M16 Hacking Wireless Networks
Ad-Hoc Connection Attack
- Ad-Hoc Mode (like airdrop) o Allows clients to communicate with each other directly WITHOUT an AP o Allows data to be conveniently shared o Does NOT provide strong authentication or encryption - Attacker connects to client operating in Ad-Hoc Mode
Frequency-hopping spread spectrum (FHSS)
- AKA Frequency-hopping code-division multiple access (FH-CDMA) - Transmitting radio signals by rapidly switching a carrier among many frequency channels - It decreases the efficiency of unauthorized interception or jamming of telecommunications - A transmitter hops between available frequencies using a specified algorithm in a pseudorandom sequence known to both the sender and receiver
(4) Launch of Wireless Attacks
Aircrack-ng Suite
WPA3 Cracking Techniques
Downgrade Security Attacks - Downgrade the AP to WPA2 - 2 Ways to Downgrade o Exploiting Backward Compatibility o Exploiting the Dragonfly handshake Side-Channel Attacks § Timing-based attack § Cache-based attack
802.11d
Enhancement to a and b Enables global portability = allows variations in frequencies, power levels and bandwidth
Brute forcing of WPA keys
- Perform a brute-force attack on WPA encryption keys using a dictionary or using tools such as aircrack, aireplay, or KisMAC - May take hours, days, or even weeks
iCopy-X
- Portable RFID cloning device - Entirely stand-alone device with an integrated screen and buttons = does NOT need external computer
Reflector Antennas
- Reflect radio signals and has a high manufacturing cost - Concentrates EM energy that is radiated or received at a focal point - Generally parabolic
Jamming Signal Attack
- Send overwhelming volumes of malicious traffic = DoS - Use hardware to perform attack o Generates signals that appear to be noise to the devices on network o Causes them to hold their transmissions until the signal has subsided
Honeypot/Honeypot AP Attack
- Setting up an unauthorized wireless network using a rogue AP + impersonate - Has high-power (high-gain) antennas - Uses the same SSID as the target network - They transmit a stronger beacon signal than legitimate APs
Authentication Attacks
- Steal the identity of Wi-Fi clients, their personal information, login credentials, etc. - To gain unauthorized access to network resources
Parabolic Grid Antenna
- Uses the same principle as a satellite dish but NO solid dish - Consists of a semi-dish in the form of a grid consisting of aluminum wires - Can achieve very-long-distance Wi-Fi transmissions through highly focused radio beams - Useful for transmitting weak radio signals over very long distances (10 miles) - Can receive Wi-Fi signals that are either horizontally or vertically polarized
Sniffing Tools
- Wireshark with Npcap - SteelCentral Packet Analyzer - OmniPeek Network Protocol Analyzer - CommView for Wi-Fi - Kismet
De-authentication Attack
- attacker floods station(s) with forged de-authenticates or disassociates to disconnect users from an AP
Global System for Mobile Communications (GSM)
- universal system used for mobile data transmission in wireless networks worldwide
802.11a
3.7 GHz and 5 GHz OFDM 6, 9, 12, 18, 24, 36, 48, 54 Mbps speeds 35-100 and 5000 M
WPA2
802.1X/EAP/PSK AES = Encryption algorithm CCMP = Encryption method 128, 192, 256 bits = Key size CBC-MAC = Data integrity 48 bits = IV length
WPA3
802.1X/EAP/PSK AES = Encryption algorithm CCMP = Encryption method 128/192 bits = Key size (personal/enterprise) BIP-GMAC-256 = Data integrity 48 bits = IV length
WPA
802.1X/EAP/PSK RC4 = Encryption algorithm TKIP = Encryption method 128 bits = Key size MIC and CRC-32 = Data integrity 48 bits = IV length
WarDriving
o Attackers drive around with Wi-Fi-enabled laptops installed with a wireless discovery tool to map out open wireless networks. § Send probe requests or listens for beacons - Drive the car at speeds of 35 mph or below (at higher speeds, the Wi-Fi antenna will not be able to detect Wi-Fi networks).
