All right.
Hello and welcome back to the official circus series.
This is the oh 211 Wi-Fi wireless security section.
We're going to talk about wireless.
We're going to talk about network attacks.
We're going to talk about wireless encryption and many other topics.
It's a very exciting topic because wireless is everywhere.
Wireless is ubiquitous with the advent of smartphones, Iot devices, Google homes, Google nests,
all that kind of good stuff.
This is our chapter outline.
We're going to talk about wireless networking, the different types of wireless networking.
We're going to look at wireless networking terminologies.
We're going to look at the different bands of wireless networking.
So wireless versus wired networking.
We're going to talk about wireless encryption because it's important to have secure wireless networking
as encryption is always top of mind with respect to wireless networks versus traditional wired networks.
And then, of course, we'll talk about some of the different wireless attacks, as well as some of
the different countermeasures that can be used to prevent wireless attacks.
This is our chapter flow.
We're going to discuss what's in-network, what's a wireless network types.
We're going to go over the different types of wireless networking.
So it's not just.
802 11.
And what?
Finish out with encryption, the different types of tools and we'll even get into some Bluetooth as
well.
So what is the wireless network, wi fi or wireless fidelity refers to the 8.2. 11, I believe, standard.
So the general I believe designation for network standards and ATO to such as ATO 2.34 Ethernet.
The 11 Family of Standards governs all the wireless local area networking.
Essentially, it's an I Tripoli standard developed by the Land Man Standards Committee.
It has currently six different over the air modulation techniques, which we'll get into momentarily.
Wireless networking generally has advantages that it cuts back on the amount of cabling and it also
cannot be cut by an attacker.
So it is that advantageous in that way.
It also allows you to provide connectivity where cables are hard to reach, such as airports, coffee
shops, universities, other places like that.
So the six over the air modulation techniques in 802 11 all use the same layer two protocols.
The most popular and prolific are those defined by the BMG amendments to the original Wi-Fi standard.
And later, more security was added on and enhanced with the 802. 11 I some of the service standards
like the C through F, H, through J as well as the eight or 211 N are enhancements and corrections
to previous specifications.
NATO 11 B was the first.
Widely accepted, wireless networking is standard and followed by A and G.
So some disadvantages of wireless networking working are that security can be more difficult.
And you also.
As you increase the number of nodes in wireless networking, bandwidth becomes an important consideration
and wireless networks can be interfered with with other electronic equipment operation like fluorescent
lighting, certain types of motors, they create electromagnetic interference and radio frequency interference.
So wireless has to be governed by particular frequencies that especially the 2.4 gigahertz and the five
gigahertz frequency band.
So sometimes B and the G networking can have interference from things like microwave ovens and other
things.
So these are the 8 to 11 wireless standards.
We'll see that A02 11 A was adopted in 1999 and B was also adopted around the same time.
We had a around the maximum data rate of 11 megabits per second.
But it operated on the 2.4 gigahertz frequency.
So because Wi-Fi differs from Ethernet in in a very important way, Ethernet uses something called carrier
sense, multiple access collision detection.
That means that Ethernet protocols and frames when there's a collision on the network, such as someone
else is trying to transmit.
It will use a protocol that can detect that collision and back off the amount of data that's being sent.
Now, contrast that with wireless.
On the other hand, wireless does not handle collisions quite nearly as well, and it uses something
called carrier sense multiple access with Collision Avoidance or Sistema CD.
In practice, because of the overhead, the maximum throughput, the eight oh to 11 B could really achieve
was about 5.9 megabit per second over TCP and 7.1 megabit per second over UDP.
So it's different performance rates based on different the type of protocol.
So I.
Tripoli 802 11 B also operates in the unprotected 2.4 gigahertz frequency band.
With an 83.5 megahertz wide channel.
So the key thing to remember with wireless is that it's a theoretical range generally and the maximum
limit to the data rate, it's a maximum under perfect conditions and the typical range will vary based
on things like building materials, construction and things of that nature.
So then eight or 211 be quickly crept up on the market and because it extended some of the different
modulation techniques off the original standard.
So chipsets and wireless routers and devices were able to support the 802 11 B enhancement.
So this increased.
Both the amount of adoption rate and also the price drop as well.
So 211 B rapidly became the definitive wireless LAN technology.
So 802 11 B runs that 11 megabit per second, but we'll scale back to five and a half megabit per second
or two megabit per second, depending on signal quality.
