"...Information security and wireless networks?
But aren’t these mutually exclusive concepts?”
From a conversation at the Svyazexpocom-2004 exhibition"

Wireless communication devices based on 802.11x standards are moving very aggressively in the network equipment market today. This is not surprising: ease of use for mobile and quasi-mobile users, organization of commercial and corporate hotspots, “last mile”, connection of local networks (LANs) with each other - all this is not a complete list of reasons for implementing such solutions. Indeed, the number of all kinds of operating 802.11x equipment in the world is impressive: according to J"son & Partners, the number of hot spots alone at the end of 2003 exceeded 43 thousand, and by the end of 2004 it should reach 140 thousand. Russia's share in these indicators is small, but the number of wireless communication networks (including hot spots) is steadily growing in our country.We also note that in our country more than 80% of corporate wireless communication networks are built on the “oldest” and most frequently used equipment - Cisco Aironet.

But it's not just the numbers that are impressive; Much more surprising is the number of misconceptions associated with ensuring secure data transmission in such networks. The range of opinions here is the widest: from complete trust in any equipment and any of its settings to unflattering characteristics of the kind that we cited as an epigraph.

802.11x - susceptibility to external threats

The very essence of wireless data transmission is fraught with the possibility of unauthorized connections to access points, data interception and other troubles. The absence of a cable, which is organizationally easy to protect, creates a feeling of unpleasant openness and accessibility.

It is worth mentioning “non-protocol” threats - they are the basis of the problem. When developing a wireless corporate network, administrators primarily care about high-quality coverage of the office area. Very often, no one simply takes into account that insidious hackers can connect to the network directly from a car parked on the street. In addition, there are situations when, in principle, it is impossible to eliminate the very possibility of “hearing” the transmitted traffic. An example is external antennas. By the way, in the CIS countries connecting LAN offices to each other using wireless is a very popular solution.

An equally dangerous threat is the possibility of equipment theft. If the security policy of a wireless network is based on MAC addresses, then any component (network card, access point) stolen by an attacker instantly makes this network open.

And finally, the problem of “too smart” users. Often, unauthorized connection of access points to LANs is the work of the organization’s employees themselves. Moreover, this is done solely for the convenience of work, sometimes even with good intentions. Of course, these employees also ensure information protection when connecting such devices to the network on their own and do not always imagine the consequences of such “self-defense.”

These and similar problems need to be addressed comprehensively. Let us note right away that organizational measures are not considered within the framework of this article - they are most often selected based on the operating conditions of each specific network. As for technical measures, mandatory mutual authentication of devices and the introduction of active (for example, Observer 8.3, Airopeek NX 2.01, Wireless Sniffer 4.75) and passive (such as APTools 0.1.0, xprobe 0.0.2) control tools give a very good result .

Vulnerability of "old" security methods

The IEEE 802.11 committee has always been involved in protecting data in wireless networks. Unfortunately, the methods used to ensure the security of 802.11x networks at the stage of their initial development (1997-1998) were, to put it mildly, unsuccessful. They included WEP (Wired Equivalent Privacy) encryption and authentication: MAC address-based, Open, and PreShared Key.

Let's consider the listed methods in order. The classic WEP encryption protocol, developed by RSA Data Security, uses a 40-bit key that is added to the generated initialization vector (IV, its length is 24 bits). Using the resulting key, user data and a checksum are encrypted using the RC4 algorithm. Vector IV is transmitted in the clear.

The first disadvantage of this method is that a 40-bit key is not enough for peace of mind. Even DES, with its 56-bit key, has long been recognized as unreliable. The second disadvantage is the immutability of the key; Using a static key simplifies the hacking problem. Since the 40-bit key is unreliable, I would like to change it more often. And finally, the approach to encryption itself is highly questionable. The size of IV is 24 bits, which means that it will be repeated no later than after 5 hours (packet length 1500 bytes, speed 11 Mbit/s).

Nikita Borisov, Ian Goldberg and David Wagner were the first to study this problem, and already in 2001, the first implementations of drivers and programs appeared to cope with WEP encryption. A document describing this vulnerability is published at: http://www.isaac.cs.berkeley.edu/isaac/wep-faq.htm l.

Authentication methods are also not very reliable. For example, it costs nothing to “overhear” the entire authentication procedure by MAC address - after all, MAC addresses in the frame are transmitted unencrypted. If an attacker knows about the accepted authentication method, he is almost ready to enter the network. The most reliable of the listed methods is PreShared Key, but it is only good if it is securely encrypted and regularly replaces high-quality passwords.

It is a common misconception that using a unique Service Set ID (SSID) will prevent unauthorized connections. Alas, the SSID is only suitable for logical division of network devices into groups - nothing more. The only thing you can do with an SSID is confuse a young hacker by using "unprintable" characters. Access points (Access Point, AP), for example, from Cisco Systems, allow you to do this (you can specify the characters included in the SSID in hexadecimal - \xbd\xba).

Thus, if we also take into account the mass of “inquisitive” teenagers with laptops, a wireless communication network inevitably faces the problem of protecting against almost guaranteed WEP attacks.

WEP attacks

The insufficient key length, the lack of key rotation, and the RC4 encryption principle itself, described above, make it possible to organize a very effective passive attack. Moreover, the attacker does not need to perform any actions by which he could be detected; it is enough to simply listen to the channel. In this case, no special equipment is required - a regular WLAN card, purchased for 20-25 dollars, will suffice, as well as a program that will accumulate packets on the hard drive until the values ​​of the IV vector coincide. When the number of packets becomes sufficient (usually from 1 million to 4 million), it is easy to calculate the WEP key. One of the most popular programs for such “exercises” is AirSnort (http://airsnort.shmoo.com). This software works with network cards from Cisco Systems, cards based on NMC Prism-2 (there are quite a few of them), as well as on Orinoco cards or their clones.

A hacker using active attack methods can achieve good results. For example, you can send known data from outside the LAN, say, from the Internet, while simultaneously analyzing how the access point encrypted it. This method allows you to both calculate the key and manipulate the data.

Another active attack method is Bit-Flip attack. The algorithm of actions here is as follows (Fig. 1):

1. We intercept a WEP encrypted frame.
2. We randomly change several bits in the “data” field and recalculate the CRC-32 checksum.
3. We send the modified frame to the access point.
4. The access point will accept the frame at the link layer because the checksum is correct.
5. The access point will try to decrypt the data and respond with a known text, for example: “Your encryption key is incorrect.”
6. Comparing the encrypted and unencrypted text can allow the key to be calculated.

In this article, we will not consider a possible DOS attack on equipment using the DSSS wideband modulation method. This type of equipment includes 802.11b and 802.11a devices operating at low speeds.

Interim conclusions

All of the above suggests that old methods of ensuring security in wireless networks are unreliable; and if the equipment does not allow the implementation of modern solutions for information protection, then the choice of strategies is small: either use the strictest administrative policies (see the sidebar "Administrative measures"), or use IPSec - ESP technology.

IPSec - ESP technology will certainly protect data, but will greatly reduce LAN performance. Still, this technology was developed for global networks, and it is wasteful to use it within a wireless local network. Its use over wireless channels is justified only in the case of connecting branches or other similar solutions.

Modern security requirements, or "Life with Cisco"

For the peace of mind of any user, there are only three issues that need to be addressed for their traffic: confidentiality (data must be securely encrypted), integrity (data must be guaranteed not to be changed by a third party) and authenticity (confidence that the data is received from the correct source).

Authentication

The 802.1x standard is defined as more modern than the 1997-1998 standards. an authentication method that is widely used in various network equipment, including wireless devices. Its fundamental difference from older authentication methods is as follows: until mutual verification is carried out, the user can neither receive nor transmit any data. The standard also provides for dynamic management of encryption keys, which naturally makes a passive attack on WEP more difficult.

For example, a number of developers use the EAP-TLS and PEAP protocols for authentication in their devices, but Cisco Systems (http://www.cisco.com) approaches the problem more “broadly”, offering, along with these, the following for its wireless networks a number of protocols.

Extensible Authentication Protocol - Transport Layer Security(EAP-TLS) is an IETF standard that provides authentication through the two-way exchange of digital certificates.

Protected EAP(PEAP) is still a draft standard by the IETF. It provides for the exchange of digital certificates and additional verification of name and password through a specially created encrypted tunnel.

Lightweight EAP(LEAP) is a proprietary protocol of Cisco Systems. A "lightweight" mutual authentication protocol similar to the two-way Challenge Authentication Protocol (CHAP). Uses a shared key, so requires some intelligence when generating passwords. Otherwise, like any other method, PreShared Key is susceptible to dictionary attacks.

EAP - Flexible Authentication via Secure Tunneling(EAP-FAST) - developed by Cisco based on the IETF draft standard to protect against dictionary attacks and is highly reliable. Requires minimal effort from the administrator for support. The principle of its operation is similar to LEAP, but authentication is carried out over a secure tunnel. The first implementations appeared in April 2004. Supported starting from software versions IOS 12.2(11)JA, VxWorks 12.01T, Cisco Secure ACS 3.2.3.

All modern authentication methods (see table) imply support for dynamic keys, which is good news. However, if we compare all these standards in other respects, the EAP-TLS and PEAP methods seem more cumbersome. And indeed it is. They are more suitable for use in networks built on equipment from various manufacturers.

Features of authentication methods

Index	Way
	LEAP	EAP-FAST	PEAP	EAP-TLS
Support for modern OS	Yes	Yes	Not all	Not all
Software complexity and resource intensity of authentication	Low	Low	Average	High
Difficulty of control	Low*	Low	Average	Average
Single Sign on (single login on Windows)	Yes	Yes	No	Yes
Dynamic Keys	Yes	Yes	Yes	Yes
One-time passwords	No	Yes	Yes	No
Support for user databases not in Microsoft Windows format	No	Yes	Yes	Yes
Fast Secure Roaming	Yes	Yes	No	No
Local authentication capability	Yes	Yes	No	No

The authentication methods developed by Cisco look nicer. What makes them especially attractive is their support for Fast Secure Roaming technology, which allows you to switch between different access points (switching time is approximately 100 ms), which is especially important when transmitting voice traffic. With EAP-TLS and PEAP, re-authentication will take significantly longer and will result in the conversation being dropped. The main disadvantage of LEAP and LEAP-FAST is obvious - these protocols are supported only in Cisco Systems equipment.

Encryption and integrity

Based on 802.11i recommendations, Cisco Systems has implemented the TKIP (Temporal Key Integrity Protocol) protocol, which ensures the change of the PPK (Per Packet Keying) encryption key in each packet and monitoring the integrity of MIC (Message Integrity Check) messages.

The PPK procedure involves changing the IV in each packet. Moreover, encryption is carried out using the hash function value from the IV and the WEP key itself. If we also take into account that WEP keys change dynamically, the encryption reliability becomes quite high.

