Ethical Hacking
Module XV
Hacking Wireless Networks
Module Objective
Introduction to 802.11
What is WEP?
Finding WLANs
Cracking WEP Keys
Sniffing Traffic
Wireless DoS attacks
WLAN Scanners
WLAN Sniffers
Securing Wireless Networks
Hacking Tools
Introduction to Wireless Networking
Wireless networking technology is becoming increasingly popular but at the same time has introduced many security issues
The popularity in wireless technology is driven by two primary factors – convenience and cost.
A Wireless local area network (WLAN) allows workers to access digital resources without being locked into their desks.
Laptops could be carried into meetings or even into Starbucks café tapping into the wireless network. This convenience has become affordable.
What is 802.11x ?
Wireless LAN standards are defined by the IEEE’s 802.11 working group. WLANs come in three flavors:
802.11b
Operates in the 2.4000GHz to 2.2835GHz frtequency range and can operate at up to 11 megabits per second.
802.11a
Operates in the 5.15-5.35GHz to 5.725-5.825GHz frequency range and can operate at up to 54 megabits per second.
802.11g
Operates in the 2.4GHz frequency range (increased bandwidth range) and can operate at up to 54 megabits per second.

Note: WEP standards are defined in the 802.11 standard and not the individual standards. WEP vulnerabilities have the potential to affect all flavors of 802.11 networks.
Setting Up WLAN
When setting up a WLAN, the channel and service set identifier (SSID) must be configured in addition to traditional network settings such as IP address and a subnet mask.
The channel is a number between 1and 11 (1 and 13in Europe) and designates the frequency on which the network will operate.
The SSID is an alphanumeric string that differentiates networks operating on the same channel.
It is essentially a configurable name that identifies an individual network. These settings are important factors when identifying WLANs and sniffing traffic.
SSIDs
The SSID is a unique identifier that wireless networking devices use to establish and maintain wireless connectivity
SSID acts as a single shared password between access points and clients.
Security concerns arise when the default values are not changed, as these units can be easily compromised.
A non-secure access mode, allows clients to connect to the access point using the configured SSID, a blank SSID, or an SSID configured as “any.”
What is WEP?
WEP is a component of the IEEE 802.11 WLAN standards. Its primary purpose is to provide for confidentiality of data on wireless networks at a level equivalent to that of wired LANs.
Wired LANs typically employ physical controls to prevent unauthorized users from connecting to the network and viewing data. In a wireless LAN, the network can be accessed without physically connecting to the LAN.
IEEE chose to employ encryption at the data link layer to prevent unauthorized eavesdropping on a network. This is accomplished by encrypting data with the RC4 encryption algorithm.
MAC Sniffing & AP Spoofing
MAC addresses are easily sniffed by an attacker since they must appear in the clear even in when WEP is enabled.
An attacker can use those “advantages” in order to masquerade as a valid MAC address by programming the wireless card, and get into the wireless network and use the wireless pipes.
Spoofing MAC address is very easy. Using packet-capturing software, an attacker can determine a valid MAC address using one packet.
To perform a spoofing attack, an attacker must set up an access point (rogue) near the target wireless network or in a place where a victim may believe that wireless Internet is available.

Denial of Service attacks
Wireless LANs are susceptible to the same protocol-based attacks that plague wired LAN
WLANs send information via radio waves on public frequencies, thus they are susceptible to in advertent or deliberate interference from traffic using the same radio band.
Hacking Tool: NetStumbler
http://www.netstumbler.org
Netstumbler is a high level WLAN scanner. It operates by sending a steady stream of broadcast packets on all possible channels.
Access Points (AP) respond to broadcast packets to verify their existence, even if beacons have been disabled.
NetStumbler displays:
Signal Strength
MAC Address
SSID
Channel details

Hacking Tool: AiroPeek
http://www.wildpackets.com
Airopeek is a comprehensive packet analyzer for IEEE 802.11 wireless LANs, supporting all higher level network protocols such as TCP/IP, Apple Talk, NetBUI and IPX.
In addition, AiroPeek quickly isolates security problems, fully decodes 802.11a and 802.11b WLAN protocols, and analyzes wireless network performance with accurate identification of signal strength, channel and data rates.
Hacking Tool: Airsnort
http://airsnort.shmoo.com/
AirSnort is a wireless LAN (WLAN) tool which recovers encryption keys. AirSnort operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered.
AirSnort requires approximately 5-10 million encrypted packets to be gathered.
Once enough packets have been gathered, AirSnort can guess the encryption password in under a second.
Hacking Tool: Kismet
Kismet is a 802.11b wireless network sniffer which separates and identifies different wireless networks in the area.
Kismet works with any wireless card which is capable of reporting raw packets.
WEPCrack
WEPCrack is an open source tool for breaking 802.11 WEP secret keys.
While Airsnort has captured the media attention, WEPCrack was the first publically available code that demonstrated the above attack.
The current tools are Perl based and are composed of the following scripts:
WeakIVGen.pl, prism-getIV.pl, WEPCrack.pl
Other Tools
Network discovery tools run on 802.11 stations and passively monitor beacon and probe response frames. They typically display discovered devices by SSID, channel, MAC address and location.
Vulnerability assessment tools, in addition to network discovery, sniff traffic to spot security policy violations.
Traffic monitoring and analysis tools also provide discovery and vulnerability alerting. In addition, they capture and examine packet content.
IDSes may use signature analysis, protocol inspection, rules enforcement and/or anomaly detection.
WIDZ, Wireless Intrusion Detection System
WIDZ version 1 is a proof of concept IDS system for 802.11 that guards APs and monitors local for potentially malevolent activity.
It detects scans, association floods, and bogus/Rogue APs. It can easily be integrated with SNORT or RealSecure.
Securing Wireless Networks
MAC Address Filtering
This method uses a list of MAC addresses of client wireless network interface cards that are allowed to associate with the access point.
SSID (NetworkID)
The first attempt to secure wireless network was the use of Network ID (SSID). When a wireless client wants to associate with an access point, the SSID is transmitted during the process. The SSID is a seven digit alphanumeric id that is hard coded into the access point and the client device.
Firewalls
Using a firewall to secure a wireless network is probably the only security feature that will prevent unauthorized access.
Out of the box security
Radius: used as additional layer in the security
Maximum Security: Add VPN to Wireless LAN
Summary
A wireless enables a mobile user to connect to a local area network (LAN) through a wireless (radio) connection.
Wired Equivalent Privacy (WEP), a security protocol, specified in the IEEE Wi-Fi standard, 802.11b, that is designed to provide a wireless local area network (WLAN) with a level of security and privacy comparable to what is usually expected of a wired LAN.
WEP is vulnerable because of relatively short IVs and keys that remain static.
Even if WEP is enabled, MAC addresses can be easily sniffed by an attacker as they appear in the clear format. Spoofing MAC address is also easy.
If an attacker holds wireless equipment nearby a wireless network, he will be able to perform a spoofing attack by setting up an access point (rogue) near the target wireless network.
Wireless networks are extremely vulnerable to DoS attacks.
A variety of hacking and monitoring tools are available for the Wireless networks as well.
Securing wireless networks include adopting a suitable strategy as MAC address filtering, Fire walling or a combination of protocol based measures.