Because lower data rates use less complex and more redundant encoding, they're less susceptible to
corruption due to interference and signal attenuation.
So in order to try and bump up the speeds, they created some enhanced versions called ADA 211 B plus.
But they were not really adopted.
And along came ADA or $2.11 G.
So 802 11 G was.
Released in 2003 with the 2.4 gigahertz frequency band.
Notice that the 54 megabit per second data rate increase.
So the ATO 211 B and ATO 211 G standards do not specify the width of a channel.
Rather they specify the centre frequency.
So the centre frequency is at 22 megahertz apart.
So there are 14 overlapping staggered channels that are 23 megahertz apart.
So the most common channels are one, six and 11.
So channel 14 we can't take advantage of in the US, but if you're overseas, you can take advantage
of Channel 14.
So most often commercial routers when you buy if you buy big routers today, they are set to channels
one, six or 11 because of the lack of overlap.
So depending on the power of the transmitter on a channel, say, for example, a channel one, if you
had a more powerful channel one, it could overwhelm Channel six.
But as a general rule one, six and 11 do not overlap.
And according to the FCC regulations, channels ten and 11 are only the channels which are common throughout
the world.
Channel 14 is restricted to eight oh to 11 B only.
Arrow 211 did use the five gigahertz frequency band and uses something called off FDM or Orthogonal
Frequency Division multiplexing.
And it has a maximum data rate of 54 megabit per second.
They are notice roughly until we.
Received 802 11 end standard.
The typical range stayed consistent outdoors at about 4 to 450 feet, whereas indoors it was anywhere
from 100 to 125 feet.
So the 802 11 G standard swept the consumer shelves in 2003 while before it was actually ratified.
Then it became common to see A, B and G routers, and then it became B, G and then routers.
So G held the promise of higher throughput, but conflict with devices and also interference and really
only having three fully non-overlapping channels.
And also the higher data rates of eight or to 11 G are more susceptible to interference.
So then the move to dual mode or tri band products also carries with it the economies of scale.
So someone has to build a chip to be able to handle that particular.
Standard.
So some chipsets were able to take advantage of things like packet bursting, which will would improve
speeds considerably.
The first major manufacturer to use the G standard in this way was the Apple Airport extreme, as well
as Cisco, who bought up links and was able to offer them under the name Aero Net and January 2004.
I actually decided to form a new task group to amend the 802 11 standard to try to get the real throughput
up above 100 megabits per second.
And at least up to four, two times 4 to 5 times faster than eight or to 11 A or B, and perhaps 20
times faster than B.
So there are a couple of competing variants.
Well, they are 211 end, but it built on the previous 802 11 standards by introducing something called
MIMO, multiple input, multiple output.
So essentially adding additional transmit and receive antennas to have increased throughput.
As well as increased ranged.
Senator Slater 211 and also supported the dual band configuration.
So it's still very common to see eight or to 11 end routers.
Even today, though, AC has kind of taken over the market.
I Tripoli does not actually test equipment for compliance.
So there's a group called the Wi-Fi Alliance, which runs a program.
So all manufacturers that want to produce wireless devices have to pay to participate in.
So this is the Wi-Fi Alliance Web page.
You can see a little bit about who they are, what organizations are members, where their direction
is going.
And if you want a product that's actually certified, you look for the Wi-Fi certified logo.
So generally, that is the brand.
If you want to become a member, member.
You have to, of course, pay a fee, either be a contributor to drive the actual process, or you can
be an implementer.
But there are some small business organizations as well.
But you have to be part of the group to be able to use that membership.
So now let's talk about some different terminology around Wi-Fi.
So there's this idea of Wi-Fi.
Chalking.
Again, it's it's somewhat gone away in recent years, but it is still an interesting part of the Wi-Fi
data.
211 story.
So we have a few terms.
First, we have war driving.
This was the idea of searching around for why find networks where a person usually in a moving vehicle
or maybe with a laptop or a smartphone, there's software for driving freely available on the Internet.
One such software we'll get into here momentarily.
There's also war cycling, war walking or war flying with a drone to try and gather access point information.
So you have to if you want to do war driving, you got to have it.
A device could be a laptop, could be a smartphone.
You have to have the right type of wireless network card or NIC card that will work in promiscuous mode.
So promiscuous mode means that it will receive traffic that is not necessarily addressed to it.