Ensuring integrity is the responsibility of the MIC procedure. The MIC and SEQuence number fields are added to the generated frame; the sequence number of the packet is indicated in the SEQ field, which allows you to protect against attacks based on repetitions and violations of sequence. A packet with an incorrect sequence number is simply ignored. The 32-bit MIC field contains the hash function value calculated from the values ​​of the 802.11 packet header itself, the SEQ field, and user data (Fig. 2).

Another promising encryption and integrity protocol that has already proven itself in wired solutions is AES (Advanced Encryption Standard). It was developed relatively recently - in October 2001 and has better cryptographic strength compared to DES and GOST 28147-89. AES key length is 128, 192 or 256 bits. As noted, it provides both encryption and integrity.

Note that the algorithm used in it (Rijndael) does not require large resources either during implementation or operation, which is very important for reducing data latency and processor load.

AES already runs on Cisco IOS (k9) starting with 12.2(13)T. Currently, almost all Cisco Systems 802.11g devices are ready to support AES. The online community is awaiting the announcement of the release of this software, but the repeatedly stated deadlines are not met. However, now some clarity has emerged. The company announced that all devices operating in the 802.11g standard can be completely freely equipped with new software, which will certainly appear soon... But only after the ratification of the 802.11i standard. The standard was ratified by IEEE at the end of June (see sidebar "802.11i Standard Ratified"). So we're waiting, sir.

Wi-Fi Protected Access

The Wi-Fi Protected Access (WPA) standard is a set of rules for implementing data protection in 802.11x networks. Since August 2003, WPA compliance has been part of the requirements for equipment certified as Wi-Fi Certified (http://www.wi-fi.org/OpenSection/pdf/Wi-Fi_Protected_Access_Overview.pdf).

Note that the WPA specification includes a slightly modified TKIP-PPK protocol. Encryption is performed on a “mixture” of several keys - the current and subsequent ones. In this case, the length of IV is increased to 48 bits.

WPA also defines message integrity control according to a simplified version of MIC (Michael MIC), which differs from the one described in that the hash function is calculated based on fewer fields, but the MIC field itself is longer - 64 bits. This makes it possible to implement additional information protection measures, for example, tighten the requirements for re-associations, re-authentications, etc.

The specifications also include support for 802.1x/EAP and shared key authentication and, of course, key management.

It is especially pleasing that WPA devices are ready to work with both clients whose equipment supports modern standards, and with clients who are completely unconcerned about their security and use old equipment or software. The author categorically recommends: distribute users with different degrees of security across different virtual LANs and implement your security policy in accordance with this.

Today, provided that modern equipment and software are used, it is quite possible to build a secure and attack-resistant wireless network based on 802.11x standards. To do this, you just need to apply several reasonable postulates to it.

We must remember that a wireless network is almost always connected to a wired one. In addition to the need to protect wireless channels, this fact serves as an incentive to introduce new security methods in wired networks. Otherwise, a situation may arise where the network has fragmented security, which essentially creates a potential security threat.

It is advisable to use equipment that has a Wi-Fi Certified certificate issued later than August 2003, i.e., confirming compliance with WPA.

Many administrators, when installing devices on the LAN, save the manufacturer's default settings. In serious wireless networks this is absolutely unacceptable.

Of course, we need to implement 802.1x/EAP/TKIP/MIC and dynamic key management. If the network is mixed, use virtual local networks. Now almost any serious access point manufacturer supports this technology. And if he doesn’t support it, then you shouldn’t support such a manufacturer by purchasing his equipment. If external antennas are used (for example, when connecting different LANs), VPN virtual private network technology is recommended.

It is worth combining protocol and software methods of protection with administrative ones. It also makes sense to think about implementing Intrusion Detection System (IDS) technology to detect possible intrusions. You can also use the software products described above.

Finally, and most importantly, use common sense when planning a secure wireless network. Remember: any encryption or other manipulation of data inevitably introduces additional delay, increases the amount of service traffic and the load on the processors of network devices. Of course, security is an important factor in modern networks, but it becomes meaningless if user traffic does not receive the proper bandwidth. After all, unfortunately, any networks are created ultimately for users, and not for administrators. However, the topic of QoS in 802.11x wireless networks deserves a separate article.

802.11i standard ratified On June 25, 2004, the Institute of Electrical and Electronics Engineers (IEEE) ratified the long-awaited wireless LAN security standard, 802.11i. Before its adoption, back in 2002, the industry consortium Wi-Fi Alliance proposed using the WPA protocol as an intermediate option. It includes some 802.11i mechanisms, including TKIP encryption and the ability to use the 802.1x user authentication system based on the RADIUS protocol. The WPA protocol exists in two modifications: lightweight (for home users) and including the 802.1x authentication standard (for corporate users). The official 802.11i standard adds to the WPA protocol the requirement to use the AES encryption standard, which provides a level of security that meets the requirements of FIPS Class 140-2 (Federal Information Processing Standard) used in the US government. However, in many existing networks, the AES protocol may require replacement equipment unless it is equipped with special encryption and decryption capabilities. In addition, the new standard has acquired several relatively little-known properties. One of them - key-caching - records information about him unnoticed by the user, allowing him to not enter all the information about himself again when leaving the wireless network coverage area and then returning to it. The second innovation is pre-authentication. Its essence is as follows: from the access point to which the user is currently connected, a pre-authentication packet is sent to another access point, providing this user with pre-authentication even before registering at the new point and thereby reducing authorization time when moving between access points . The Wi-Fi Alliance intends to begin testing devices for compliance with the new standard (also called WPA2) before September of this year. According to its representatives, widespread replacement of equipment will not be necessary. And while WPA1-enabled devices can operate in environments where advanced encryption and RADIUS authentication are not required, 802.11i products can be considered WPA equipment that supports AES.

Wireless networks are not secure. Let me repeat: wireless networks are not secure. Most of the time they are secure enough for most users, but such networks cannot be made completely private.

The simple truth is that a wireless network uses radio signals with a well-defined set of characteristics, so anyone willing to devote enough time and effort to monitoring these signals can likely find a way to intercept and read the data contained within them. If you send sensitive information over a wireless connection, an attacker could copy it. Credit card numbers, account passwords and other personal information are vulnerable.

Encryption and other security methods can make it slightly more difficult to intercept data, but they do not provide complete protection against a truly sophisticated spy. As any police officer can tell you, locks come from honest people, but experienced thieves know how to deal with them. It's easy to find a whole catalog of tools for breaking WEP encryption on the Internet.

Making the situation even more dangerous, many network administrators and home wireless users leave the doors and windows of their networks wide open without taking advantage of the encryption and other security features integrated into every 802.11b wireless point and network node. Login to unsecured private networks is possible in many urban areas and on a large number of local networks. In the spring of 2001, the San Francisco Chronicle reported that a network security expert with a directional antenna mounted on the roof of a van in downtown San Francisco was able to log on to an average of half a dozen wireless networks per block. The number of such networks is growing steadily. A year later, a group of Microsoft employees conducting an "informal test" discovered more than 200 unsecured open access points in a suburban neighborhood network in Seattle. And Tully's Coffee stores report that they are noticing their customers logging onto Wi-Fi networks through hotspots at Starbucks stores across the street.

Simple arithmetic is enough: your access point has a range of 100m or more in all directions, so the signal is likely to extend beyond your property (or the walls of your apartment). A network device in the next room of the building or across the street can most likely detect the network. A laptop or PDA placed in a car parked on the street is also capable of a similar action. If some precautions are not taken, the operator of this device can register on your network, steal files from servers and infiltrate your Internet connection for streaming video or online games.

It is important to understand that we are talking about two different types of wireless security threats. The first is the danger of someone else connecting to your network without your knowledge or permission; the second is the possibility that a sophisticated attacker could steal data as you send and receive it. Each of them is a separate potential problem, and each requires a special method of prevention and protection. While it may be true that none of the currently available tools can provide complete protection, they can make life much more difficult for most casual attackers.

Wireless networks represent a trade-off between security and usability. The obvious benefits of a wireless network connection - fast and easy network access from a laptop or isolated location - come at a cost. For most users, these costs do not outweigh the convenience of a wireless network. But just as you lock your car when you park, you should take similar steps to protect your network and data.

Protecting your network and data

What can you do to protect yourself from outsiders as a wireless network operator? You have two options: you can accept the fact that 802.11b networks are not completely secure, but use the built-in network security features to slow down bad actors; You can forgo the built-in tools and instead use a firewall for isolation.

It is clear that the security features integrated into the 802.11b protocols.

unacceptable for absolute protection of transmitted data. If you've read articles about wireless network security in trade magazines and perused discussions on online forums, it's easy to believe that Wi-Fi networks are as leaky as the proverbial sieve. But this may exaggerate the real threat to your own network. Remember that most people close to stealing your messages or infiltrating your network won't just sit back and wait for you to start transmitting data. And to be completely honest, most of the data sent through your network is actually of no interest. But encryption tools are available on every Wi-Fi network, so you should actually use them.

The more serious threat is not that your communications will be intercepted, but that illegal connections will be created to it. This will allow an unauthorized user to either read files stored on other networked computers or use your broadband Internet connection without your knowledge or permission.

It makes sense to take care of managing your network. If you choose to implement 802.11b security, there are special steps you must follow:

Place your access point in the middle of the building, not next to a window. This will reduce the distance your signals have to travel through walls;

Use WEP (Wired Equivalent Privacy) encryption, available on all 802.11b network nodes. Given enough time and the right equipment, WEP is not difficult to crack, but encrypted packets are still more difficult to read than data sent without encryption. This chapter provides more information about WEP encryption;

Change WEP keys frequently. Extracting WEP encryption keys from a data stream takes time, and every time you change the keys, bad actors trying to steal your data have to start all over again. Changing your keys once or twice a month is not too often;

Do not store WEP keys in an easily accessible place. On a large network, an attempt may be made to store them on a local Web page or in a text file. Do not do that;

Do not use email to transmit WEP keys. If an outsider steals account names and passwords, the thief will receive messages with your new keys before your legitimate users receive them;

Add another layer of encryption such as Kerberos, SSH or VPN on top of the WEP encryption integrated into the wireless network;

Do not use your access point's default SSID. These settings are well known to network hackers;

Change the SSID to something that does not identify your job or location. If an attacker discovers the name BigCorpNet and looks around and sees BigCorp headquarters across the street, they will likely target your network. The same goes for your home network. Don't call it Perkins if that's the name on the outside of your mailbox. Don't use an SSID that sounds like your network contains some sort of enticing information - use an unremarkable name such as an empty field, "network-" or even a string of random characters (W24rnQ);

Change the IP address and password of your access point. The default passwords for most access point configuration tools are easy to find (and often repeated from one vendor to another - tip: don't use "admin"), so they aren't even good enough to protect against your own users, let alone outsiders. intending to use your network for their own purposes;

Disable the SSID Broadcast feature for an access point that allows connections from clients without the correct SSID. This doesn't guarantee that your network will be invisible, but it may help;

Enable the access control feature for your access point. Access control restricts connections to network clients with specified MAC addresses. The access point will refuse connection to any adapter whose address is not in the list. This may not be practical if you want to allow other visitors to use your network, but it is a useful tool for home and small office networks where you know all your potential users. Similar to the "broadcast SSID" feature, this is not a guarantee, but it won't hurt either;

Test your network's security by trying to find it from the street. Grab a laptop with a scanning program running, such as Network Stumbler or a utility that displays the status of your network adapter, and start walking away from the building. If you can detect your network from a block away, so can an outsider. Remember that ill-wishers can use directional antennas with high gain, which increase this distance;

Think of the network as wide open for sharing. Make sure everyone using the network is aware that they are using an insecure system;

Extend file access only to files you actually want to share. Do not open the entire disc. Use password protection for every accessible item;

Use the same security tools that you would use on a wired network. At best, the wireless portion of your LAN is no more secure than the wired portion, so you must take the same precautions. In most cases, the wireless part of the network is much less secure than the wired part;

Consider using a virtual private network (VPN) for added security.