WarFlying
o Attackers use drones to detect open wireless networks.
Wormhole Attack
- Exploits dynamic routing protocols such as Dynamic Source Routing (DSR) and the Ad-Hoc On-Demand Distance Vector (AODV) - Attacker places themselves in the target network to sniff wireless transmissions - From this location, the attacker advertises that the malicious node has the shortest route for transmitting data - Attacker creates a tunnel to forward the data between the source and destination node - Impacting the confidentiality, integrity, and availability of network data
Key Reinstallation Attack (KRACK)
- Exploits flaws in the implementation of the four-way handshake in the WPA2 - Four-way handshake o Establish connections o Generate a fresh encryption key that will be used to encrypt the network traffic - Forcing Nonce reuse o Attacker tricks user into using already in use key o Attacker captures the victim's ANonce key that is already in use to manipulate and replay cryptographic handshake messages
Inter-Chip Privilege Escalation/Wireless Co-Existence Attack
- Exploits vulnerabilities in wireless chips - Comb Chip = designed for Bluetooth AND Wi-Fi - Attackers leverage combo chips to exploit one chip to steal the data from another chip - Bluetooth chip can capture sensitive data from the Wi-Fi chip o OR can manipulated data going through the Wi-Fi Chip
Misconfigured AP Attack
- Exposes network to attack - Difficult to detect a misconfigured AP because it is an authorized, legitimate device - SSID broadcast, Weak PW, Config errors (default configs)
(1) Wi-Fi Discovery
- Find a Wi-Fi network or device - Sing tools such as insider and NetSurveyor - Footprinting the wireless networks and finding the appropriate target
De-authentication attack
- Find an actively connected client - Attacker forces the client to disconnect from the AP - Use aireplay to capture the authentication packet when the client attempts to reconnect o Includes the pairwise master key (PMK), which the attacker can crack by dictionary or brute-force attacks
Wi-Jacking Attack
- Force user to visit malicious site by creating evil twin using KARMA o The client device's browser must store the admin interface credentials of the router. The target network's router must use an unencrypted HTTP
aLTEr Attack
- Force victim to visit malicious website using DNS spoofing - Performed on LET data in AES counter (AES-CTR mode) = NO integrity protection - Attacker installs a virtual (fake) tower between two authentic endpoints - uses this virtual tower to interrupt the data transmission between the user and real tower - Use virtual fake tower to hijack the active LTE session - Redirects the victim to malicious websites - Take control over browsing data and modifies user inputs with a spoofed DNS server
WEP Encryption Cracking
- Gathering a large number of IVs - Done by listening to traffic - WEP packet injection o Expedites the IV-gathering process and allows capturing a large number of IVs in a short period
GNSS Spoofing
- Global Navigation Satellite System (GNSS) - Attacker modifies the target GNSS signal measurements (position, navigation, and time = PNT) - Broadcasts the same signals to the target's GNSS receiver - User's GNSS receiver believes it to be authentic - Force system to display false positions and times
Rogue AP Attack
- Installed in the network = allows unauthorized users to connect to that network - Unauthorized (or rogue) APs can allow anyone with an 802.11-equipped device to connect to a corporate network - The attacker lures the user to connect to the rogue AP by sending the SSID - If the user connects to the rogue AP under the impression that it is a legitimate AP, all the traffic from the user passes through the rogue AP - Allows attacker to sniff traffic flowing through rough AP
Confidentiality Attack
- Intercept confidential info - An attacker may attempt to break the encryption
Tools to discover Wi-Fi networks