So the antenna could be mounted on the car or on a bicycle because the wireless LAN may actually extend
outside of an office building.
A user could potentially get information on the networks and possibly gain access to other things.
So let's talk about the different types of wireless networks.
And to do that, we really have to talk about wireless encryption.
So we started out with WEP or Wired equivalent privacy, which was not designed to be a long term solution,
but it was designed to provide the same level of security, roughly as a wired network.
So we have some other wi fi terms.
We have.
WPA, which came out as more of a replacement of WEP or an improvement to WEP.
Wi-Fi protected access, but has largely been deprecated because of known tools for breaching security.
WPA can work with something called TCP, which stands for Temporal Key Integrity Protocol, which is
a type of encryption.
Or it can be used with the RC for Stream Cipher, which is what WEP was actually created with.
Then you have WPA two, which is generally seen to be the preferred method of securing a wireless network
because it uses something called skimpy counter cipher.
BLOCK chaining message authentication code.
Protocol or copy.
It's based on the advanced encryption standard or a yes, which is the approved encryption standard
as far as the U.S..
Adopted by the NSA, though it has been.
Somewhat.
Question as to whether that standard can continue to be approved in the era of quantum computing and
all the technology, but for the foreseeable future, as as well as CMP will be around and be utilized
now.
WEP and is different from the WPA and WPA two.
There are WPA personal and WPA two enterprise.
Now these are tending to be.
Personal meaning what you would use around your home network enterprise would be used for a business
or a company and could take advantage of more advanced authentication methods like ERP, the Extensible
Authentication Protocol.
So these are the different types of networks.
They're usually defined by their security level and their encryption type.
So let's look at the different types of wireless encryption.
We have WEP wired equivalent privacy.
Which has been broken.
Because of its poor handling of the RC four stream cipher, particularly the initialization vector.
So Web has been broken for a long, long time.
WPA came out and did some improvements on it, and because the WPA has the enterprise mode, it can
be used with EAP as well as radius.
Radius stands for remote authentication, dial in user service, and it works over Port 1812.
And it's a what we call a triple A protocol and authorization authentication and accounting protocol.
The point of radius is to provide a secure.
Network access control.
Many times ERP and RADIUS are combined with something called 802.1 x WPA two.
On the other hand, can also be used with temporal key integrity protocol, but it is preferred to be
used with.
CMP because of its being based on a piece.
So t cap came around with the I Tripoli 802. 11 I standard for wireless lands and there are generally.
Two methods of doing wireless networks.
You can either do a pre shared key or you can do an open network.
A pre shared key is where you have to put in a passphrase or a password to your network before you can
authenticate.
Now, this can be done in an enterprise scenario with something like a certificate based authentication
or a smart card or something like that.
Now.
Hotels, many coffee shops, many airports use open wireless networks in order to use something called
a captive portal instead of using.
The.
Pre shared key.
They'll just have you authenticate within the browser and then you'll gain additional network access
once you provide some type of a credentials or a form of payment.
Now, with respect to a yes and yes, these are two of these symmetric encryption algorithms.
There are actually block ciphers.
DS stands for the data encryption standard, and it has been largely deprecated.
It was a 64 bit block size with a 56 bit key, and it was designed before we had a yes.
And essentially, it has been deprecated or replaced by triple DS or a 3DS.
So as is generally the recommended solution, our if you cannot support a yes in your particular organization,
you can use 3DS as a recommended standard.
Now, with respect to enterprise security, the best practice is to use 8.2.1 X with radius and it uses
a shared secret which is similar to a password.
There are some different modes to IP or the extensible authentication protocol.
It has AEA petals, which is considered the most secure because it provides mutual authentication,
but it needs an 82.1 X server and it's largely certificate based.
There has to be a certificate on both the client and the server.
So 8.2.1 X can authenticate using ERP and radius both devices as well as users.
So things like switches.
Voice over IP phones.
There's some other technologies like Leap, which was the lightweight ERP, which was created by Cisco
and then protected Epee, which is a version that was is often used in wireless networks and point to
point connections.
It was created by Microsoft, RSA and Cisco.
But generally epee tools is the most secure.
And there are different types of wireless encryption.
And depending on whether you are a small business or even just a regular home user or a large organization,
you may have different choices for your wireless options.
So now Radius and EEP may also work with something called federated systems.
This means that you can actually log in one time with single sign on and get access to multiple systems
instead of just one.
System.
So this can use any of the ERP versions.