Some experts use a different method to secure a wireless network. They accept the idea that the 802.11b network is insecure, so they don't even try to use the built-in security features. For example, NASA's Advanced Supercomputing Division network security team in California found that "the network itself does not provide strong authentication and tamper protection" and that "802.11b security features only consume resources without providing any real security in return." So it disables all 802.11b security features and uses its own wireless firewall, the Wireless Firewall Gateway (WFG), instead. The WFG is a router that sits between the wireless and the rest of the network, so all network traffic in and out of wireless devices (including Internet access) must go through the gateway.

As an added benefit, this security method keeps the administrative footprint of each package to a minimum, since they do not contain authentication or encryption. This reduces the number of bits in each packet, which increases the effective data transfer rate of the network.

Other wireless network operators use VPNs to control access through their wireless gateways. A VPN adds another layer of point-to-point security to the IP layer (instead of the physical layer where encryption occurs in 802.11b) before the user can surf the network.

Network security is necessary in two cases - a network administrator does not want to allow unauthorized users to enter their network, and individual users do not want anyone to gain access to their personal files. When you log into a shared network, you need to take some precautions against having your files read over the network.

To disable File Sharing(File Access) Before connecting to a shared network, use the following procedure in Windows 95, Windows 98, and Windows ME:

1. B Control Panel(Control Panel) open dialog box Network(Net).

2. Select File and Printer Sharing(Access to files and printers).

3. In the Fi dialog box le and Printer Sharing disable the function I Want to Give Others Access to My Files(Give others access to my files).

Windows 2000 and Windows XP do not have a central place to disable access to files, so you must disable each access individually.

1. Open a window My Computer(My computer).

2. Icons for all your available drives and folders have a hand icon. To disable access, right-click on the icon and select Sharing and Security(Access and Security) in the menu.

3. Disable the feature Share This Folder on the Network(Open access to this folder over the network).

4. Click the button OK(Yes) to close the dialog box.

5. Repeat the process for each available folder or file. Don't forget the folder Shared Documents(General documents).

When returning to your office or home network, you must reverse the procedure to regain access to your files.

Another problem is the danger of a spy tracking data sent over radio communications and stealing confidential information on the fly. This is not as common as having a spy access the network and read files, but it is possible. Encryption and other security tools can make it difficult to decode data, but it's best to treat a Wi-Fi network like you would a cell phone: never send a message or file containing sensitive information.

802.11b Security Tools

The security tools in the 802.11b specifications aren't perfect, but they're better than nothing. Even if you decide not to use them, it's important to understand what they are and how they work before turning them off.

Network name (SSID)

As discussed in Chapter 1, every wireless network has a name. On a network with only one access point, the name is the Basic Service Set ID (BSSID). When a network contains more than one access point, the name becomes an Extended Service Set ID (ESSID). The standard designation for all network names is SSID - the term you will most often see in configuration utilities for wireless access points and clients.

When configuring access points for a network, you must assign an SSID to it. Every access point and network client on the network must use the same SSID. On Windows computers, the SSID of the wireless adapter must also be the workgroup name.

When two or more access points with the same SSID are detected, the user assumes that they are all part of the same network (even if the access points operate on different radio channels) and contacts the access point that provides the strongest or clearest signal. If, due to interference or attenuation, this signal deteriorates, the client will try to move to another access point, which it believes belongs to the same network.

If two different networks with signal overlap have the same name, the client will assume that they are both part of the same network and may attempt to transition. From the user's point of view, such an erroneous transition looks like a complete interruption of the network connection. Therefore, each wireless network that may overlap with another must have a unique SSID.

Exceptions to the unique SSID rule are public and group networks, which provide access only to the Internet and not to other computers or devices on the local network. Such networks often share a common SSID so subscribers can discover and connect to them from multiple locations.

Some access points, including Apple's AirPort Base Station and similar Orinoco systems, have a feature that allows you to choose between "open" and "closed" access. When an access point is configured for public access, it accepts connections from a client whose SSID is set to Any(Any), the same as from devices configured to communicate using the access point's own SSID. When an access point is set to private (Apple calls it a "hidden network"), it only accepts connections whose SSID matches its SSID. This is a good way to protect your network from outsiders, but it only works if every node on the network uses an adapter from Orinoco (the Apple AirPort Card is a proprietary version of the Orinoco adapter). If an adapter made by any other manufacturer tries to connect to a closed access point, it will ignore it, even if the SSID matches.

Network SSID provides a very limited form of access control because you must specify the SSID when setting up your wireless connection. The access point SSID feature is always a text field that accepts whatever name you want to give it. However, many network configuration programs (including the wireless networking tools in Windows XP and those that come with some major brands of network adapters) automatically detect and display the SSID of each active network within their signal range. Therefore, it is not always necessary to know the network SSID before connecting. Sometimes a configuration utility (a network monitor or a scanning program similar to Network Stumbler) will show you the names of each nearby network in a list or menu.

As an example in Fig. Figure 14.1 shows the result of a Network Stumbler scanner at Seattle-Tacoma Airport, where WayPort serves the passenger terminal and MobileStar provides coverage at the American Airlines VIP Club. (MobileStar became part of another service shortly after I made this plan, so the network names have changed, but the service remains the same).

Each access point comes with a default SSID setting. These default settings are well known and published in snooping communities (see, for example, http://www.wi2600.org/mediawhore/nf0/wireless/ssid_defaults). Obviously, the default settings should not be used on any network.

Rice. 14.1

Many access points come with an SSID hiding feature, often called Hidden network or Hidden network. This feature helps prevent some spies from discovering the name of your network, but whenever a new client connects to it or an existing client receives a weak signal, the SSID is broadcast and a program like Kismet detects it. Hiding the SSID may slow down the occasional guest, but does not provide any real security.

WEP encryption

WEP encryption is a feature of every 802.11b system, so it's important to know how it works, even if you choose not to use it. As its name suggests, the original purpose of Wired Equivalent Privacy (WEP) was to provide a level of security for wireless networks comparable to that of a wired network. But there is a very common claim that a network based on WEP encryption is almost as vulnerable to intrusion as a network with absolutely no security. It will protect against the occasional spy, but won't be particularly effective against a persistent burglar.

WEP performs three functions: it prevents unauthorized access to the network, verifies the integrity of each packet, and protects data from ill-wishers. To encrypt data packets, WEP uses a secret encryption key before the network client or access point transmits it, and uses the same key to decode the data after it is received.

When a client tries to communicate with the network using a different key, the result is garbled and ignored. Therefore, WEP settings must be exactly the same on every access point and client adapter on the network. This sounds simple enough, but it gets confusing because vendors use different methods to determine the WEP key size and format. The functions are consistent from brand to brand, but the same settings do not always have the same designations.

How many bits are in your WEP key?

First, the WEP key can be either 64 or 128 bits. 128-bit keys are more difficult to crack, but they also increase the amount of time it takes to transmit each packet.

The confusion between different vendors' implementations arises because 40-bit WEP is the same as a 64-bit WEP key, and a 104-bit key is the same as a 128-bit key. A standard 64-bit WEP key is a string containing an internally generated 24-bit initialization vector and a 40-bit secret key assigned by the network administrator. Some manufacturers' specifications and configuration programs call this "64-bit encryption" and others call it "40-bit encryption". In either case, the encryption scheme remains the same, so an adapter that uses 40-bit encryption is fully compatible with an access point or adapter that uses 64-bit encryption.

Many network adapters and access points also contain a "strong encryption" feature that uses a 128-bit key (which is actually a 104-bit secret key with a 24-bit initialization vector).

Strong encryption is one-way compatible with 64-bit encryption, but is not automatic, so all components of a mixed network of devices with a 128-bit and 64-bit key will work with 64-bit encryption. If the access point and all adapters support 128-bit encryption, use a 128-bit key. But if you want your network to be compatible with adapters and access points that only recognize 64-bit encryption, configure your entire network to use 64-bit keys.

ASCII or hexadecimal key?

But the key length alone is confusing when setting up WEP encryption. Some programs require the key as a string of text characters, while others require it as a hexadecimal number. Others can generate a key from an optional passphrase.

Each ASCII character consists of 8 bits, so a 40-bit (or 64-bit) WEP key contains 5 characters, and a 104-bit (or 128-bit) key consists of 13 characters. In hexadecimal, each number is made up of 4 bits, so a 40-bit key contains 10 hexadecimal characters, and a 128-bit key has 26 characters.

In Fig. In Figure 14.2, which shows the Wireless Setting window for a D-Link access point, the 40-bit Shared Key Security field uses hexadecimal characters and has space for ten characters. The D-Link program contains all ten characters on one line, but some others divide them into five groups of two numbers or into two groups of five numbers.

Rice. 14.2

To a computer, the key looks the same either way, but it's easier to copy the string when it's split into parts.

Many client utilities, such as the Wireless Network Properties dialog box in Windows XP (shown in Figure 14.3), offer a choice of either hexadecimal code or text, so you can use the appropriate format for the access point.

The passphrase is a text string that adapters and access points automatically convert to a string of hexadecimal characters. Since people generally remember meaningful words or phrases more easily than hexadecimal gobbledygook, a passphrase is easier to convey than a hexadecimal string. However, a passphrase is only useful when all adapters and access points on the network are made by the same manufacturer.

Rice. 14.3

What features are present?

Similar to almost all settings in the 802.11b configuration utility, the names of WEP functions are not constant from one program to another.

Some use an open set of features such as “enable WEP encryption,” while others use technical terminology taken from the official 802.11 specification. Open System Authentication is the second variant of the name "WEP Encryption Disabled".

