Advanced 802 11 Attack Mike Lynn Robert

Advanced 802. 11 Attack Mike Lynn & Robert Baird 7/31/2002 Black Hat 2002, Las Vegas NV

What Is NOT Covered Wired Equiv. Privacy (WEP) vulnerabilities WEP Key cracking techniques Radio signal amplification Suggested changes to the IEEE 802. 11 b specification Wireless network discovery tools 7/31/2002 Black Hat 2002, Las Vegas NV

What Will Be Covered Wireless network best practices Practical attacks The focus of the attack(s) n n n The network layers The bottom 2 layers Custom (forged) 802. 11 b management frames The Tool Box n n n 7/31/2002 Drivers Utilities Proof of concept code Black Hat 2002, Las Vegas NV

What Will Be Covered Attack Scenarios n n Denial of service Masked ESSID detection 802. 11 b layer MITM attack Inadequate VPN implementations Mitigation Strategies 7/31/2002 Black Hat 2002, Las Vegas NV

Wireless Best Practices Enable WEP - Wired equivalent privacy n Key rotation when equipment supports it Disable broadcast of ESSID Block null ESSID connection Restrict access by MAC address Use VPN technology Use strong mutual authentication 7/31/2002 Black Hat 2002, Las Vegas NV

Practical Attacks WEP – Can be cracked passively Masked ESSID – Can be passively observed in management frames during association Block null ESSID connects – Same problem Install VPN – Weakly authenticated VPN is susceptible to active attack (MITM) Strong mutual authentication - ? 7/31/2002 Black Hat 2002, Las Vegas NV

The Network Layers 7/31/2002 Black Hat 2002, Las Vegas NV

The Bottom Layers Manipulating the bottom 2 layers of the OSI n Data Link (Layer 2) w Media Access Control (MAC) – Access to medium w Logical Link Control (LLC) – Frame sync, flow control n Physical (Layer 1) w Radio bit stream w Divided into channels 7/31/2002 Black Hat 2002, Las Vegas NV

The Bottom Layers 7/31/2002 Black Hat 2002, Las Vegas NV

Management Frames Management frames can control link characteristics and physical medium properties 802. 11 b management frames are NOT authenticated n 7/31/2002 Why is this bad? Black Hat 2002, Las Vegas NV

The Tool Box Custom Drivers n Air-Jack w w n Custom driver for Prism. II (HFA 384 x) cards MAC address setting/spoofing Send custom (forged) management frames AP forgery/fake AP Lucent/Orinoco w Linux driver modified to allow MAC address setting/spoofing from the command line Utilities n 7/31/2002 User space programs – wlan-jack, essid-jack, monkey-jack, kracker-jack Black Hat 2002, Las Vegas NV

Air-Jack Driver Allows control of wireless card modes n Modes 0 and 1 standard documented modes w BSS (infrastructure) (1) or IBSS (0) (Ad-hoc) n Pseudo-IBSS (3) mode w Control channel selection w Firmware handles timing sensitive functions n Mode 5 - undocumented w w 7/31/2002 Channel selection Firmware handles time sensitive functions No beacons sent Very little firmware intervention Black Hat 2002, Las Vegas NV

Air-Jack Driver n Mode 6 – Host Access Point mode w Sends Beacons (firmware control) w Responds to Probe request w Handles time sensitive functions Can enable Prism. II monitor mode Uses Linux PF_PACKET interface for RX and TX of raw frames 7/31/2002 Black Hat 2002, Las Vegas NV

$Air-Jack Driver void send_deauth (__u 8 *dst, __u 8 *bssid) { struct a 3_80211$

Air-Jack Driver void send_deauth (__u 8 *dst, __u 8 *bssid) { struct a 3_80211 hdr; __u 16 reason; }frame; memset(&frame, 0, sizeof(frame)); frame. hdr. mh_type = FC_TYPE_MGT; frame. hdr. mh_subtype = MGT_DEAUTH; memcpy(&(frame. hdr. mh_mac 1), dst, 6); memcpy(&(frame. hdr. mh_mac 2), bssid, 6); memcpy(&(frame. hdr. mh_mac 3), bssid, 6); frame. reason = 1; send(socket, &frame, sizeof(frame), 0); } 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – WLAN-Jack Denial of Service – De-authentication n n Use MAC address of Access Point Send deauthenticate frames w Send continuously w Send to broadcast address or specific MAC n Users are unable to reassociate with AP Air-Jack + WLAN-Jack 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – WLAN-Jack 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – WLAN-Jack Airopeek Trace 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – WLAN-Jack Decode of Deauthentication Frame 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – WLAN-Jack This is your connection 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – WLAN-Jack This is your connection on WLAN-Jack. 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – ESSID-Jack Is the ESSID a shared secret? If I mask the ESSID from the AP beacons then unauthorized users will not be able to associate with my AP? Discover Masked ESSID n n 7/31/2002 Send a deauthenticate frame to the broadcast address. Obtain ESSID contained in client probe request or AP probe response. Black Hat 2002, Las Vegas NV