And it's very advantageous for organizations.
Now let's look at some of the different ways in which you can gather information on Wi-Fi.
So we have here wiggled dot net, which is actually a essentially all the networks found by everyone.
So you can actually put in a latitude and longitude.
You can zoom in, zoom out, you can go pretty much anywhere in the different areas that have have Wi-Fi
found and it's pretty much worldwide.
So you can see different areas, obviously, the larger the.
Density of wi fi networks, you'll have larger areas.
And you can see different hotspots individually.
You can actually put in SS IDs if you know that the name of the hotspot, if you know the the Mac address,
you can sort by date.
So if you want to cut out for a particular time to see what's new, you can do that as well.
You can filter based on ones that are possibly free.
Down here.
We can see the statistics over time as to how the wireless networks increased the starting out.
You know, before 2010, it was a much lower number daily in the tens of millions.
Now, today, we're in the hundreds of millions of wireless access points.
And notice that in the early days of them keeping track of this information, networks were largely
unencrypted.
They did not have WPA EP.
Notice on this chart, there's a legend here that shows the red is unencrypted, the green is encrypted,
and then they break down the green as to whether what percentage of each type of encryption algorithm.
So around 2000.
526, the unencrypted started dropping below the encrypted and then slowly we started increasing the
number of encrypted networks.
So if you fast forward all the way to today, you can see that 77% of the networks are encrypted, 18%
are unknown, only 3% are encrypted roughly.
And about of that, 67% are running, too.
There are a few networks still out there with WEP and WPA.
And so how do you find out or how do you submit to this information?
Not only does this have wireless access points, it has Bluetooth devices, it has cell towers.
They also have an app on Android.
Sadly, no iOS app.
But if you want to, you can do an advanced search.
If you log in with an account, you have to first register a new time to get an account from them.
They do track some information.
You can upload data to the site from different types of wireless tools like insider cookies.
Mac Kismet But you have to have a particular type of upload and make sure it's in the appropriate format
for them.
So there's different types of network stumbling tools or network reconnaissance tools, depending on
what your.
Version you're trying to capture.
So if you want to look at this, is there Android app you can go to there?
This is kind of an example of what you would see as you're driving around or walking around with a special
type of antenna.
You can actually capture traffic with their app and then upload it to improve the information.
So the tools, if you want to download the tools, you can download different maps for Google Earth
and different to overlay that with the actual wireless.
Society locations.
There are some other tools written in Python that will do some other things as well.
You can also use their API if you're a developer and you want to utilize their API.
They have a JSON restful API to be able to add functionality.
As well.
So now let's there's lots of different reconnaissance tools.
There's Wi-Fi analyzers, there's smartphone apps, there's many, many different options.
And we'll get into some of those here momentarily.
So bottom line from respect to the cryptographic protocols of wireless, WPA was an interim replacement
for WEP.
It's been deprecated.
WPA two is the current standard, although there are WPA three networks that are popping up.
And then, of course, tip temporal integrity protocol is an older encryption protocol used with WPA.
And then we have CMP, which is based on a yes.
So what's the recommended solution to be used with WPA two?
So how do we secure wireless networks?
Don't use Web use WPA two?
Or if you do use WPA, use it with a yes.
If you have an older router that doesn't support WPA two, might be time for an upgrade.
So let's talk about some of the other wireless terms to understand and important information that.
We'll help you understand wireless networking other than just eight O2 11.
Wireless fidelity.
So we have GSM, which is the global system for mobile communication we have.
D s SS direct sequence spread spectrum.
So the original data signal gets multiplied by some pseudo random noise spreading codes.
Then we have the frequency hop spread spectrum.
This is essentially a method of transmitting radio signals and rapidly switching the carrier among them.
We have the term of BBC, SAS, ID or the basic service set identifier, which is the MAC address of
the wireless access point.
So if you see the BBC ID, that is the MAC address.
The bandwidth is actually just the range of frequencies that the wireless signal is traversing.
And then we have off DRM, orthogonal frequency, division, multiplexing.
This is a method of encoding carrier frequency signals.
Of -- as a method of digital control, digital signal modulation.
You take a single data stream and split it across several narrow band channels at different frequencies.
So the original data streams and bits that will be sent essentially in parallel instead of being sent
in serial.
So the benefit of this is to improve.
Transmission of technology to get cleaner transmission in the early days of DRM was conceived in the
1960s and 1970s with the goal of minimising the interference amongst the different channels.