Some access points also provide an optional public key authentication feature that uses WEP encryption, where the network client has the key but unencrypted data is accepted from other network nodes.

Combining hexadecimal and text keys

Setting up a mixed network becomes more complicated when some network nodes only use hexadecimal keys while others require text keys. If this situation occurs on your network, you need to follow the rules below to configure them with WEP:

Convert all text keys to hexadecimal. If the configuration program requires a text key, enter the characters Oh(a zero followed by a lowercase x) before the hexadecimal string. If you are using Apple's AirPort software, instead of Oh At the beginning of the hessadecimal key, you must enter a dollar symbol ( $ );

Make sure all your encryption keys have the correct number of characters;

If things still don't work, read the security sections in the manuals for your network adapters and access points. It is possible that one or more of these devices on the network has some hidden personality trait that you are not aware of.

Changing WEP keys

Many access points and network client adapters can support up to four different 64-bit WEP keys, but only one is active at a time, as shown in Figure 1. 14.4. Other keys are spare keys, which can allow the network administrator to adjust the network's security with a short notice. Adapters and access points that support 128-bit encryption use only one 128-bit WEP key at a time.

Rice. 14.4

On a network where WEP encryption is organized seriously. WEP keys must be changed regularly, according to a schedule. A month is sufficient for a network that does not transmit important data, but for a more serious network, a new key must be installed once or twice a week. Remember to write down your current WEP keys in a safe place.

On a home or small office network, you will most likely change all the WEP keys yourself. Otherwise, the network administrator or security professional should distribute the new WEP keys on paper, in a memo, rather than via email. For an additional level of security on networks using 64-bit encryption, instruct your users to change two keys at a time (not the current default). Send a separate memo notifying users which key has become the new default and when it should change.

A typical weekly instruction might look like this:

Please enter the following new 64-bit WEP keys:

Key 1: XX XX XX XX XX

Key 4: YY YV YY YY YY

Another note a week later will provide the codes for Key 2 and Key 3.

A separate note might say: “Our network will switch to Key 3 at midnight on Tuesday. Please change the default key of your network adapter." To change, choose a time when the fewest number of users are using the wireless network, since any active connection on the access point at the time the keys are changed will be broken and cannot be restored until the keys on the client adapter are changed. Users can enter new keys in advance as alternatives to the current active key and change them with a few clicks when the new key takes effect.

Is WEP protection enough?

Several computer scientists have published reports on WEP encryption, arguing against its use to protect sensitive data. All of them point to serious shortcomings in the theory and practice of cryptography used in the composition of WEP encryption algorithms. These experts are unanimous in their recommendation: Anyone using an 802.11 wireless network should not rely on WEP for security purposes. You need to use other methods to protect your networks.

A team from the University of California, Berkeley, has found numerous flaws in the WEP algorithm that make it vulnerable to at least four different types of attacks:

Passive attacks using statistical analysis to decode data;

Active attacks with the creation of encrypted packets that force the access point to accept false commands;

Attacks by analyzing encrypted packets to create a dictionary, which can then be used to automatically decode data in real time;

Attacks that modify packet headers to redirect data to a destination controlled by the attacker.

The Berkeley report concludes with the unequivocal statement: “WEP security is not equivalent to wired security. Problems with the protocol are the result of a misunderstanding of some of the basics of cryptography and therefore the insecure use of encryption methods."

Researchers from Rice University and AT&T Labs published their own descriptions of their attacks on WEP-encrypted networks (http://www.cs.rice.edu/~astubble/wep), which led them to a similar conclusion: “WEP in 802.11 is completely unsafe." They were able to order and receive the necessary equipment, set up a test bench, develop their attack tool, and successfully obtain a 128-bit WEP key in less than a week.

Both the Berkeley and AT&T Labs reports are written by technical experts, for technical experts, and analyze cryptography. Their arguments are understandable, but their methods presuppose that the ill-wisher has some serious technical knowledge. However, tools for less sophisticated codebreakers can be found just as easily. Both AirSnort (http://airsnort.shmoo.com) and WEPCrack() are Linux programs that monitor wireless network signals and exploit weaknesses in the WEP algorithm to obtain the encryption key.

The developers of AirSnort claim that their program can successfully hack most networks within two weeks. This technology monitors network signals without influencing them, so the network administrator cannot detect the presence of an attack. The program is being released to make the problem worse. If WEP encryption is easy to break, standards groups are forced to either find a way to make it more secure or replace it with a more difficult-to-break option.

To sum it up: keep it simple and encrypt your network data.

Encrypted data is more secure than plaintext transmission, and cracking a WEP key takes time, so WEP adds another (presumably weak) layer of security, especially if you change keys frequently. WEP encryption can't do much to protect you from serious enemies, but it will protect you from random ill-wishers. It's much easier to break into a network that doesn't use encryption (which is what most do), so a hacker who discovers an encrypted signal will likely move on to a target with less security.

Help is on the way

Obviously, a security design with holes large enough to fit a giant digital truck through is almost as bad as no security at all. Successful attacks on WEP encryption and readily available tools to exploit security protocol flaws are causing Wi-Fi Alliance members to seriously consider supporting their license as the de facto standard for wireless networking. Words such as “crisis” are used by them to describe the attention given to these issues.

They want to find a solution before the notoriety of security breaches outweighs the demand for the wireless Ethernet equipment they carefully created and advertised.

The new standards that will solve this problem will be called 802.11i.IEEE. The 802.11 Standards Committee began discussing the problem several months before it became public knowledge. A committee called Task Group i (TGi) is working on a new, improved security specification that will (hopefully) address all of the known weaknesses of WEP encryption standards. The group promises that the new security tools will work automatically and will be compatible with older equipment that does not use the new tools. The research group has a Web site at http://grouper.ieee.Org/groups/802/11/Reports, where you can find meeting information and read some of the technical papers.

The Wi-Fi Alliance wants its members to begin using the TGi product as quickly as possible. This can defuse the situation before it becomes a commercial disaster. Once engineers report a solution, all access point and network adapter manufacturers will integrate the new security methods into their products, and the Alliance will add them to the Wi-Fi certification test suite. Updated software and firmware will ensure compatibility of existing 802.11b products with the new 802.11i protocols.

Access Control

Most access points have a feature that allows the network administrator to restrict access to client adapters from a specified list. If a network device whose MAC address is not in the list of authorized users tries to connect, the access point ignores the request to associate with the network. This method can be effective in preventing strangers from connecting to a wireless network, but it forces the network administrator to keep a complete list of users' adapters and their MAC addresses. Every time a new user wants to connect to the network and every time a legitimate user changes adapters, someone has to add another MAC address to the list. This is feasible in a home or small office network, but can be a big problem for a large enterprise or campus system.

Each access point configuration utility uses a different format for access lists. The manual and on-line documentation supplied with your access point should provide detailed instructions on how to create and use an access control list. The 802.11b standard does not define a maximum ACL size for an access point, so the numbers are distributed throughout the card. Some access points limit the list to several dozen parameters. Others, such as the Proxim Harmony AP Controller, will support up to 10,000 individual addresses. The rest allow an unlimited number. If you plan to use an address list to control access to your network, make sure the access point will handle a list large enough to support all users with sufficient headroom for the future. A rule of thumb is that the access point must allow at least twice the number of MAC addresses compared to the current number of users on your network.

MAC authentication cannot protect against all intrusions, since changing the MAC address is trivial on most network cards: all an attacker has to do is monitor your network traffic long enough to find a valid user and copy his MAC address.

However, this can be a very effective way to slow down the occasional spy.

Authentication: 802.1x standard

Due to security holes in the WEP encryption specification, many wireless network equipment manufacturers and software developers have already adapted the new IEEE standard - 802.1x - to add another layer of security to their networks. The 802.1x standard defines a framework that can support several different forms of authentication, including certificates, smart cards, and one-time passwords, all of which provide greater security than the access controls integrated into 802.11.

In 802.11 wireless networks, a technology called Robust Security Network is built on top of the 802.1x framework to limit network access to authorized devices.

Most end users should know two things about 802.1x: first, it is integrated into some (but not all) 802.11b hardware and software, including the wireless configuration utility that comes with Windows XP and many modern access points, so it can provide another potential layer of protection; and secondly, it still has serious flaws that a skilled network hacker can exploit to infiltrate a wireless network. The nasty technical details, analyzed by two University of Maryland researchers, are available online at http://www.cs.umd.edu/~waa/1x.pdf.

It seems like a landmark has appeared, doesn't it? Engineers from interested hardware and software companies band together under the banner of a research group

What to do? Is a secure wireless network an unattainable ideal? If you look at wireless security as a game of cat and mouse, it's pretty clear that the mice (spies and network crackers) are the winners. But these mice require advanced knowledge and hardware to overcome existing encryption and authentication tools.

Think of it like the front door of your home: if you leave it wide open, anyone can come in and steal your things, but if you lock the door and latch the windows, it will be much more difficult for a burglar to get inside. A specialist can open the lock, but this will take a lot of time and effort.

Firewalls

If you accept that WEP encryption and 802.1x do not provide adequate wireless security, the next logical step is to find another way to prevent outsiders from accessing your network. You need a firewall.

A firewall is a proxy server that filters all data passing through it to or from the network, depending on a set of rules set by the network administrator. For example, a firewall may filter out data from an unknown source or files associated with a specific source (viruses). Or it may allow all data sent from the local network to the Internet, but only allow specific types of data from the Internet. The most common use of a network firewall is as a gateway to the Internet, as shown in Figure. 14.5. The firewall monitors all data coming and going between the local network on one side and the Internet on the other. This type of firewall is designed to protect computers on a network from unauthorized access from the Internet.

Rice. 14.5

In a wireless network, the firewall may also be located at the gateway between the wireless access points and the wired network. Such a firewall isolates the wireless portion of the network from the wired network, so ill-wishers who connect their computers to the network without permission cannot use the wireless connection to access the Internet or the wired portion of the network. In Fig. Figure 14.6 shows the location of the firewall on a wireless network.

Rice. 14.6

Don't give wireless network invaders a chance

Most people trying to join a wireless network don't worry about other computers; they are interested in free high-speed Internet access. If they can't use your network to download files or connect to their favorite Web pages, they'll likely try to find some other unsecured wireless point. This doesn't mean you should store sensitive data in accessible files on unsecured computers, but if you can limit or deny access to the Internet, you will make your network much less attractive to detractors. A firewall on a wireless network can perform several functions: it acts as a router between the wireless and wired network or as a bridge between the network and the Internet, blocking all traffic from the wireless to the wired side that does not originate from an authenticated user. But it does not interfere with commands, messages, or file transfers made by trusted users.

Since both authorized users and outsiders are on the unsecured side of the firewall, this does not isolate the wireless nodes from one another. An attacker can still access another computer on the same wireless network and read available files, so it is better to disable File Sharing(Access files) on any computer connected to a wireless network.

