Step 1:
Introduction
I have been working with 802.11 wireless technologies for a couple years now and although things are starting to improve, I still do not see many step by step or “How to” guides that give detailed instruction on performing 802.11 wireless attacks (Aircrack-ng.org aside).The focus of this paper is to provide a step by step walkthrough of popular wireless attacks ... There are some areas where I just point you in the right direction, usually towards the right tool, but ideally, these areas will be further described and covered in the next release of the paper. By understanding the mindset and methodologies an attacker uses, we can better defend against those attacks. Although I’ll provide a brief background into 802.11, this paper should not serve as a comprehensive guide to the 802.11 standard, but instead should provide you with adequate information to understand 802.11 attacks. I’ll continue to update this paper as I further experiment with new attacks, so please stay tuned for updates.
Background
IEEE 802.11 refers to the set of standards set forth by the Institute of Electrical and Electronics Engineers (IEEE). More specifically, working group 11 of the 802 category for LAN/MAN technologies has been reserved for defining the standards of wireless local area networks (WLAN) operating in the 2.4GHz and 5GHz ISM bands. To ease the overwhelming increase of technical jargon, the term “Wi-Fi” has been adopted to refer to the IEEE 802.11 standard by the general public. It should be noted that the Wi-Fi alliance had first coined the term to define a slightly different set of standards, however it is still commonplace to use the terms [IEEE] 802.11 and Wi-Fi interchangeably.
Since its initial release in 1997, 802.11 has undergone a variety of changes to not only improve speed and quality, but also to increase security. Each amendment to the original IEEE 802.11 standard further exemplifies this. Amendments A, B, G, N, and I are most recognizable as they’ve made notable changes to the original standard. IEEE 802.11 a/b/g/n generally define the implementation’s frequency spectrum and modulation. For instance, 802.11a operates in the 5GHz spectrum, using OFDM to obtain 54Mbit/s data rate, whereas 802.11b operates in the 2.4GHz spectrum using DSSS to obtain 11Mbit/s data rate. 802.11g expands on 802.11b to leverage OFDM within the 2.4GHz spectrum to match the 54Mbit/s data rate of 802.11a. In addition to other enhancements, 802.11n further increases bandwidth to 74 Mbits/s by using multiple-input multiple-output (MIMO) technology.
IEEE 802.11i (WPA/WPA2) is notable as it defines increased security and encryption standards meant to address the inadequacies of WEP which was the initial security mechanism used in the 802.11 standard.
Security and 802.11
Due to the borderless nature of 802.11, security is an obvious concern. Wired Equivalent Privacy (WEP) became the first attempt at security. However, a number of serious weaknesses within the RC4 cryptographic implementation employed by WEP were quickly identified, and in 2001, these issues resulted in the immediate requirement for increased wireless security. IEEE 802.11i was finally ratified in 2004 and is the primary means of wireless security. Unfortunately, due to the early adoption of wireless technologies, WEP is still in use by many companies and consumers alike. During the time before and in the early stages of 802.11i, wireless technology vendors attempted to address the issues with WEP by releasing additional mechanisms to mitigate the risk of WEP implementations. However, in the past year, the time it takes to crack WEP has been drastically reduced; meaning that no implementation of WEP should be considered secure.
WPA/WPA2
IEEE 802.11i introduces two areas of authentication to the 802.11 suite: WPA Enterprise and WPA Pre-shared key.
WPA Enterprise leverages IEEE 802.1x (not part of the IEEE 802.11 suite) which relies on the extensible authentication protocol (EAP) to relay authentication messages from a wireless client (supplicant) through the access point (authenticator) to a RADIUS server (authentication server). EAP in itself is an extremely simple messaging protocol. However, when it is combined with more sophisticated and proven authentication mechanisms, such as TLS, it becomes a reliable means of authentication.
WPA Pre-shared key (WPA-PSK) relies on a similar concept to WEP with the idea that a previously negotiated string is required in order to join the network. This string can be anywhere between 8 and 63 characters.
Encryption
WPA was originally released using an encryption mechanism based on RC4 called temporal key integrity protocol (TKIP) which was meant to be a temporary solution until the official 802.11i standard was released. Although TKIP was built with several improvements to the RC4 implementation that is employed in WEP, and there are currently no known attacks against TKIP specifically, it is considered inherently insecure because of its roots in RC4. To offer greater security, CCMP, an AES based encryption protocol was released in the final IEEE 802.11i standard (referred to as WPA2). CCMP is currently the only cryptographically sound protocol for 802.11 networks which is recognized by the National Institute of Standards and Technologies (NIST) and holds a FIPS140-2 certification.
The lack of a physical boundary as previously relied on with standard Ethernet networks is the major appeal of wireless networks to attackers. In the past, a certain level of implied security existed due to the assumption that an intruder would require some means of physical, hard-wired connectivity in order to access the internal network. With wireless networks, this is obviously not the case. Using easily obtainable but specialized equipment, an intruder can launch an attack on a wireless network from upwards of a mile away, given the right conditions.
Most often, attacks on wireless networks require the misuse of basic session management mechanisms built into the 802.11 standard. According to the 802.11 standard, clients must perform certain actions based on what the access point instructs them to do. Instructions from the access point are communicated to clients via management frames. Unfortunately, management frames are sent unencrypted through the air and there is no mechanism to ensure the identity of the access point other than its Media Access Control (MAC) address. This means that an attacker can simply inject into the air a malformed frame using the MAC address of the access point and instruct the client to disconnect from the wireless network.
Equipment:
Cytat:
Choosing the right equipment is a crucial step. In the case of poor reconnaissance (or scoping :)), you may find yourself in an unexpected situation. By planning ahead, you will end up saving yourself a great deal of time and heartache. Misio
Hardware
Maintaining diverse and flexible hardware should be the primary focus when choosing the items within a wireless toolkit. Over time, adapters may fail and yield less than accurate results or you may need to perform a certain unexpected task which may require specialized hardware. Whatever the case may be, I cannot stress enough the importance of staying diverse in the hardware that you choose.
Client Adapters - Over the past years, a number of different wireless client adapter chipsets have been deemed, “the hacker’s choice”. From the coveted Prism2, to the now popular Atheros chipset, the tides have changed a number of different ways. The most popular chipset in today’s 802.11 scene is the Atheros chipset which has shown excellent Linux driver and injection support, mainly due to diligent work by the madwifi development team.
In addition to chipset, another concern is band. Although the majority of 802.11 wireless networks only operate at 2.4GHz, there are still a large number of deployments operating at 5GHz. When choosing your client adapter, be mindful of which bands it supports as this may be a deciding factor in the success of an attack.
Software
Operating system support, drivers, and attack tools were all once a major concern when developing a toolkit. This concern has since faded due to the availability of Live Distributions. Remote Exploit’s BackTrack is a live Linux distribution created specifically with security researchers in mind. It contains just about every tool, driver, and kernel patch that you could think of. BackTrack can be run from a CD or USB stick on virtually any system.
The common method of booting BackTrack is via USB stick. The distribution itself can be obtained from
www.remote-exploit.org while the procedures for configuring BackTrack (in Windows) to boot from a USB stick are as
follows:
http://img231.imageshack.us/img231/8939/obrazmisio2.jpg
http://img80.imageshack.us/img80/4823/nowyobraz19.jpg
With your BackTrack USB stick inserted, start your computer. BackTrack should automatically load all of the necessary drivers for your system and provide you with a full Linux distribution with all of the tools you need preloaded.
cdn....:twisted:
Copyright © 2006-2024 - HACK.pl. Wszelkie prawa zastrzeżone.