So it's used not only in Wi-Fi, it's also used in 4G, LTE communications, as well as even TV broadcasting
services.
So direct sequence spread spectrum.
This is a spread spectrum modulation technique, again, to try and reduce overall signal interference.
So the signal gets made wider than the actual information bandwidth.
So how does the signal get transmitted?
The sequence is already known by the receiver, so the transmitter and the receiver can get the same
information and then the receiver can do the other the opposite process to reconstruct the received
signal.
So frequency have spreads spread spectrum and.
Direct sequence spread spectrum are often used in CDMA code division multiple access.
Which is a common.
Time sharing technique amongst multiple cellular providers.
So a DSD and CDMA, a single frequency is used and frequency reuse is not allowed.
The sender has to wait.
If the medium is busy and the power strength is much lower on DSPs.
SS versus frequency helps spread spectrum.
The advantage of frequency hop is that it is often cheaper and it is more common, but spread spectrum.
Eliminates crosstalk.
It has better output with integrity, it reduces noise, and it results in longer operational distances
of wi fi.
So Kelly Lennox is the main operating system for.
Doing wireless penetration testing.
But there are many tools involved, such as aircraft energy.
Aircraft Can is the main tool for exploiting wireless vulnerabilities in Linux.
There are different attacks like WEP, WPA two aircraft can be installed on other Linux distributions.
But as we're focusing on Kelly here, this is what we will we will focus on will briefly just touch
on their aircraft energy website.
So this is the complete set of tools that not only has monitoring, attacking, cracking wep pre shared
keys.
And they have robust instructions if you want to get started either through a Linux distribution.
One of the key things to make sure is if your wireless chipset chipset is compatible with these tools,
some chipsets are not.
So you can go look at the air crack website to see if your chipset is actually compatible.
And you'll have to look at your.
Information.
Certain Linux distributions will have the list of drivers.
There's of course, usually it's going to be some type of arthritis chipset, rather US based cards
or something like that.
You can run the command from within.
Charlie Linux will go ahead and go in here.
So let's go into the home directory.
And if you want to check and see if your wireless chipset is supported, you can get that information
from the LZ USB Dash V command and you can see.
What information you have returned.
Just scroll up because.
So my case, mine is our length technology, our 2870 wireless adapter, that's eight O2, 11 end wireless
LAN.
Gives us a little bit more information about the adapter, the vendor.
Max package size.
So once you get this information, you can also you can also look at the FCC ID as well.
And you have to determine what driver you have.
So in my case, mine is actually an alpha brand wireless adapter and there.
Generally available on many, many different sites like Amazon.
You can get them for not too much.
We can do less the less PCI command TV, and we can see some other information about what modules we
have.
So one important thing to notice that in many cases internal wireless adapters will just not work with
Kali Linux and wireless pen testing.
It's not because the adapter is not supported.
It might be or it might not be because most wireless chipsets do not support packet injection or the
things that we need to be able to do to do a wireless attack.
These are some of the information.
This is how web networking works.
So we can see we have a key store combined with the web key and an initialization vector.
It gets fed into the RC for Cypher to create a key stream that gets exported with some data and gets
fed spit out into the ciphertext.
So you have a WEP encrypted packet.
There's some cyclic redundancy check or a checksum done for integrity checking, but that's the basic
flow of the web networking.
So cracking a web network.
The tools you'll need are Wireshark, the Airplay and Arrow Dump Engine and can enable all which come
with Kali Linux.
This is the basic process.
We start the wireless card and monitor mode.
We test the injection capability, we use Airplay Energy to fake the authentication process, and we
start collecting initialization vectors.
So we can use the wi fi encryption tool to replay packets, and then we run the crack tool to extract
the encryption key.
This is not very difficult and the tools are preloaded with Kali Linux.
So let's go ahead and go over to our.
Kelly Box.
Let's go over to our Kelly Box.
There's some basic commands we'll have to get through besides with once we've figured out that our hardware
is compatible and our wireless adapter is compatible, we have to look at our networking.
So you want to make sure that your wireless device is actually configured?
I've already put my wireless card into monitor mode.
I have an Alpha network and O2 11 BGN long range adapter.
It's model number AWB, U.S. 036 and H.
So I'm going to go ahead and look at my wireless config with the IDB config command and we can see that
mine is in monitor mode and my frequency is 2.412 gigahertz with a power level of 20 DBM.