A wireless firewall must use some type of authentication to allow authorized users through the gateway and filter out all others. If MAC address-based access control is built into 802.11b systems, and the additional authentication in 802.1x is not acceptable, then the external firewall should require each user to enter a login and password before connecting to the Internet.

If your wireless network contains computers running multiple operating systems, the firewall must use a login that works on any platform. The easiest way to accomplish this is to use a Web-based authentication server, such as the one included with the Apache Web Server (http://httpd.apache.org).

NASA uses Apache on a dedicated server to create a Web site that notifies users when they enter an account name and password.

The server uses a Perl/CGI script to compare the login and password with the database. If they are correct, it instructs the server to accept commands and data from the user's IP address. If there is no login in the database or the password is inaccurate, the Apache server displays the “Invalid Username and Password” Web page.

The Apache Web server is available as a Unix application that runs on an old, slow computer with an early Pentium or even 486 CPU, so it's often possible to reuse an old computer that's no longer in daily use as a firewall. Both the Apache application and the Unix operating system are available as open source software, so it should be possible to build an Apache-based firewall at extremely low cost.

If you prefer to use Windows instead of Unix, you have several options. You can use the Windows NT/2000 version of Apache or a commercial utility such as Wireless Enforcer from Sygate (http://www.sygate.com/prodacls/sse/sse_swe_securjty.htm) - Wireless Enforcer works with other elements of the Sygate Secure Enterprise Suite Sygate Security) to assign and verify a unique fingerprint to each authorized user. If outsiders try to connect to the access point without the required fingerprint, the network blocks them.

Isolating your network from the Internet

Not all attacks on a wireless network are carried out over the air. A wireless network requires the same kind of firewall support against Internet attacks as any other network. Many access points contain configurable firewall functionality, but if yours does not, your network must contain one or more of the following firewalls:

Firewall program on each computer;

A separate router or dedicated computer to act as a network firewall;

An integrated security package, such as the Sygate package described in the previous section.

Firewall client programs provide another line of defense against attacks on your network over the Internet. Some of them come from ill-wishers looking for a way to read your files and other resources that you want to hide from the outside world. Others may want to use your computer as a distribution point for spam or infiltration attempts on a computer elsewhere in the world to make the actual resource harder to track. Others distribute viruses or use unwanted programs that take over control of the computer and display intimidating or advertising messages. Plus, an unsecured machine with a lot of unused storage space can be an attractive target for hackers looking to distribute pirated software, music, or video files (don't you think they might be storing that crap on their own computers?).

If you set up a firewall that notifies you when an external computer tries to connect to your network, you'll likely see several intrusion attempts every day.

Access points with firewalls

The simplest option for using a wireless firewall is to use the one built into the access point. Some combine the functions of a wireless access point with a broadband router and an Ethernet switch, so they support both wired and wireless network clients.

As you know, a network router provides translation between a numeric IP address that defines the gateway of a local network, and internal IP addresses that define individual computers within it. A firewall typically blocks all incoming data requests to local network hosts, but this creates problems when you want to use one or more local network computers as file servers. To solve this problem, the firewall includes a virtual server that redirects requests of a certain type to the appropriate computer within the network.

Each request to connect to a server contains a specific port number that determines the type of server. For example, Web servers use port 80 and FTP uses port 21, so these port numbers are part of the access request. When accepting requests to access the server, you must enable the network address translation (NAT) function in the firewall to route these requests to a specified computer within the local network. In Fig. 14.7 the virtual server is configured to use a computer with local IP address 192.168.0.177 as a Web server and 192.168.0.164 as an FTP file server. In table Table 14.1 shows the most common service port numbers.

Table 14.1 Common TCP/IP service port numbers

There are hundreds of other port numbers used on different networks, but most of them you will never see in real use. The official list of assigned ports is at http://www.iana.org/assignments/port-numbers.

Rice. 14.7

NAT translation assumes that the IP addresses of each virtual server should not change from one request to the next. A web server with a current number of 192.168.0.23 should not switch to 192.168.0.47 in a week. This is usually not a problem on a wired network, but on a wireless one, where network clients are connecting and leaving continuously. The DHCP server automatically assigns the next available number to each new client. If one of these users is the location of one of the network service ports, NAT may not detect it. This problem is not very common, since most networks do not use laptops as servers, but it does happen sometimes. The solution is to either disable the DHCP server and assign a permanent IP address to each client, or move the service port to a computer that has a wired connection to the network.

Firewall Software

A wireless gateway firewall on the interface between the access point and the wired portion of your LAN will prevent outsiders from using the network to access the Internet, and an Internet connection firewall will reject attempts to connect to the network from the Internet, but another form of security is needed for a wireless network. If someone is accessing your wireless network without permission, you will want to rid other legitimate computers on the same network of it. This means that you need a client firewall program for each network node.

A client firewall performs the same functions on a computer's network interface that a network or enterprise firewall performs for the entire network. It detects connection attempts on TCP ports and ignores them if they do not match one or more firewall program configuration settings.

Some firewalls are available as a trial version, while others are free for non-commercial users, so you can easily try them on your own system and see which one you like best.

Below are some programs for Windows:

Unix and Linux users also have many firewall features. Most of them were written for use on standalone firewall computers, which are widely used as network gateways, but they can equally act as protection for individual network clients.

In Linux, the firewall is part of the kernel, the user works with it through console utilities - either ipchains or iptables. Both are documented at http:// linuxdoc.org/HOWTO/IPCHAINS-HOWVTO.html and http:// www.netfilter.org/unreliable-guides/packet-filtering-HOWTO respectively. IP Filter is a software package that provides firewall services for FreeBSD and NetBSD systems. The official IP Filter Web site is at http://coombs.anu.edu.au/-avalon, and http://www.obfuscation.org/ipf/ipf-howto.txt has an excellent document on its use. The program can reject or allow any packet passing through the firewall, as well as filter by netmask or host address, implement service port restrictions, and provide NAT translation services.

NetBSD/i386 Firewall is another free Unix firewall.

It runs on any PC with a 486 or higher CPU with a minimum of 8 MB of memory. The NetBSD/i386 Firewall Project home page is at http://www.dubbele.com.

PortSentry is a port scanning tool that integrates into several widely used versions of Linux, including Red Hat, Caldera, Debian, and Turbo Linux. It is available for download at http://www.psionic.com/products/portsentry.html.

Virtual Private Networks

By isolating the connection between network nodes from other network traffic, a VPN can add another layer of protection. A VPN is an encrypted transmission channel that connects two network endpoints through a “data tunnel.” Many network security experts recommend VPN as an effective way to protect a wireless network from ill-wishers and unauthorized users. You can find more information about setting up and using a VPN in the next chapter.

Physical protection

So far we've talked about preventing electronic thieves from gaining access to your network. It is easy enough to access the network using existing hardware that has not yet been configured for it. This is even easier if the attacker has a computer stolen from an authorized user.

Losing a laptop computer is not pleasant. It's even worse to allow a thief to use a stolen computer to retrace the network. As a network operator, you should remind your users that their portable devices are attractive targets for thieves and offer some tips on how to protect them. As a user, you yourself must adhere to the same rules.

The first rule is simple - do not forget that you are wearing a computer. It seems obvious, but taxi drivers in London found approximately 2,900 laptops (and 62,000 mobile phones!) left in cars over a six-month period. Countless others have been abandoned in airplanes, hotel rooms, commuter trains and conference rooms. Do not advertise that you are carrying a computer. Nylon bags with a large "IBM" or "COMPAQ" logo on the side may look fashionable, but they are not as secure as a regular briefcase or shopping bag.

Always carry the computer in your hands or on your shoulder when it is not locked in a closet or storage room. Get distracted for a minute and an experienced thief can steal it. Airport terminals, train stations and hotel lobbies are common locations for theft. Do not leave an unsecured personal computer in the office overnight. Don't let it go through airport scanners. Ask the inspector to inspect it personally or make sure that you can return the computer immediately after it finishes traveling along the conveyor belt. Two people working together can easily detain you and steal your computer before you have it. If someone tries to steal your computer during baggage check, make a fuss and call security for help. Make sure your computers and individual components such as PC cards have ownership labels on the inside and outside.

Security Tracking of Office Property (http://www.stoptheft.com) offers recordable, printed cyanoacrylate adhesive security tags that require 360kg of force to remove, with a permanent "Stolen Property" chemical marking that appears if someone... or delete the shortcut.

If you can convince your customers to use alert devices on their computers, it can increase the chances of them returning. Trackit (http://www.trackit-corp.co m) is a two-part alert device that uses a clip-on transmitter and a miniature receiver located in a computer bag. When the transmitter is more than 12 m from the receiver, the receiver emits a 110 dB siren, which usually causes a thief to drop a stolen bag.

Finally, keep a list of model and serial numbers separate from the devices themselves. You need this information for your insurance claim.

When you discover that one of the computers connected to your network has been lost or stolen, it is important to protect the rest of the network. If possible, change the network SSID, password, and WEP keys as soon as possible. If your network uses a list of MAC addresses to control access, remove the stolen device's MAC address from the list of authorized connections.

Connecting your network to the world

If you are using a wireless network to share the Internet access of a neighborhood network or campus, or want to allow customers and other visitors to connect to your wireless network, you should not use WEP or other security tools to restrict access to known users, but you should still provide some security measures .

Your desire to give people a direct connection to the Internet doesn't mean you want to let them roam other computers on your network; you want to isolate the wireless access points from the rest of your network.

If all the local hosts on your network are wired, the best practice is to place a firewall between the wireless access point and the wired LAN, allowing the access point (and computers connected to it via wireless connections) to connect only to the Internet and not to any of the local hosts wired network, as shown in Fig. 14.8.

However, if some of your home computers use wireless connections, you need to protect them from access by others using the shared part of your network. There are a couple of ways to implement this plan: in Fig. Figure 14.9 shows a wireless network with a software firewall on each home computer, and Fig. 14.10 - a system using two separate wireless networks with different SSIDs connected to the same Internet node. The general rule is to use one or more firewalls to isolate the public part of your network from computers that you don't want exposed to the rest of the world.

Rice. 14.8

Rice. 14.9

Rice. 14.10

Notes:

To centrally control access to files in Windows XP and Windows 2000, right-click the context menu My Computer and select Manage. In the right pane, select a bookmark Shared Folders, then Shares. - Note scientific ed.