Attack Scenarios – ESSID-Jack 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios - ESSID-Jack Airopeek Trace 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – ESSID-Jack Airopeek Trace 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – Monkey-Jack MITM Attack n n Taking over connections at layer 1 and 2 Insert attack machine between victim and access point Management frames n Deauthenticate victim from real AP w Send deauthenticate frames to the victim using the access point’s MAC address as the source 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – Monkey-Jack n n Victim’s 802. 11 card scans channels to search for new AP Victim’s 802. 11 card associates with fake AP on the attack machine w Fake AP is on a different channel than the real one w Attack machine’s fake AP is duplicating MAC address and ESSID of real AP 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – Monkey-Jack n Attack machine associates with real AP w Attack machine duplicates MAC address of the victim’s machine. Attack machine is now inserted and can pass frames through in a manner that is transparent to the upper level protocols 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – Monkey-Jack Before Monkey-Jack 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios Monkey-Jack After Monkey-Jack 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios - Monkey-Jack 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – Kracker-Jack Dangers of wireless MITM n n n Wireless networks are more vulnerable to MITM attacks than wired networks. Many security solutions are implemented with an assumption of a secure layer 1 and 2 Many VPN solutions are implemented with inadequate authentication for protection against wireless MITM attacks. 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – Kracker-Jack WAVEsec n n An open source software solution for securing wireless networks Uses Free. S/WAN IPSEC implementation Will thwart passive eavesdropping of wireless network communications. Implementation options w X. 509 Certificates w Secure DNS 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – Kracker-Jack Authenticating with WAVEsec gateway n n 7/31/2002 Client sends modified DHCP request with client’s public key WAVEsec gateway inserts client’s public key into DNS record Client obtains WAVEsec gateway’s public key by requesting it from the DNS server IPSEC tunnel setup Black Hat 2002, Las Vegas NV

Attack Scenarios – Kracker-Jack Using Kracker-Jack n n n KJ inserts to 802. 11 layer (like monkey-jack) KJ, using a DNS request, gets victims public key from DNS server KJ, using the victims MAC address sends DHCP request with its own key to replace the victim’s key in the DNS server 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – Kracker-Jack n n n KJ initiates ISAKMP main mode SA with the WAVEsec server KJ initiates ISAKMP main mode SA with victim Victim gets new server key by DNS request serviced by KJ Two separate IPSEC tunnels are now setup All traffic passes through KJ unencrypted 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – Kracker-Jack 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – Kracker-Jack IKE – ISAKMP/Oakley n Phase 1 w Messages 1 and 2 – negotiate characteristics of security association; no authentication w Messages 3 and 4 – exchange random values (nonce) and execute Diffie-Hellman exchange to establish a master key (SKEYID); no authentication w Messages 5 and 6 – exchange information for mutually authenticating the parties; identity payload, signature payload, and OPTIONAL certificate payload 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios – Kracker-Jack IKE – ISAKMP/Oakley n Phase 2 – Oakley Quick Mode w Define Security Associations w Define keys used to protect IP datagrams 7/31/2002 Black Hat 2002, Las Vegas NV

Attack Scenarios Shared key authentication attack n n n 7/31/2002 Observe plain text challenge Observe cipher text response XOR plain text with cipher text to get key stream XOR IP packet with key stream re-using IV Broadcast ping Black Hat 2002, Las Vegas NV

Mitigation Strategies Big guy with a stick Wireless IDS and Monitoring n Air. Defense http: //www. airdefense. net VPN + Strong mutual authentication RF Signal shaping – Avoiding signal leaks n n 7/31/2002 Antennas with directional radiation pattern Lower Access Point power Black Hat 2002, Las Vegas NV

Summary Wireless networks are more susceptible to active attacks than wired networks Enable all built-in security capabilities Use VPN with strong mutual authentication Monitor wireless network medium (air space) for suspicious activity Updates – Black Hat web site or n http: //802. 11 ninja. net 7/31/2002 Black Hat 2002, Las Vegas NV

Advanced 802. 11 Attack Robert Baird & Mike Lynn 7/31/2002 Black Hat 2002, Las Vegas NV