If I want to look at the man pages for configuring, either b i w config is similar to i have config,
but it's dedicated to the wireless interface.
So you can change the network I.D. You can change the frequency, the channel.
You can even change the mode.
If you want to change it to an ad hoc network, you can change the bitrate depending on whether the
card supports it or not.
If you have multiple transmit towers supported cards, you can change that as well.
Let's go ahead and clear the screen.
And so if I were going to put my wireless card into monitor mode, I would type the error.
Monash Emoji Command and then start and zero.
And it's already started.
So if I just run the command without any arguments, we'll see that I already have my wireless card
in monitor mode, so I'm already ready to start doing.
Capturing.
I can also change my Mac address.
There is a tool called Mac changer or doing that.
If it is not installed in your linux box, you can do an apt get install mac changer.
If I want to change the Mac address from my network interface.
Set it to be something random, some random vendor.
So to further anonymize the activities, of course, I should say that you should not hack wireless
networks that you're not authorized to if you don't have permission.
That is a crime.
And these techniques should not be used to perform nefarious activities.
So if you do the want to change the Mac address, you have to first bring the interface down and then
bring it back up.
You can do that with the I have config command.
I have config and then because it's its own interface wireless LAN zero mine down.
And we brought the interface down.
Now we'll bring it back up with I have config.
Wireless lan zero mine up.
And it takes a second.
And there we can see that it's now back up and we can verify that with my debit config.
Let's go ahead and clear the screen so we can start dumping out the wireless sides or the B side, I
should say, with the aero dump dash energy command.
And we're going to type in wireless land zero man and we'll give it a little bit of time and we should
see our.
Besides populate here momentarily.
Now let's look at how does WPA work?
So WPA Y A5 Protected Access sends a temporal encryption key with an initialization vector and there's
some mixing and some different cipher process.
And eventually you can see here you get out your ciphertext.
The WPA.
You have to because it uses a per key encryption, a per packet encryption key.
They can be cracked using a dictionary attack.
So to crack WPA, you have to stay near the access point to start capturing packets for a small amount
of time, which is enough to capture the authentication handshake.
And you send a authentication attack to essentially disconnect the client and reconnect the client back
to the network so we can try to authenticate and capture the track again.
So once we get that authentication packet, we can then use our crack to brute force the keys.
How does WEP stack up against WPA and WPA two?
So Webb uses the RC for cipher, whereas WPA uses the RC for Cipher with some more functionality, like
a dot one X and the AP.
WPA two also uses ATO 2.1 X with AP and has a automatic key distribution, whereas Webb must be done
manually.
And there's no there's reuse of initialization vectors, which can also cause problems.
Now let's talk about some of the different wireless attack types.
There is the rogue access point which will get into the evil twin attack, which is just another type
of rogue access point.
We'll look at client Ms. Association attacks and we'll look at MAC address spoofing.
So the rogue access point is very similar.
You place your rogue access point near a genuine access point.
And then you essentially try to get people to connect to it.
So the rogue access point could be set to another a different side than the regular society of the organization.
The coffee shop.
The wire.
The airport.
So essentially the hacker will disable the legitimate access point or potentially just blast out the
signal with enough power that it drowns out the legitimate access point signal.
There are jamming devices which can be purchased for not too much money.
To help make this happen.
Essentially, the goal is to get legitimate users to connect to the rogue access point or the evil twin.
Now, the evil twin access point is designed to look very much like the real access point to the victim.
The victim.
Or see something like a Starbucks coffeehouse or.
Something along those lines to be able to.
And try to connect to it so it could be free public Wi-Fi, could be airport Wi-Fi and so on and so
forth.
Let's talk about some of the different the client and disassociation attacks.
So essentially what happens is an attacker will set up a road access point near the target company so
that legitimate corporate users try to connect to it.
Because corporate employees may or may not have training, they will just open up their Wi-Fi and connect
to it.
And now that attacker can essentially see everything that.
They're doing.
So let's talk about some of the different ways in which attackers can perform these types of attacks.
So in normal operation, we have aafp, we have addressed resolution protocol and we have MAC addresses.
And there a switch has to learn.
What systems are connected to what port.
So a switch uses a mac address table to record the MAC addresses and the ports of hosts that the PC
wants to send a frame to.
So a PC one wants to send a frame to PC number two.
So the Mac address, which is ABCD f00-0002.