The last few years have seen the rise of wireless technology. Wi-Fi networks (802.11a/b/g standard networks) are becoming increasingly popular, and if earlier it was mainly about the use of wireless networks in offices and hot spots, now they are widely used both at home and for deploying mobile phones. offices (offices during business trips). Wireless access points and SOHO class wireless routers are sold especially for home users and small offices, and pocket wireless routers are sold for mobile users. However, when deciding to switch to a wireless network, it should be remembered that at the current stage of development it has one significant drawback - imperfection in terms of security. In this article we will talk about the most vulnerable areas of wireless networks and show with practical examples how they are hacked. The knowledge gained can be successfully used to audit the security of wireless networks, which will allow you to avoid traditional mistakes made when deploying wireless networks. We'll first look at the basic security measures used to protect wireless networks today, and then talk about how they can be overcome by attackers.

Wireless Security Methods

The 802.11a/b/g wireless network standards provide several security mechanisms:

• authentication and data encryption mode using the WEP (Wired Equivalent Privacy) protocol;
• authentication and data encryption mode using the WPA (Wi-Fi Protected Access) protocol;
• filtering by MAC addresses;
• using hidden network identifier mode.

WEP protocol

All modern wireless devices (access points, wireless adapters and routers) support the WEP security protocol, which was originally included in the IEEE 802.11 wireless network specification.

The WEP protocol allows you to encrypt the transmitted data stream based on the RC4 algorithm with a key size of 64 or 128 bits. Some devices also support keys of 152, 256 and 512 bits, but this is rather the exception to the rule. The keys have a so-called static component of 40 and 104 bits in length, respectively, for 64- and 128-bit keys, as well as an additional dynamic component of 24 bits in size, called the Initialization Vector (IV).

At the simplest level, the WEP encryption procedure is as follows. Initially, the data transmitted in the packet is checked for integrity (CRC-32 algorithm), after which the checksum (Integrity Check Value, ICV) is added to the service field of the packet header. Next, a 24-bit initialization vector (IV) is generated, to which a static (40- or 104-bit) secret key is added. The 64- or 128-bit key thus obtained is the initial key for generating the pseudo-random number used to encrypt the data. Next, the data is mixed (encrypted) using the logical XOR operation with a pseudo-random key sequence, and the initialization vector is added to the frame service field.

On the receiving side, the data can be decrypted, since information about the initialization vector is transmitted along with it, and the static component of the key is stored by the user to whom the data is transferred.

The WEP protocol provides two methods of user authentication: Open System (open) and Shared Key (shared). With open authentication, no authentication actually occurs, meaning any user can gain access to the wireless network. However, even in the case of an open system, WEP data encryption is allowed.

WAP protocol

In 2003, another security standard was introduced - WPA, the main feature of which is the technology of dynamic generation of data encryption keys, built on the basis of the TKIP (Temporal Key Integrity Protocol), which is a further development of the RC4 encryption algorithm. Under the TKIP protocol, network devices work with a 48-bit initialization vector (as opposed to the 24-bit WEP vector) and implement rules for changing the sequence of its bits, which eliminates key reuse. The TKIP protocol provides for the generation of a new 128-bit key for each transmitted packet. In addition, cryptographic checksums in WPA are calculated using a new method - MIC (Message Integrity Code). Each frame contains a special eight-byte message integrity code, the verification of which allows you to repel attacks using forged packets. As a result, it turns out that each data packet transmitted over the network has its own unique key, and each wireless network device is endowed with a dynamically changing key.

In addition, the WPA protocol supports encryption using the advanced AES (Advanced Encryption Standard) standard, which has a more secure cryptographic algorithm compared to the WEP and TKIP protocols.

When deploying wireless networks at home or in small offices, a variant of the WPA security protocol based on shared keys - WPA-PSK (Pre Shared Key) - is usually used. In the future, we will consider only the WPA-PSK option, without touching on the WPA protocol options aimed at corporate networks, where user authorization is carried out on a separate RADIUS server.

When using WPA-PSK, a password of 8 to 63 characters is specified in the access point settings and client wireless connection profiles.

MAC Address Filtering

MAC address filtering, which is supported by all modern access points and wireless routers, although not part of the 802.11 standard, is nevertheless considered to improve the security of a wireless network. To implement this function, a table of MAC addresses of wireless adapters of clients authorized to work in this network is created in the access point settings.

Hidden SSID Mode

Another precaution often used in wireless networks is the hidden network identifier mode. Each wireless network is assigned a unique identifier (SSID), which is the name of the network. When a user tries to log into a network, the wireless adapter driver first scans the airwaves for the presence of wireless networks. When using the hidden identifier mode (as a rule, this mode is called Hide SSID), the network is not displayed in the list of available ones and you can connect to it only if, firstly, its SSID is precisely known, and secondly, a profile has been created in advance connection to this network.

Hacking wireless networks

Having familiarized ourselves with the main methods of protecting 802.11a/b/g networks, we will consider ways to overcome them. Note that the same tools are used to hack WEP and WPA networks, so first we will tell you what is included in the attacker’s arsenal.

First of all, we need a laptop with a wireless adapter. The main problem that arises in the process of selecting wireless hacking tools is ensuring compatibility between the wireless adapter chip used by the software and the operating system.

Selecting a wireless adapter

The fact is that most utilities that allow you to hack wireless networks are “tailored” for Linux systems. There are versions of some utilities for Windows XP. However, depending on the wireless adapter chip, certain wireless cards can be used with utilities for both Linux and Windows XP systems, and some wireless adapters can be used with utilities only for Linux or only for Windows XP systems. There are wireless adapters that are not supported by either Linux or Windows XP utilities. In addition, there are chips that, although supported by utilities, work extremely slowly (in terms of capturing and analyzing packets).

The fact is that to perform the task of hacking wireless networks, special (non-standard) drivers for wireless network adapters are required. The standard modes of any wireless adapter are Infrastructure (Basic Service Set, BSS) and ad-hoc (Independent Basic Service Set, IBSS). In Infrastructure mode, each client is connected to the network through an access point, and in ad-hoc mode, wireless adapters can communicate with each other directly, without using an access point. However, both of these modes do not allow the wireless adapter to listen on the air and intercept packets. In both cases, the network adapter will catch packets that are intended only for the network for which it is configured. In order to be able to see other networks (having a hidden ESSID) and capture packets, there is a special monitoring mode (Monitor mode), when switched to which the adapter is not associated with any specific network and catches all available packets. Typically, the drivers supplied by the wireless adapter manufacturer do not support monitoring mode, and in order to enable it, you must install special drivers, often written by a group of third-party developers. It should be immediately noted that for Windows operating systems such special drivers exist only for wireless adapters based on Hermes, Realtek, Aironet and Atheros chips. Driver support for this mode for operating systems of the Linux/BSD family is largely determined by the openness of the specifications for the card, however, the list of supported devices is much wider than for the Windows family. Drivers for Linux/BSD systems with support for monitoring mode can be found for wireless adapters based on the following chipsets: Prism, Orinoco, Atheros, Ralink, Aironet, Realtek, Hermes and Intel, although drivers based on Intel chips are not suitable for all devices.

Currently, all laptops based on Intel Centrino mobile technology have built-in wireless adapters based on Intel chips (IPW2100, IPW2200, IPW2915, IPW3945 chips), but for our purposes these adapters are not suitable - although they are compatible with Linux utilities. used for hacking, these chips work extremely slowly, and are generally incompatible with Windows utilities.

Selecting an operating system

Regarding the choice of operating system, the following recommendations can be given. Linux systems are more preferable for these purposes, since when using Linux the range of possible tools is much wider, and Linux utilities work much faster. But this does not mean that you cannot use Windows XP together with Windows utilities. In the future, we will consider both options for hacking wireless networks - that is, using both Linux and Windows utilities. At the same time, we understand perfectly well that not all users are in a hurry to switch from Windows to Linux. Despite all its shortcomings, Windows OS is much more widespread, and it is much easier to learn for a novice user. Therefore, in our opinion, the optimal option is to use Windows XP as the main operating system on a laptop, and for tasks of hacking a wireless network - Linux Live CD, which runs from a CD and does not require installation on the computer’s hard drive. The best solution in our case would be the BackTrack disk, which is built on the Linux OS (kernel version 2.6.18.3) and contains all the necessary tool packages for hacking networks. An image of this disk can be downloaded from the website using the link: http://www.remote-exploit.org/backtrack.html.

Software set

Traditionally, to hack wireless networks, the aircrack software package is used, which exists in versions for both Windows XP (aircrack-ng 0.6.2-win) and Linux (aircrack-ng 0.7). This package is distributed absolutely free of charge and can be downloaded from the official website www.aircrack-ng.org. There is simply no point in looking for any other utilities, since this package is the best solution in its class. In addition, it (the Linux version, of course) is included in the BackTrack disk.

Hacking Wireless Networks Using a BackTrack Live CD

So, no matter what operating system you have installed on your laptop, we will use the BackTrack boot disk to hack the wireless network. Note that in addition to the tools we need to hack a wireless network, this disk contains many other utilities that allow us to audit networks (port scanners, sniffers, etc.). By the way, such a disk is useful for any system administrator involved in network auditing.

Hacking any wireless network using the BackTrack disk is carried out in three stages (Table 1):

• collecting information about the wireless network;
• packet capture;
• packet analysis.

The first step is to collect detailed information about the wireless network that is being hacked: the MAC addresses of the access point and the active client of the wireless network, the name of the network (network ID) and the type of encryption used. To do this, use the airmon-ng, airodump-ng and Kismet utilities - the first of them is necessary to configure the wireless network adapter driver to monitor the wireless network, and the other two allow you to obtain the necessary information about the wireless network. All of these utilities are already included on the BackTrack disk.

Table 1. Steps to hack a wireless network using the BackTrack Live CD

Stage number	Description	Utilities used	Result
	Collecting wireless network information	airmon-ng airodump-ng Kismet	Access point MAC address, active client MAC address, network type, network ID, encryption type (WEP, WPA-PSK), communication channel number
	Packet interception	airodump-ng Kismet airoplay-ng
	Packet analysis		Key selection	Password selection

The next step is to capture packets using the airodump-ng utility. In the case where WEP encryption is used on the network, it is necessary to collect IV packets containing initialization vectors. If the traffic on the network is low (for example, the client is inactive), then you can additionally use the airoplay-ng utility to increase traffic between the client and the access point.

If the network uses WPA-PSK encryption, then it is necessary to collect packets that contain information about the client authentication procedure on the network (handshake procedure). In order to force the client to undergo the authentication procedure on the network, you can use the airoplay-ng utility to initiate the process of forcibly disconnecting it from the network and then restoring the connection.

At the last stage, the intercepted information is analyzed using the aircrack-ng utility. In the case of WEP encryption, the probability of guessing the key depends on the number of collected IV packets, and WPA-PSK encryption depends on the dictionary used to guess the password.

Practical examples

After a brief description of the procedure for hacking a wireless network, we will move on to consider practical examples with a detailed description of each stage and the utilities used.

In our case, we were dealing with an experimental network consisting of a D-Link DWL-7000AP access point and a network client with a Gigabyte GN-WPEAG wireless PCI adapter.

