How to Hack a Wireless Network
John Hamilton

Lenski Volunteers

Overview

Wireless standards

Wireless security

Why worry about security? (Demo)

Ways to secure your network

Wireless Standards

802.11b

Available late 1999

AP Cost: $50-$130

Card cost: $50-$90

Frequency: 2.4 Ghz

Data rate: 11 Mbps

Not compatible

Range 150 ft.

802.11a

Available late 2001

AP Cost: $200-$350

Card cost: $100

Frequency: 5 Ghz

Data rate: 54 Mbps

Not compatible

Range 75 ft.

802.11g

Available mid 2003

AP Cost: $80-$150

Card cost: $80-$130

Frequency: 2.4 Ghz

Data rate: 54 Mbps

Compatible with b

Range 75 ft.

Wireless Security

MAC (Media Access Control ) filtering

Each network device has a unique address

Example: 00:C0:26:74:DD:85

Available in 802.11 b/a/g

WEP (Wired Equivalent Privacy)

Offers some protection through encryption but can be hacked

Available in 802.11 b/a/g

WPA (Wi-Fi Protected Access)

Much improved over WEP

Available only in 802.11g

Why Worry About Security?

To protect confidential material and resources

Remote connection to your network

Use of high gain antennas

Pringles can, soup can, commercial, etc.

Network sniffing

ethereal, tcpdump

MAC filtering

Cracked with a wireless sniffer

kismet, netstumbler

WEP cracking

Wireless cracker

airsnort

Cracking Demo

Cracking WEP

From the Airsnort FAQ:

To crack a WEP password, AirSnort needs a certain number of packets with weak keys. Out of the sixteen million keys which can be generated by WEP cards, about nine thousand are weak (for 128 bit encryption.) Call these packets with weak keys "interesting." Most passwords can be guessed with about two thousand interesting packets. Some as few as 1200-1500, others as many as 3500-4000.

To get an idea, assume that your business (it's not very big yet) has four employees, all using the same password. These employees surf the net pretty continuously throughout the day (they're not very good employees.) These employees will generate about a million packets a day. These employees will generate approximately a hundred and twenty interesting packets every day, so after sixteen days, the network will almost certainly be cracked.

However, this network is nowhere near being saturated. As networks approach saturation, the capture time approaches a single day. In some situations, different physical networks may use the same passwords. If this could be determined, this would usually linearly diminish the cracking time also.

Securing Your Network

Location of access points

Turn off SSID broadcasting

Use MAC address filtering

Use WEP or WPA

Separate wireless network with static IP addresses

Use a filtering router (firewall)

Only turn on access during normal hours

Location

SSID (Service Set Identifer)

Turn off broadcast of SSID

Change from default setting

Change default password

MAC Address Filtering

Put address for each computer in MAC table

Only allow access to computers in table

WEP / WPA

Use longest WEP key available (40, 64, 128)

Use WPA if available instead of WEP

Separate Network

Access point

Router

Access point

Access point

Secure network

DHCP

Turn off DHCP

Use static IP addresses

Filtering Router

Only allow access to legitimate ports (i.e. 80)

Schedule Access

Allow access only during normal use hours

Links

Pringles antenna - http://www.oreillynet.com/cs/weblog/view/wlg/448

Modifying the DWL-650 to connect to an antenna - http://c0rtex.com/~will/antenna/

Kismet - http://www.kismetwireless.net/

Airsnort - http://airsnort.shmoo.com/

Bering Firewall Distribution (Shorewall) - http://leaf.sourceforge.net

2004-06-10T18:13:50