- Laptop with a Wi-Fi card - External Wi-Fi antenna - Network discovery software - inSSIDer - NetSurveyor - Wi-Fi Scanner - Acrylic Wi-Fi Home - Wi-Fi Scanner - Acrylic Wi-Fi Home - WirelessMon - Ekahau Wi-Fi Heatmaps
Manipulation (MITM)
- Level beyond eavesdropping - Attacker receives the victim's encrypted data, manipulates it, and retransmits the manipulated data to the victim - Attacker can intercept packets with encrypted data and change the destination address to forward packets across the Internet
Availability Attacks
- Makes wireless network services unavailable to legitimate users - Obstructing the delivery of wireless services - By crippling WLAN resources or by denying them access
(2) GPS Mapping
- Map the network - Drawing a map of the network
GPS Mapping Tools
- Maptitude Mapping Software - Skyhook - ExpertGPS - GPS Visualizer - Mapwel - TrackMaker
Orthogonal frequency-division multiplexing (OFDM)
- Method of digital modulation of data - A signal is split into multiple carrier frequencies that are orthogonal (occurring at right angles) to each other
Service set identifier (SSID)
- NAME of network = A 32-alphanumeric-character unique identifier given to a wireless local area network (WLAN)
Client Mis-Association - User connect to someone else
- Network client mistakenly connects to a neighboring AP
Configuration error (Misconfigured AP Attack)
- No PW configured - Errors made during installation - Configuration policies on an AP - Human errors made while troubleshooting WLAN problems - Security changes not implemented uniformly across an architecture - SSID broadcasting is a configuration error that assists attackers in stealing an SSID = makes the AP assume that the attacker is attempting a legitimate connection
WPA Cracking Techniques
- Only way to crack WPA is to sniff the PW PMK associated with the handshake auth process
Automated Spectrum Analysis Tools
- RF Explorer
Additional RFID cloning tools:
- RFIDler - RFID Mifare Cloner - Proxmark3 - Boscloner Pro
Omnidirectional Antenna
- Radiate electromagnetic (EM) energy in all directions - Provides a 360° horizontal radiation pattern - Radiates strong waves uniformly in two dimensions, but the waves are usually not as strong in the third dimension - Efficient in areas where wireless stations use time-division multiple access technology - Good for radio towers and receivers may be moving
WPA3 Encryption Cracking
- Replaces WPA2's four-way (PSK) handshake with the Dragonfly (SAE) handshake - Dragonfly SAE still vulnerable to password-cracking - Dragonblood o Set of vulnerabilities in WPA3 allowing key recover, security mechanism downgrades, info-theft - Tools = Dragonslayer, Dragonforce, Dragondrain, and Dragontime
Dipole Antenna (doublet)
- Straight electrical conductor measuring half a wavelength from end to end - Connected at the center of the radio frequency (RF) feed line - Feeds on a balanced parallel-wire RF transmission line
MAC Spoofing Tools
- Technitium MAC Address Changer - Allows a user to change (spoof) the MAC address of their NIC instantly - Has user interface and provides info on each NIC in the machine
Wireless ARP Poisoning Attack
- The ARP cache maintained by the OS is corrupted with wrong MAC addresses - Send an ARP replay packet constructed with a wrong MAC address - Impacts all the hosts in a subnet o All hosts connected to a switch or hub are susceptible to ARP poisoning attacks - Attackers IP is associated with the victim's MAC - Use Ettercap for ARP attacks
Basic service set identifier (BSSID)
- The MAC address of an access point (AP) or base station that has set up a basic service set (BSS)
Fragmentation Attack
- The aircrack-ng suite helps the attacker obtain a small amount of keying material from the packet - aircracking-ng sends a packet to the AP that the AP echoes = capture keying info
Choosing the Optimal Wi-Fi Card
- Tools such as aircrack-ng and KisMAC work only with selected wireless chipsets - Consider the following when choosing card o Determine the Wi-Fi requirements o Learn the capabilities of a wireless card o Determine the chipset of the Wi-Fi card o Verify the chipset capabilities o Determine the drivers and patches required