And the destination frame to send to the switch to the switch switch.
When it receives the frame, it looks at its MAC address table and find out that the destination should
be at port phase zero two.
So the switch then sends the frame to that port.
So for a network spoofing attack or a mac spoofing attack, an attacker will put the second PC's MAC
address as the source address of the frame and send it to the switch.
So the switch thinks that that 002 is that port number three.
And it will update its Mac address table accordingly.
So now on PC, one wants to send information to PC frame two.
According to the Mac address table.
The switch will send all the frames to the attacker instead of its intended recipient.
That's basically how a mac spoofing attack works.
There are other tools like Mac flooding, which can be done on the network or the.
Our player, but they're not really done specifically for wireless networking.
So let's look at some of the different tools we have, Eric Krack, which is the monitoring, attacking,
testing and cracking tool.
We have Kismet which is used for 802 11 sniffing packet capture logging.
It is a client server modular architecture.
The Wi-Fi pumpkin, which has since been deprecated, is no longer being updated, but it is still available
as a Wi-Fi access point.
If you have a Raspberry Pi, you can use this to create the Wi-Fi pumpkin for not too much money and
make a rogue wireless access point yourself.
Then we have burn y firecracker, which is used to crack many different types of wireless networks.
And of course, as part of the wireless cracking process, we need to have a password cracking tool.
So once we sniff the wireless passwords, then we can use the various password cracking techniques.
Of which Kelly alone has many.
So this is our crack energy.
This is the WEP pre shared key cracker.
Once you recover enough WEP keys or WPA two, it can do different methods to essentially recover the
key.
So you can load in capture files, you can load in initialization vector files or even hash cat files,
which is another password cracking tool.
Its main focus is on the different ways of of security, monitoring, replay attacks.
It can also check versions of wi fi cards.
All the tools are at the command line, which takes which allows for heavy scripting.
A lot of the different guys have taken advantage of this.
Primarily aircraft works on Linux, but it also works on OSX and free BSD systems as well.
Then we have kismet.
Kismet as a wireless network and device detector sniffer for driving tool and also a wireless intrusion
detection framework.
Kismet works with Wi-Fi interfaces.
Bluetooth interfaces.
Some software defined radio.
And other specialized CAPTCHA hardware.
It works on Linux access OSX and somewhat.
On Windows ten on the Windows subsystem for Linux Framework Linux.
It'll work with most Wi-Fi cards, Bluetooth interfaces and hardware devices.
So as of April 2020 as the latest version.
And you can read more about this at their Web site.
Then we have fern y firecracker furnace for wireless security auditing and as an attack and software
program written in Python, it can crack WEP, WPA, keys and run other attacks on wireless networks.
It uses the python cute gooey library.
It can crack and recover WEP, WPA or WP keys and run other network based attacks on wireless or Ethernet
networks.
It can do web cracking with fragmentation.
The chop chop attack, our replay or ops attacks.
It can also do dictionary attacks.
And men in the middle and brute force attacks.
Let's go over to our Kelly Box.
And we can look at the.
Various wireless tools.
Under the number six heading, the wireless attack setting and we can click on it and we'll see the
different wireless tools.
Furn Wi-Fi Firecracker Kismet.
Let's go ahead and launch turn and we have to put in a password because in Linux is not run as a root
anymore in the latest update.
So it'll take a moment for it to launch.
Notice when it pops up, there is a professional version of Fern y Firecracker.
We're going to say no.
We're going to select an interface card and we're going to go ahead and scan for access points.
We can see that we have the latest update notice that has some fairly robust tutorials.
If I can zoom out a little bit just to make this a little bit easier.
So to access settings, you can double click anywhere on the main window that you pick what scan you
want to scan for a scandal, pick what channel you want to scan for.
We're just going to say all channels and we're going to go ahead and scan for access points.
Says it's initializing.
And we have they will come back with some wireless access points.
Notice it also tells us what version of aircraft we have installed as well as what version of Python.
And it says it's currently active.
There are some other tools here like cookie hijacking, geolocation tracking.
That's a similar display you would see to Fern for Fern y firecracker as you detect different networks
and it'll add the keys to the database over time.
So let's look at.
The wi fi pumpkin.
It requires at least Python 2.7.
Once you clone the repository, you can run the installer or you can download the Debian package directly
and you'll get the gooey.
Like so.
