Wireless networks can be more vulnerable to attacks than wired networks because of their open structure, as potential attackers may compromise the network without actually getting access into the enterprise premises. Some of the most common Wi-Fi threats are:
- War driving and war chalking
- WEP and WPA cracking
- Rogue access points
- Wireless evil twins
War Driving and War Chalking
War driving is the process of finding available wireless access points within a certain geographical area by driving around and listening for signals. This combines Wi-Fi monitoring and GPS positioning, as every access point location is logged. The logs may contain the following information:
- Access point name
- Location
- GPS coordinates
- Type of encryption
- Signal strength
Using this method gains a lot of information in a short period of time, information that can be centralized in dedicated free software tools such as:
- Kismet
- InSSIDer
Once the attacker has the GPS coordinates of the access points, he can centralize these into various applications that provide a graphical view of the area, thus visualizing everything on a map. War driving involves using automated tools that scan and log wireless access point locations. Because no human interaction is usually required, war driving has evolved into the following variations:
- War biking: scanning while riding a bike
- War flying: flying a remote-controlled airplane equipped with the necessary scanning device
War chalking is a legacy technique of physically marking an access point location by drawing different symbols on the sidewalk and walls in that specific area. A series of codes were developed to describe the Wi-Fi network’s characteristics. Some of these codes are depicted in Figure 30.4 below:
Figure 30.4 – War Chalking Symbols
WEP and WPA Cracking
Even though wireless networks are very popular, one of the biggest challenges is protecting the data that flows through the air and that is often publically accessible. Possible attackers might capture data that flows through a wireless network so they can analyze it and try to decrypt the information.
With WEP encryption, the decryption of the data can be achieved using initialization vectors (IVs). IVs are small portions of data that are associated with the packets and that help create a key that can change all the time. A static key along an IV value may generate a unique key as long as the IV values change every time data is sent. Initialization vectors are passed along in clear text with the encrypted data, so if an attacker manages to capture a significant amount of data he can reverse the encryption process. The IV is sent in clear text because the authorized receiving station must use it to decrypt the data, as it is the only part of the packet that is not known.
One of the issues with WEP is that the key size is small. It was originally limited to 64 bits and then increased to 128 bits. The 64 bits included a 40-bit key and a 24-bit initialization vector. Another major issue with WEP is that it offers no key management, so everybody uses the same key to encrypt and decrypt data. Yet another issue is the small size of the initialization vectors (24 bits), which may have to be reused so this cannot be considered true randomization. Some of the IV values may provide weaker encryption than others, so some manufacturers do not use all the available IV values.
A technique often used by attackers is injecting frames to intentionally duplicate IV values, which makes the decryption process easier.
WPA is a more advanced encryption protocol and is preferred over WEP. The major advantage of WPA is that it offers an enhanced cryptographic algorithm that constantly changes keys during a session’s lifetime. Modern networks often use WPA2, which comes in two forms:
- WPA2-Personal:used in private networks, based on pre-shared keys (static key)
- WPA2-Enterprise: used in enterprise networks, based on 802.1X (keys are constantly changing)
However, WPA also has weak points that allow attackers to decrypt the data and expose the network. WPA2-Personal is vulnerable to a series of attacks, including:
- Brute-force: attacker tries every character combination to guess the passkey
- Dictionary attacks: attacker tries every word in a common dictionary to guess the passkey
The recommendation when using WPA with pre-shared keys is to make the key as long and as complex as possible, using a lot of non-intuitive character combinations.
Rogue Access Points
Rogue access points can be a major concern, especially in large environments, and they represent third-party access points usually installed by users in a network. This creates vulnerability as everyone in range of the rogue access points can have access to the network.
To mitigate such problems, network administrators should schedule periodic surveys of the infrastructure by walking around the campus and trying to detect signals from third-party APs. You might also consider using 802.1X to force the users to authenticate against an authentication server, regardless of the connection type.
Rogue access points might even be created by enabling the Wi-Fi sharing functionality on a user’s smartphone or PDA.
Wireless Evil Twins
Wireless evil twins describes a concept of configuring an external access point to look and behave just like a trusted access point (same SSID and same security settings) so that users connect to the “evil” AP by mistake. Usually, the evil AP will have a boost of signal in order to increase the chances of users connecting to it instead of to the trusted AP, even though it may be located in another location, thus overpowering the trusted AP.
To prevent issues arising from evil twin attacks, you should implement an additional layer of encryption inside the wireless network using HTTPS or communicate through a VPN tunnel so that the encrypted data is safe, even if you connect to a non-trusted AP.