Wardriving & Kismet Introduction
Download as PPTX, PDF2 likes4,734 views
Kismet is an open source wireless network analyzer used for wireless reconnaissance and wardriving. It passively monitors wireless traffic and extracts information on access points and clients including BSSID, encryption status, channel, manufacturer, and GPS location. Kismet logs data in various formats like text, CSV, XML and pcap files which can be analyzed using tools like Excel or imported into mapping software to visualize wireless network activity geographically. System administrators can use Kismet to troubleshoot wireless network performance issues while security analysts use it to evaluate network security and detect potential threats.
Wardriving & Kismet Introduction
- 1. Wireless Security, Wardriving, and Detecting Rogue Access Points Using Kismet Wireless ScannerBy: Lance Howell
- 2. Wireless SecurityWEP (Wired Equivalent Privacy)WPA (Wi-Fi Protected Access)WPA2 (Wi-Fi Protected Access version 2)
- 3. Weaknesses in WEPOlder Equipment and devicesSupports no keys or a shared key management system. You have to manually change your keysThe Initialization Vector (IV) is too short and sent in clear textIVs are staticNo cryptographic integrity protection is implemented
- 4. Weakness in WPAUsing short Pre-shared Keys (PSK)Dictionary Attacks
- 5. ReconnaissanceFirst Popular Software NetStumblerWindowsMacNo Linux Based VersionKismet Popular for professionalsLinux version Windows called Kiswin v 0.1 Last Update 2005
- 6. Reconnaissance continuedUse the software to listen to trafficAccess Points (AP) BroadcastSSIDEncryption StatusRather it is Broadcasting or notAP InformationGPS InformationMap Locations
- 7. SniffingPassive and Undetectable to Intrusion Detection Systems (IDS)Attackers can Identify Additional Resources that can be CompromisedAuthentication TypesUse of Virtual Private Networks (VPN), Secure Sockets Layer (SSL), and Secure Shell (SSH) helps protect against wireless interception
- 8. Spoofing and Unauthorized AccessDue to TCP/IP Design, there is little that can be done to prevent Media Access Control/IP (MAC/IP) Address SpoofingStatic Definition of MAC Address Tables can this attack be preventedStaff must be diligent about logging and monitoring those logs to try to address spoofing attacks so they can be identified.
- 9. Kismet and WardrivingInfo. Gathering, Analysis And Research
- 10. IntroductionsConsole-based wireless analysis toolPassive; captures traffic from wireless cards in monitor modeObserves activity from all networks within rangeWardriving tool of choiceWardriving is legalIncluded in Backtrack 4 ready to run and use
- 12. Objectives of KismetLocate and Identify AP(s)BSSID, ESSID, Channel and EncryptionGPS dataAnd more…Locate and Identify Client(s)MAC AddressManufacturersSpectrum AnalysisDrones/Open-Source WIPS
- 13. Data ObtainedText (txt)Comma Delimited File (CSV)XMLGPS PcapNetXML
- 14. LOG Files
- 15. Netxml Logging FileCan be imported into Excel for post-processing analysisRename to “.xml”, select “read-only workbook” when openingRequires Internet access to download Kismet DTD file Allows you to graph results, add details for additional analysis
- 16. Reporting on AP Uptime“=U267/(1000000*(60*60*24))”
- 17. StartupKismet will prompt to start the Kismet Server at startupOnce the Kismet server has started, you will be prompted for the first packet source
- 18. Kismet SourcesSpecify the available wireless interface as a packet source“wlan0, “wlan1”, etc.Kismet will identify the needed information, place the interface in passive capture modeAdd as many sources as you want from Kismet Add SourceCan also specify libpcap wireless packet capture files as sources
- 20. PluginsPlugin architecture to extend functionalityDistributed with Kismet: Aircrack-PTW, SpectoolsThird-Party: DECT wireless sniffingKismet PluginsStatus of plugins, version informationEnable or disable UI pluginsSee list of Kismet Server plugins
- 21. Extending KismetDevice Manufacturer NameKismet relies on Wireshark’s “manuf” file to identify manufacturersFile can be updated with make-manuf script (not distributed with BT4)# wgethttp://anonsvn.wireshark.org/wireshark/trunk/wka.tmpl# wgethttp://anonsvn.wireshark.org/wireshark/trunk/manuf.tmpl# wgethttp://anonsvn.wireshark.org/wireshark/trunk/make-manuf# perl make-manuf# mvmanuf /usr/share/wireshark
- 23. GISKismentBuilding Visual Representations of Kismet dataCorrelate information in databaseGraphically represent information Filter out non-useful information
- 24. GISKismet- FiltersInput FiltersAP configuration dataQuery filters on any informationAP configurationClient informationGPS coordinate(s)Filter InputInsert all AP(s) on channel 6 named LinksysFilter OutputOutput all AP(s) without encryption
- 25. Tips on Protecting the NetworkUse an External Authentication SourceRADIUSSecurIDProtect MAC Spoofing: Use a Secure Connection for all Host Services Accessed by the NetworkSSHSSLUse a Dynamic Firewall
- 26. System AdministratorsPoor performance on the wireless network complaintThings to observe:What AP are the clients connecting to?Are all AP’s properly configured?Lots of retries indicating poor connections or noiseLots of missed beacons indicating noise or faulty APsWhat channels are being utilized?
- 27. Retries are normal in small numbers; more than sustained 10% is a problem
- 28. Signal and Noise/ChannelPacket Rate (Real Time)Data Frames (Cumulative)Networks Count (Yellow is historic, green is currently active)Detail View (Scroll with arrow keys)
- 29. AuditorsAre the networks configured per specification?SSID cloaking enabled/disabled?Appropriate encryption and authentication settings?Are there unencrypted networks (when there shouldn’t be)?Kismet walkthrough while channel hopping, post-processing analysis.
- 30. Security AnalystsNetwork discovery & analysisAre there open Aps or weak crypto?What are the clients on the network?What kind of EAP types are in use?Post-processing data evaluationThird-Party tools with Kismet pcap files, XML records, nettxt summaries
Editor's Notes
- #3: WPA- Provides partial compliance in 802.11 Wi-Fi standard. Meant to be an intermediary between WEP and the new verison WPA2WPA2- Full 802.11 Wi-Fi Standard is implemented.
- #9: Static Definition of MAC Address Tables: With the amount of resources that it takes to manage that system you have to decide of it is worth taking that approach.
- #11: Wardriving is deemed legal by the FBI as long as you do not do anything to crack or break into the network. Since wireless signals are traveling over the air the companies have no expected rights to privacy.
- #26: External Authentication: Prevent an unauthorized user from accessing the wireless network, and resources it connects with.Secure Connection for Host Services: Possible to require valid client certificates to access those resources. Even if they got into your network then they would be stopped at the critical systems.