Chapter 7:-WIRELESS SECURITY

 Wireless LANs

-two or more devices using some wireless distribution method (typically spread-spectrum or OFDM radio),
-usually providing a connection through an access point to the wider internet.
This gives users the mobility to move around within a local coverage area and still be connected to the network.
The IEEE 802.11 group of standards specify the technologies for wireless LANs. 802.11 standards use the Ethernet protocol and CSMA/CA (carrier sense multiple access with collision avoidance) for path sharing and include an encryption method, the Wired Equivalent Privacy algorithm.

Comparisson

WLAN components and topologies

Types of WLAN components:

• Wireless network cards
• Wireless access points
• Wireless bridges

802.11 Components
*Two pieces of equipment defined:
-Wireless station:-A desktop or laptop PC or PDA with a wireless NIC.
-Access point:-A bridge between wireless and wired networks
:-Composed of Radio,Wired network interface (usually 802.3),Bridging software
-Aggregates access for multiple wireless stations to wired network.


The 802.11 operation modes
*Infrastructure mode
In infrastructure mode, the wireless network consists of at least one access point (AP) connected to the wired network infrastructure and a set of wireless end stations. An access point controls encryption on the network and may bridge or route the wireless traffic to a wired ethernet network (or the Internet). Access points that act as routers can also assign an IP address to your PC's using DHCP services. AP's can be compared with a basestation used in cellular networks.


This configuration is called a Basic Service Set (BSS). An Extended Service Set (ESS) consists of two or more BSSs forming a single subnetwork. Traffic is forwarded from one BSS to another to facilitate movement of wireless stations between BSSs. Almost always the distribution system which connects this networks is an Ethernet LAN. Since most corporate WLANs require access to the wired LAN for services (file servers, printers, Internet links) they will operate in infrastructure mode. This also is the case in our exercise: Wireless LAN access points in auditoria.
*Ad-Hoc Mode
Ad-Hoc mode is a set of 802.11 wireless stations that communicate directly with each other without using an access point or any connection to a wired network. This basic topology is useful in order to quickly and easily set up a wireless network anywhere a wireless infrastructure does not exist such as a hotel room, a convention center, our airport. Ad-Hoc Mode is also called peer-to-peer mode or an Independent Basic Service Set (IBSS)

802.11 Physical Layer

Originally three alternative physical layers

*Two incompatible spread-spectrum radio in 2.4Ghz ISM band:-Frequency Hopping Spread Spectrum (FHSS)-75 channels
:-Direct Sequence Spread Spectrum (DSSS)-14 channels (11 channels in US)
*One diffuse infrared layer
*802.11 speed-1 Mbps or 2 Mbps.

802.11 Data Link Layer
#Layer 2 split into:
--Logical Link Control (LLC).
--Media Access Control (MAC).
#LLC - same 48-bit addresses as 802.3.
#MAC - CSMA/CD not possible.:-Can’t listen for collision while transmitting.
#CSMA/CA – Collision Avoidance.
-Sender waits for clear air, waits random time, then sends data.
-Receiver sends explicit ACK when data arrives intact.Also handles interference.But adds overhead.
#802.11 always slower than equivalent 802.3

802.11b

##11Mbps in 2.4GHz range
##compatible

Open system authentication
##Service Set Identifier (SSID)
##Station must specify SSID to connect to the Interception
##signal week by 3 factor:
1. Wall
2. floor
3. interference

802.11
3 basic security service:
1. Authentication
2. Integrity - data will be encrypt by using WEP & WPA technique.
3. Confidential
* Some say WPA is much more secure than WEP but its actually depends on what type of shared key that actually base on ots library. the it use a simple library so it would be easy to crack and hack the network


RC4

* Ron’s Code number 4
- Symmetric key encryption
- RSA Security Inc.
- Designed in 1987.
- Trade secret until leak in 1994.
* RC4 can use key sizes from 1 bit to 2048 bits.
* RC4 generates a stream of pseudo random bits
- XORed with plaintext to create ciphertext.


WEP – SENDING
* Compute Integrity Check Vector (ICV).
- Provides integrity
- 32 bit Cyclic Redundancy Check.
- Appended to message to create plaintext.
* Plaintext encrypted via RC4
- Provides confidentiality.
- Plaintext XORed with long key stream of pseudo random bits.
- Key stream is function of
##40-bit secret key
##24 bit initialisation vector
* Ciphertext is transmitted.


WEP – RECEIVING
* Ciphertext is received.
* Ciphertext decrypted via RC4
- Ciphertext XORed with long key stream of pseudo random bits.
- Key stream is function of
## 40-bit secret key
## 24 bit initialisation vector (IV)
* Check ICV
- Separate ICV from message.
- Compute ICV for message
- Compare with received ICV


SHARED KEY AUTHENTICATION
* When station requests association with Access Point
- AP sends random number to station
- Station encrypts random number > Uses RC4, 40 bit shared secret key & 24 bit IV
- Encrypted random number sent to AP
- AP decrypts received message > Uses RC4, 40 bit shared secret key & 24 bit IV
- AP compares decrypted random number to transmitted random number
*If numbers match, station has shared secret key.


WEP SAFEGUARDS
* Shared secret key required for:
- Associating with an access point.
- Sending data.
- Receiving data.
* Messages are encrypted - Confidentiality.
* Messages have checksum - Integrity.
* But management traffic still broadcast in clear containing SSID.


PASSIVE WEP ATTACK
* If 24 bit IV is an ascending counter,
* If Access Point transmits at 11 Mbps,
* All IVs are exhausted in roughly 5 hours.
* Passive attack:
- Attacker collects all traffic
- Attacker could collect two messages:
## Encrypted with same key and same IV
##Statistical attacks to reveal plaintext
##Plaintext XOR Ciphertext = Keystream


ACTIVE WEP ATTACK
* If attacker knows plaintext and ciphertext pair
- Keystream is known.
- Attacker can create correctly encrypted messages.
- Access Point is deceived into accepting messages.
* Bitflipping
- Flip a bit in ciphertext
- Bit difference in CRC-32 can be computed


LIMITED WEP KEYS
* Some vendors allow limited WEP keys
- User types in a passphrase
- WEP key is generated from passphrase
- Passphrases creates only 21 bits of entropy in 40 bit key.
##Reduces key strength to 21 bits = 2,097,152
##Remaining 19 bits are predictable.
##21 bit key can be brute forced in minutes.

WEP Standard for Securing Wireless Networks

ACCESS POINT AUDITS
* Review security of access points.
* Are passwords and community strings secured?
* Use Firewalls & router ACLs
- Limit use of access point administration interfaces.
* Standard access point config:
- SSID
- WEP keys
- Community string & password policy


STATION PROTECTION
* Personal firewalls - Protect the station from attackers.
* VPN from station into Intranet
- End-to-end encryption into the trusted network.
- But consider roaming issues.
* Host intrusion detection - Provide early warning of intrusions onto a station.
* Configuration scanning - Check that stations are securely configured.


LOCATION OF ACCESS POINTS
* Ideally locate access points - In centre of buildings.
* Try to avoid access points
- By windows
- On external walls
- Line of sight to outside