/8.jpg)
Channel
The frequency band allocated to a transmission
![Page 9: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/9.jpg)
Wardriving
![Page 10: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/10.jpg)
Warwalking
![Page 11: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/11.jpg)
Warflying
![Page 12: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/12.jpg)
At the least…●Computer●GPS●Two 802.11 NICs●Antenna
(Folding stock not included)
http://www.tomsnetworking.com/Sections-article106-page9.php
Wireless Attacker Kit - Hardware
![Page 13: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/13.jpg)
Antennas
Floppy DiskPaper Clips
Coffee Can
Pringles Can
Discone
![Page 14: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/14.jpg)
Wireless Attacker Kit - Software
Kismet † Backtrack† FakeAP †
NetStumbler‡ Pentoo† AiroPeek ‡
Wellenreiter † ‡ AirTraf† WarLinux†
†For Unix/Linux Platforms‡For Windows Platforms
![Page 15: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/15.jpg)
Kismet
![Page 16: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/16.jpg)
NetStumbler
![Page 17: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/17.jpg)
Wellenreiter
![Page 18: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/18.jpg)
Pentoo
![Page 19: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/19.jpg)
●Some cases, still a very young technology●Can be evaded●Watches a small world
–802.11a (5.2 GHz and 5.8 GHz)–802.11b/g (2.4 GHz, but different spectrum
management)–802.11j / Public Safety (4.7 - 4.9 GHz)–Bluetooth!!! (yes, they have AP’s too)
Wireless IDS
![Page 20: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/20.jpg)
●Wigle.net
●Google.com
●Local message boards
●Use your IMAGINATION
Reconnaissance
![Page 21: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/21.jpg)
●Use the right antenna for the right job●Use the right amount of power●Pay attention to your surroundings
–Public roads, parks, etc●Policies
–Warning banners, private network messages, etc
Deployment
![Page 22: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/22.jpg)
●Few solutions out there–Solutions are generally not “court certified” (yet)
●Building is an option–Must use FCC Certified components and be in
operating compliance●Procedure and expertise
–Wifi is “Layer 1” and up–Radio and Network Engineer
●Physical environment presents their own challenges
Wireless Forensics Challenges
![Page 23: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/23.jpg)
Wireless Forensics - Antennas
http://www.l-com.com
Omni
Yagi
Grid / Dish
Panel
![Page 24: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/24.jpg)
●A very fast computer with lots of disk space●Two GPSs (one for backup)●Multiple 802.11 NICs
–Fourteen for 802.11 b/g–Eighteen for 802.11 a
●Antennas●Kismet (Don't be Evil / 9th Circuit)●Camera
Wireless Forensics Kit
![Page 25: Wireless 101sdr.ninja/wp-content/uploads/2014/08/BSides-Vegas... · SSID –BSSID –MAC Address Encryption / Authentication –WEP –WPA –802.11i –802.1x Fade / Freznel Zone](https://reader034.fdocuments.us/reader034/viewer/2022050421/5f906e78b7912c0619065ce0/html5/thumbnails/25.jpg)
Questions