To hack the network, we used a laptop with a Gigabyte GN-WMAG wireless PCMCIA adapter based on the Atheros chip. Note that when using the BackTrack disk, no additional drivers are required for the Gigabyte GN-WPEAG adapter - everything is already on the disk.

Stage 1. Collecting information about the wireless network

So, at the first stage we need to collect information about the wireless network. We insert the wireless adapter into the laptop and load the operating system from the CD. Then call the console and launch the airmon-ng utility, included in the aircrack-ng package.

This utility allows you to determine the available wireless interfaces and assign the network monitoring mode to one of the available interfaces.

The syntax for using the airmon-ng command is as follows:

airmon-ng ,

where are the options determine the start or stop of the monitoring mode, - the wireless interface being monitored, and the optional parameter specifies the number of the channel in the wireless network that is being monitored.

Initially, the airmon-ng command is specified without parameters, which allows you to get a list of available wireless interfaces. For example, in our case, the response to the airmon-ng command was as follows:

Usage:airmon-ng

Interface Chipset Driver

wifi0 Atheros madwifi-ng

ath0 Atheros madwifi-ng VAP (parent: wifi0)

Selecting wifi0 as the wireless interface, enter the command airmon-ng start wifi0. As a result, we get another interface ath1, which is in monitoring mode (Fig. 1).

Rice. 1. Setting the wireless network monitoring mode

Next, you need to run the airodump-ng utility, which is used both to capture packets in 802.11 wireless networks and to collect information about the wireless network. The syntax for using the command is as follows:

airodump-ng .

Possible command options are shown in the table. 2.

Table 2. Possible options for the airodump-ng command

	Possible meaning	Description
		Save only IV packets
		Use GPS daemon. In this case, the coordinates of the receiving point will also be recorded
Write (or -w)	File name	Specifying the name of the file to be recorded. If you specify only the file name, it will be saved in the program’s working directory
		Record all packets without filtering
	Channel number (1 to 11)	Specifying the channel number. By default, all channels are listened to.
		Specifying the 802.11a/b/g protocol

In our case, the ath1 interface is set to monitoring mode.

However, so far we do not have information about the type of network (802.11a/b/g), the type of encryption on the network, and therefore we do not know which packets need to be intercepted (all or only IV packets). Therefore, initially you should not use options in the airodump-ng command, but only need to specify the interface - this will allow us to collect the necessary information about the network.

Thus, at the first stage we launch the airodump-ng command using the following syntax:

airodump-ng-ath1

This will allow us to obtain the necessary information about the network, namely:

• MAC address of the access point;
• Client MAC address;
• network type;
• Network ESSID;
• encryption type;
• communication channel number.

In our example, by entering the airodump-ng ath1 command, we were able to determine all the necessary network parameters (Fig. 2):

Rice. 2. Gathering information about the network
using the airodump-ng utility

• The MAC address of the access point is 00:0D:88:56:33:B5;
• Client MAC address - 00:0E:35:48:C4:76
• network type - 802.11g;
• Network ESSID - dlinkG;
• encryption type - WEP;
• communication channel number - 11.

Note that the airodump-ng utility allows you to determine the network identifier (ESSID) regardless of whether the access point is set to Hidden SSID mode or not.

To collect information about the network, you can also use the Kismet utility included in the BackTrack disk - unlike airodump-ng, it allows you to collect much more information about the wireless network and in this sense is a complete and best-in-class wireless network analyzer. This utility has a graphical interface (Fig. 3), which greatly facilitates working with it.

Rice. 3. Gathering information about the network
using the Kismet utility

Stage 2: Packet interception

Once detailed information about the wireless network has been collected, you can begin intercepting packets using the same utilities that were used to collect information about the network - airodump-ng or Kismet. However, in this case we will need a slightly different command syntax.

WEP encryption

First, let's consider the option when the network uses WEP encryption. In this case, we need to filter only packets with an initialization vector (IV packets) and write them to a file, which will later be used to select a key.

For example, if it is known that the attacked network is an 802.11g network, it uses WEP encryption and transmission is carried out on channel 11, then the command syntax for intercepting packets could be as follows:

airodump-ng --ivs –w dump --band g --channel 11 ath1

In this example, we write only IV packets to a file called dump. The probability of successful key selection depends on the number of accumulated IV-packets and the length of the key. As a rule, with a key length of 128 bits, it is enough to accumulate about 1-2 million IV packets, and with a key length of 64 bits - on the order of several hundred thousand packets. However, the length of the key is unknown in advance and no utility can determine it. Therefore, for analysis it is desirable to intercept at least 1.5 million packets. In Fig. Figure 4 shows an example of capturing 1,137,637 IV packets in the airodump-ng utility.

Rice. 4. Capture packets using the airodump-ng utility

The number of packets captured is interactively displayed in the airodump-ng utility, and to stop the packet capture process you just need to press the Ctrl+C key combination.

The Kismet utility can also be used to capture packets. Actually, the interception process begins immediately after the utility is launched, and recording is made to a file with the dump extension, which is saved in the working directory of the program. However, unlike the airodump-ng utility, in this case it is impossible to filter only IV packets and set the communication channel number. Therefore, when using the Kismet utility, the efficiency (accumulation rate) of packets is lower, and the number of packets that need to be intercepted should be greater than when using the airodump-ng utility.

Often, when intercepting packets, a situation arises when there is no intensive traffic exchange between the access point and the client, therefore, in order to accumulate the number of packets required for successful network hacking, you have to wait a very long time. However, this process can be accelerated by forcing the client to communicate with the access point using the aireplay-ng utility (Fig. 5). This utility is launched in parallel with the airodump-ng utility, for which you need to launch another console session.

Rice. 5. Using the aireplay-ng utility to initialize traffic
between access point and client

The command syntax is as follows:

aireplay-ng

This command has a very large number of different options, which can be found by running the command without parameters.

For our purposes, the command syntax will look like this:

aireplay –ng -e dlinkG -a 00:0d:88:56:33:b5 -c 00:0f:ea:91:7d:95 --deauth 20 ath1

In this case, the -e dlinkG parameter specifies the wireless network ID; parameter -a 00:0d:88:56:33:b5 - MAC address of the access point; parameter -c 00:0f:ea:91:7d:95 - client MAC address; option --deauth 20 - attack to break the connection (20 times) followed by client authentication. When a client is authenticated, the traffic between it and the access point increases sharply and the number of packets that can be intercepted increases. If necessary, you can increase the number of connection breaks or repeat this command until the required number of packets has accumulated.

WPA-PSK encryption

With WPA-PSK encryption on a wireless network, the packet interception algorithm is slightly different. In this case, we do not need to filter out IV packets, since with WPA-PSK encryption they simply do not exist, but it also makes no sense to capture all packets in a row. Actually, all we need is a small part of the traffic between the access point and the wireless network client, which would contain information about the client authentication procedure on the network (handshake procedure). But in order to intercept the client authentication procedure on the network, it must first be forcibly initiated using the aireplay-ng utility.

Therefore, with WPA-PSK encryption, the packet interception algorithm will be as follows. We open two console sessions and in the first session we run a command to force the network to disconnect followed by re-identification of the client (aireplay-ng utility, deauthentication attack), and in the second session with a pause of one or two seconds we run a command to intercept packets (airodump-ng utility ). The command syntaxes are as follows:

aireplay–ng -e dlinkG -a 00:0d:88:56:33:b5 -c 00:0f:ea:91:7d:95 -deauth 10 ath1

airodump-ng –w dump -band g -channel 11 ath1

As you can see, the syntax of the aireplay-ng command is exactly the same as for WEP encryption, when this command was used to initialize traffic between the access point and the network client (the only difference is that there are fewer deauthentication packets). The airodump-ng command syntax lacks an IV packet filter.

The process of capturing packets needs to continue for only a few seconds, since with the deauthentication attack activated, the probability of capturing handshake packets is almost one hundred percent.

Stage 3: Packet Analysis

At the last stage, the intercepted packets are analyzed using the aircrack-ng utility, which is launched in a console session. Naturally, the syntax of the aircrack-ng command is different for WEP and WPA-PSK encryption. The general command syntax is as follows:

aircrack-ng

Possible command options are presented in table. 3. Note that several files with the extension *.cap or *.ivs can be specified as files containing captured packets (capture file(s)). In addition, when hacking networks with WEP encryption, the airodump-ng and aircrack-ng utilities can be launched simultaneously (two console sessions are used). In this case, aircrack-ng will automatically update the database of IV packages.

Table 3. Possible options for the aircrack-ng command

	Possible meaning	Description
	1 = static WEP, 2 = WPA-PSK	Specifies the type of attack (WEP or WPA-PSK)
		If the option is given, all IV packets with the same ESSID value will be used. This option is also used to hack WPA-PSK networks if the ESSID is not broadcast (hidden network identifier mode)
	Access point MAC address	Selecting a network based on the access point's MAC address
		Hidden operation mode. Information is not displayed until the key is found or the key cannot be found
		For WEP networks, it limits key selection to only a set of numbers and letters
		For WEP networks, limits key guessing to only a set of hexadecimal characters
		For WEP networks, it limits key selection to only a set of numbers
		For WEP networks, specifies the beginning of the key in hexadecimal format. Used to debug the program
	Client MAC address	For WEP networks, sets a packet filter based on the client's MAC address. -m ff:ff:ff:ff:ff:ff is used to collect all IV packets
	64 (for 40-bit key) 128 (for 104-bit key) 152 (for 128-bit key) 256 (for 232-bit key) 512 (for 488-bit key)	For WEP networks, specifies the key length. The default key length is 104 bits
		For WEP networks, indicates the collection of IV packets that have a given key index (from 1 to 4). By default this option is ignored
		The parameter is used when cracking WEP networks - for a 104-bit key the default value is 2, for 40-bit keys - 5. A higher value of this parameter allows you to calculate keys with fewer packets, but over a longer time
		Used when hacking WEP networks. This parameter allows you to exclude specific types of korek attacks (there are 17 types of korek attacks in total)
		Used when hacking WEP networks. Disables searching for the last character in a key
		Used when hacking WEP networks. Allows searching for the last character in a key (default)
		Used when hacking WEP networks. Allows searching for the last two characters in a key
		Used when hacking WEP networks. Prohibits the use of multiple processors in SMP systems
		Used when hacking WEP networks. Allows you to use a special (experimental) type of attack to select a key. Used when standard attacks do not allow finding the key when using more than 1 million IV packets
	Path to dictionary	During a WPA-PSK attack, specifies the path to the dictionary used

When using WEP encryption, the main problem is that we do not know in advance the length of the key used for encryption. Therefore, you can try to try several options for the key length, which is specified by the -n parameter. If this parameter is not specified, then by default the key length is set to 104 bits (-n 128).