There are also some Bluetooth hacking tools and blue staffing is the unauthorized access of information
from a wireless device through Bluetooth, often through phones, laptops, PDAs.
This allows you to get things like calendars, contact lists, emails, text messages on some phones.
You can even copy pictures and private videos.
Blue bugging is a form of Bluetooth attack, often caused by a lack of security awareness.
This was developed after the onset of blue jackets and blue staffing similar to blue staffing.
Blue blocking access is and uses all phone features, but is limited by the transmitter power of Bluetooth
radios.
Normally at about 10 to 15 meters.
Blue Log is a Linux Bluetooth scanner which has is designed for more site surveys.
There are even blue honey pots, Bluetooth honey pots written in Java, and there are other devices
like Blue Mojo that can be used for testing Bluetooth with known vulnerabilities.
There was a Bluetooth vulnerability recently called Blue Bourne, which required all Bluetooth devices
to update the latest and greatest version.
Usually, Bluetooth will result in an exploit with the OB X Protocol, which is the Bluetooth protocol.
So we talked about a lot of different things here in the wireless section.
So Wi-Fi Wireless Fidelity refers to ADA 2.11 I triple standards.
We talked about war driving.
We looked at driving around with a wi fi enabled laptop.
We looked at wiggle, we looked at were chalking being drawing symbols in public places to advertise
open Wi-Fi, which is largely gone by the wayside or disappeared altogether.
We talked about war flying, using drones to detect open Wi-Fi networks.
We also looked at the different types of wireless encryption, extensive authentication protocol.
We looked at radius, the triple AA protocols, we looked at WEP, wired equivalent privacy, we looked
at WPA, wi fi protected access, we looked at WPA to the Wi-Fi Protected Access Version two.
We talked about some of the encryption protocols, temporal key integrity protocol, which goes along
with CMP.
We talked about.
Remember that CMP is an improved version of security for WPA two and does work thanks to the advanced
encryption standard.
We talked about the differences of personal versus enterprise versions of wireless.
We talked about different wireless attacks, rogue access points.
We talked about evil twin attacks.
We looked at client association attacks and even Mac spoofing.
Now let's do some practice questions.
I Tripoli 802. 11 defines basic service set as the building block of wireless.
What?
A LAN.
B when protocol.
See.
Man.
Or D all the above.
Answer is a LAN.
So the best ID or the basic service set is the building block for wireless LANs.
What is wired equivalent privacy or WEP?
A security algorithm for Ethernet.
Security algorithm for wireless networks.
Security algorithm for USB connections.
Or D none of the above.
Answer is B wireless networks, weapons wired equivalent privacy, which was designed to provide a similar
level of security to wired networks.
Of course, that did not turn out to be the case.
Thanks to many of the tools we looked at.
And Kelly Lennox.
Question three An attacker drives around a neighborhood with a car and a laptop looking for free Wi-Fi
and uses them to attack servers.
What is this called?
A Wi-Fi gaming.
Be your driving.
Sci fi driving.
Ardi wore chalking.
The answer is be war driving.
So if you have a Wi-Fi-enabled laptop or smartphone or even a Wi-Fi pineapple.
You can perform more driving.
Question for what is a.
A Wi-Fi protected access.
B Wired protected access.
C Wired process access or dh wi fi process access.
Answer is a Wi-Fi protected access.
Ever.
Five.
What is the term used to describe the ability for networking devices from different manufacturers to
communicate effectively?
Answer is a interoperable.
Be accessible.
C portable.
Or D scalable.
The answer is a interoperable or interoperability.
This is the ability for network devices from different manufacturers to communicate.
One of the key things with wireless is to make sure that your chipset is capable of performing various
injection and capturing.
These are some of the different acronyms we talked about.
We talked about wi fi GSM.
Web therapy to you might see Bluetooth or abbreviated Betty the O backs, which is the Bluetooth protocol.
We talked about wireless access points and access points and the different types of networks we talked
about.
P.S. TCP.
And in summary, you should now have a better understanding of wireless networking.
The types of wireless networking, wireless networking terminologies, the different bands of wireless
networks, wireless encryption types, as well as wireless attacks and countermeasures.
So I appreciate your attention in this module.
I hope you learned a lot.
There's a lot to wireless networking, a lot, especially with Kali Linux and all the different tools
and.
Just a disclaimer to use these tools responsibly, not to attack wireless networks.
You do not have permission.
And we'll see you in the next module.