802.16 (WiMAX)
2 - 11 GHz SOFDMA 34 - 1000 Mbps speeds 1609.34 - M 9656.06 (1-6 miles)
Multiple input, multiple output-orthogonal frequency-division multiplexing (MIMO-OFDM)
- AKA transmission scheme or modulation scheme - Spread spectrum technique that multiplies the original data signal with a pseudo-random noise-spreading code - Protects signals against interference or jamming
Evil Twin
- AP that pretends to be a legitimate AP by imitating its SSID - Sets up a rogue AP outside the network perimeter - Lures users to sign into this AP - Uses tools: KARMA
Rouge AP
- APs an attacker installs on a network without authorization - NOT under the management of the admin o NOT configured for security - Provide backdoor access to the wireless network - Use MANA Toolkit
Tools
- Aircrack-ng - Wifiphisher - Reaver
Eavesdropping (MITM)
- An attacker in the vicinity of a wireless network can receive radio waves on the wireless network without much effort or equipment - Attacker can examine the entire data frame and store it
(3) Wireless Traffic Analysis
- Analyze the traffic - ID the vulnerabilities and susceptible victims
Sinkhole Attacka
- Attacker advertises a compromised or malicious node as the shortest possible route - Attacker places the malicious node near the base station and attracts all the neighboring nodes with fake routing path info - Sniff and manipulate data
AP MAC Spoofing
- Attacker can spoof the MAC address of the AP by programming a rogue AP to advertise the same identity information as that of the legitimate AP = bypasses MAC filtering on PA - Attack spoofs their MAC to look like authorized client --> connects to AP
Man-in-the-Middle Attack (MITM)
- Attacker intercept, read, or alter info transmitted between 2 computers
Disassociation Attack
- Attacker makes the victim unavailable to other wireless devices by destroying the connectivity between the AP and client
GPS
- Attacker uses this GPS utility to locate and map the target wireless network in a geographical area
Meaconing Method (GNSS)
- Attackers aim to block and re-broadcast the original signals to the receiver - Effective with mono-and multi-antenna meaconers that control multiple satellites - Allows attackers to manipulate the original signal with false positioning data
Interrupting the Lock Mechanism (GNSS)
- Attackers aim to discover a GNSS receiver's new lock via a faulty signal - Start radiating a jamming signal inside the GNSS receiver, where the receiver requests for the next acquisition - A signal simulator is used to generate a false signal, transmit it to the GNSS receiver, and gain the new lock data of the receiver - Gain location data of receiver by generating a false signal to the receiver
MAC Spoofing Attack
- Attackers change their MAC address to that of an authenticated user to bypass the MAC filtering configured in an AP - To spoof a MAC address, the attacker simply needs to set the value returned by ifconfig to another hex value in the format of aa:bb:cc:dd:ee:ff
Drag-off Strategy (GNSS)
- Attackers track the receiver's position and identify the deviation from the original location to a fake one - Attacker mirrors the original navigation signals, injecting a progressive misalignment between those signals, and forwarding them to the GNSS receiver. - Protects attackers from detection by radar systems
Cancellation Methodology (GNSS)
- Attackers use dual signal transmission to cancel out individual spoofed signals by introducing false satellite data. - Used for extracting the code phase data but limited in terms of obtaining the amplitude matching and carrier phase
Directional Antenna
- Broadcast and receive radio waves from a single direction - Works effectively in only a few directions = reduces interference
WPA/WPA2 Encryption Cracking
- Can still be cracked if right packets are captured
Offline attack
- Capture the WPA/WPA2 authentication handshake - Crack encryption key offline - Capturing a full authentication handshake from a client and the AP helps in breaking the WPA/WPA2 encryption
RFID Cloning Attack
- Capturing the data from an RFID tag and then creating its clone using a new chip - Data from one RFID tag are copied into another tag by changing the tag ID (TID) - The cloned copy is different from the original RFID tag and may be easily detected - Use iCopy-X, RFIDler, etc. to clone RFID tags
Integrity Attack
- Changing data during transmission - Attackers send forged control, management, or data frames to misdirect wireless devices
(5) Wi-Fi Encryption Cracking
- Crack the WEP or WPA/WPA2 encryption
Denial-of-Service Attack
- Disrupt wireless network connections by broadcasting de-authenticate commands
Yagi Antenna (Yagi-Uda)
- Unidirectional antenna commonly used in communications at a frequency band of 10 MHz to VHF and UHF - High gain and low signal-to-noise (SNR) ratio - Unidirectional radiation and response pattern - Concentrates the radiation and response - Consists of a reflector, dipole, and many directors - Develops an end-fire radiation pattern
WPA PSK
- Uses a user-defined password to initialize the four-way handshake - User provides credentials/PW to the AP - Capture WPA-PSK handshake containing password = brute forced using a dictionary attack
WEP Cracking
- Wesside-ng = WEP cracking tool o Finds and associates with EWP network
Wi-Fi Hotspot Finder Tools
- Wi-Fi Finder - Homedale::Wi-Fi/WLAN Monitor - Fing - Network Tools - WiFi Finder - Free WiFi Map - WiFi Map - Find Wifi & Connect to Wi-Fi
Wireless Hacking Methodology
- Wi-Fi discovery - GPS mapping - Wireless traffic analysis - Launch of wireless attacks - Wi-Fi encryption cracking - Wi-Fi network compromising
Mobile-based Wi-Fi Discovery Tools
- WiFi Analyzer - Opensignal - Network Signal Info Pro - WiFi Manager - Network Refresher: Network Signal Refresher - WiFi Scanner - WiGLE
Denial-of-Service: Disassociation and De-authentication Atta
- Wireless DoS attacks include: o Disassociation attacks o De-authentication attacks
802.15.4 (ZigBee)
0.868, 0.915, 2.4 GHz O-QPSK, GFSK, BPSK 0.02, 0.04, 0.25 Mbps speeds 1 - 100 M
Unauthorized Association - someone lese connects to you
2 Forms o Accidental § Connecting to the target network's AP from a neighboring organization's overlapping network without the victim's knowledge o Malicious § Done using Soft Aps § The attacker infects the victim's machine and activates soft APs allowing an unauthorized connection to the network
802.11b
2.4 GHz DSSS 1, 2, 5.5, 11 Mbps speeds 35 - 140 M
802.11
2.4 GHz DSSS, FHSS 1 Mbps and 2 Mbps speeds 20-100 M
802.15.1 (Bluetooth)
2.4 GHz GFSK, π/4-DPSK, 8DPSK 25 - 50 Mbps speeds 10 - 240 M
802.11g
2.4 GHz OFDM 6, 9, 12, 18, 24, 36, 48, 54 Mbps speeds 38 - 140 M
802.11n
2.4 and 5 GHz MIMO-OFDM 54 - 600 Mbps speeds 70 - 250 M
802.11i
A standard for WLANs that provides improved encryption for networks that use 802.11a, 802.11b, and 802.11g standards; defines WPA2-Enterprise/WPA2-Personal for Wi-Fi
802.11e
It provides guidance for prioritization of data, voice, and video transmissions enabling QoS
WEP
NO authentication RC4 = Encryption algorithm WEP = Encryption method 40 or 104 bits = Key size CRC-32 = Data integrity 24 bits = IV length
Rogue AP vs Evil Twin
Rouge PA disables SSID broadcast + setup INSIDE network Evil Twin copies and broadcasts the SSID of target network + setup OUTSIDE network
Misconfiguration Key Elements (Misconfigured AP Attack)
SSID broadcast - APs using default SSIDs are vulnerable to brute-force dictionary attacks - An unencrypted SSID broadcasts the password in plaintext Weak password - Some network admins incorrectly use SSIDs as basic passwords
WarChalking
Symbols are drawn in public places to advertise open Wi-Fi networks.
KARMA Attack
create an evil twin using KARAM tool
WarWalking
o Attackers walk around with Wi-Fi-enabled laptops installed with a wireless discovery tool to map out open wireless networks.
MAC DoS Attacks
o de-authentication flood attacks = everyone de-authenticated o virtual jamming o association flood attacks