If you know some information about the key itself (for example, it consists only of numbers, or only of letters, or only of a set of letters and numbers, but does not contain special characters), then you can use the -c, -t and -h options.

In our case, we used the aircrack-ng command with the following syntax:

aircrack-ng –a 1 –e dlinkG –b 00:0d:88:56:33:b5 –c 00:0f:ea:91:7d:95 –n 128 dump.ivs.

Here, specifying the MAC address of the access point and client, as well as the network ESSID, is redundant, since only one access point and one wireless client were used. However, if there are several clients and there are several access points, then these parameters must also be specified.

As a result, we were able to find a 128-bit key in just 25 s (Fig. 6). As you can see, hacking a network based on WEP encryption is not a serious problem, but it does not always end in success. It may turn out that not enough IV packets have been accumulated to select a key.

Rice. 6. Selection of a 128-bit key
using the aircrack-ng utility

WPA-PSK encryption uses the following command syntax:

aircrack-ng –a 2 –e dlinkG–b 00:0d:88:56:33:b5 –w dict dump.cap.

In this case, the probability of a positive result, that is, the probability of guessing the entire password, depends on the dictionary used. If the password is in the dictionary, it will be found. The dictionary used by the aircrack-ng program must first be mounted in the program’s working folder or the full path to the dictionary must be specified. A selection of good dictionaries can be found on the website www.insidepro.com. If they don’t help, then most likely the password is a meaningless set of characters. After all, dictionaries contain words or phrases, as well as convenient, easy-to-remember keyboard shortcuts. It is clear that there is no arbitrary set of characters in dictionaries. But even in this case there is a way out. Some utilities designed for password guessing can generate dictionaries from a given set of characters and maximum word length. An example of such a program is PasswordPro v.2.2.5.0.

However, we note once again that the probability of hacking a WPA-PSK password is very low. If the password is not specified in the form of any word, but is a random combination of letters and numbers, then it is almost impossible to guess it.

Generalization

To summarize everything that was said above about hacking wireless networks, we will once again list the main stages of this process and the commands used at each of them.

Stage 1. Gathering information about the network:

Airmon-ng start wifi0;

Airodump-ng ath1.

Stage 2. Collecting packages:

• WEP case:

Airodump-ng --ivs -w dump --band g --channel 11 ath1,

Aireplay -ng -e dlinkG -a 00:0d:88:56:33:b5 -c 00:0f:ea:91:7d:95 --deauth 20 ath1

(if there is insufficient traffic. The command is launched in a separate console session);

• WPA-PSC case:

-aireplay-ng -e dlinkG -a 00:0d:88:56:33:b5 -c 00:0f:ea:91:7d:95 --deauth 10 ath1,

Airodump-ng -w dump --band g --channel 11 ath1

(the command is run in a separate console session).

Stage 3. Packet analysis:

• WEP case:

Aircrack-ng -a 1 -e dlinkG -b 00:0d:88:56:33:b5 -c 00:0f:ea:91:7d:95 -n 128 dump.ivs;

• WPA-PSK case:

Aircrack-ng -a 2 -e dlinkG-b 00:0d:88:56:33:b5 -w dict dump.cap.

Hacking wireless networks using the aircrack-ng 0.6.2-win package and Windows XP

As we already noted at the beginning of the article, there is a version of the aircrack-ng package 0.6.2-win supported by the Windows XP operating system. Let us immediately note that the capabilities of the package are not as extensive as compared to its Linux counterpart, and therefore, if there is no strong prejudice against Linux, then it is better to use the option with the BackTrack disk.

The first thing you will have to face when using the Windows version of the aircrack-ng program is the need to replace the standard drivers from the wireless network adapter manufacturer with special drivers that support monitoring and packet interception mode. Moreover, as in the case of the Linux version of the program, the specific version of the driver depends on the chip on which the network adapter is built. For example, when using our Gigabyte GN-WMAG wireless PCMCIA adapter based on the Atheros AR5004 chip, we used driver version 5.2.1.1 from WildPackets.

The procedure for hacking a wireless network using the Windows version of the aircrack-ng package is quite simple and conceptually repeats the procedure for hacking wireless networks using the Linux version of the package. It is traditionally performed in three stages: collecting information about the network, intercepting packets and analyzing them.

To start working with the utility, you need to run the Aircrack-ng GUI.exe file, which has a convenient graphical interface and is, in fact, a graphical shell for all the utilities included in the aircrack-ng 0.6.2-win package. The main program window (Fig. 7) has several tabs, by switching between which you can activate the necessary utilities.

Rice. 7. Main window of the Aircrack-ng GUI utility

To collect the necessary information about the network, you need to go to the airdump-ng tab, after which the airdump-ng 0.6.2 utility will launch in a separate window.

When you run the airdump-ng 0.6.2 program (Fig. 8), a dialog box will open in which you will need to specify the wireless network adapter (Network interface index number), network interface type (o/a) chip, wireless channel number communications (Channel(s): 1 to 14, 0=all) (if the channel number is unknown, then you can scan all channels). In addition, the name of the output file in which the captured packets are stored is specified (Output filename prefix), and it is indicated whether it is necessary to capture all entire packets (CAP files) or only part of the packets with initialization vectors (IVS files) (Only write WEP IVs (y/n)). With WEP encryption, to select a secret key, it is enough to generate only an IVS file, but when using WPA-PSK encryption, you will need a cap file. By default, IVS or CAP files are created in the same directory as the airdump-ng 0.6.2 program.

Rice. 8. Setting up the airdump-ng 0.6.2 utility

After configuring all the options of the airodump-ng 0.6.2 utility, an information window will open, which displays information about detected wireless access points, information about network clients, and statistics of intercepted packets (Fig. 9).

Rice. 9. Information window of the airodump-ng 0.6.2 utility

If there are several access points, statistics will be displayed for each of them.

The first step is to write down the MAC address of the access point, the SSID of the wireless network and the MAC address of one of the clients connected to it (if there are several of them). Then you need to wait until a sufficient number of packets have been intercepted. To stop the packet capture process (utility operation), use the Ctrl+C key combination. Note that the Windows version of the package does not provide methods to forcefully increase traffic between the access point and the network client (remember that the Linux version of the package provides the aireplay-ng utility for this).

The main problem when hacking WPA-PSK networks using the Windows version of the Aircrack-ng GNU 0.6.2 program is that the client initialization procedure on the network must be captured in the CAP file, that is, you will have to sit in ambush with the running airodump-ng program. Once the network client initialization procedure is captured in the CAP file, you can stop the airodump program and begin the decryption process. Actually, in this case there is no need to accumulate intercepted packets, since only packets transmitted between the access point and the client during initialization are used to calculate the secret key.

In the case of WEP encryption, after generating the output IVS file, you can begin to analyze it using the aircrack-ng 0.6.2 utility, to launch which you again need to open the main window of the Aircrack-ng GUI program on the appropriate tab and configure the aircrack-ng utility. With WEP encryption, setting up the utility consists of setting the length of the WEP key, specifying the ESSID of the wireless network, setting the MAC address of the access point, excluding certain types of attacks (RoreK attacks), setting, if necessary, the character set used for the key, and etc. All the same settings are provided here as in the case of the Linux version of this utility. The only difference is that in the Linux version all settings are specified as options on the command line, while in the Windows version a convenient graphical interface is used to configure the utility (Fig. 10).

Rice. 11. Result of IVS file analysis
aircrack-ng 0.6.2 utility

The result of the IVS file analysis is shown in Fig. 11. It is unlikely that the line KEY FOUND! needs comments. Please note: the secret key was calculated in just 1 second!

When using WPA-PSK encryption in the settings of the aircrack-ng 0.6.2 utility, it is necessary to use the CAP file as the output file, and not the IVS file. In addition, you need to specify the path to the dictionary used for hacking, which is pre-installed in the directory with the aircrack-ng 0.6.2 program (Fig. 12).

Rice. 12. Result of ivs file analysis
aircrack-ng 0.6.2 utility

The result of the CAP file analysis is shown in Fig. 13. However, it should be borne in mind that a positive result of the key search is possible only if the password is present in the analyzed dictionary.

Rice. 13. Result of CAP file analysis

Bypassing MAC address filter protection

At the very beginning of the article, we noted that in addition to WEP and WPA-PSK encryption, functions such as hidden network identifier mode and MAC address filtering are often used. These are traditionally classified as wireless security features.

As we have already demonstrated with the aircrack-ng package, you cannot rely on the hidden network identifier mode at all. The airodump-ng utility we mentioned will still show you the network SSID, which can later be used to create a connection profile (unauthorized!) to the network.

Well, if we talk about such a security measure as filtering by MAC addresses, then everything is very simple here. On the Internet you can find quite a lot of different utilities for both Linux and Windows that allow you to replace the MAC address of a network interface. As an example, we can cite the following Windows utilities: SMAC 2.0 (paid utility, http://www.klcconsulting.net/smac), MAC MakeUP (free utility, www.gorlani.com/publicprj/macmakeup/macmakeup.asp - fig 14) or MAC Spoofer 2006 (free utility).

Rice. 14. MAC address spoofing using the MAC MakeUP utility

Having carried out such a substitution, you can pretend to be your own and implement unauthorized access to the wireless network. Moreover, both clients (real and uninvited) will exist quite calmly on the same network with the same MAC address, moreover, in this case the uninvited guest will be assigned exactly the same IP address as the real network client.

conclusions

So, it is not difficult to overcome the entire security system of a wireless network based on WEP encryption. Perhaps many will say that this is irrelevant, since the WEP protocol has long since died - it is not used. It was replaced by the more robust WPA protocol. However, let's not rush to conclusions. This is true, but only partly. The fact is that in some cases, to increase the range of a wireless network, so-called distributed wireless networks (WDS) are deployed based on several access points. The most interesting thing is that such networks do not support the WPA protocol and the only acceptable security measure in this case is the use of WEP encryption. In this case, WDS networks are hacked in exactly the same way as networks based on a single access point. In addition, PDAs equipped with a wireless module also do not support the WPA protocol, so to include a PDA-based client in a wireless network, you must use the WEP protocol in it. Consequently, the WEP protocol will be in demand in wireless networks for a long time.

The examples of hacking of wireless networks that we have considered very clearly demonstrate their vulnerability. If we talk about the WEP protocol, it can be compared to foolproof protection. This is about the same as a car alarm - only it saves you from hooligans. As for such precautions as MAC address filtering and hidden network identifier mode, they cannot be considered as protection at all. Nevertheless, even such means should not be neglected, although only in combination with other measures.

The WPA protocol, although much more difficult to crack, is also vulnerable. However, do not lose heart - not everything is so hopeless. The fact is that the success of hacking a WPA secret key depends on whether it is in the dictionary or not. The standard dictionary we used is just over 40 MB in size, which is generally not that much. After three attempts, we managed to find a key that was not in the dictionary, and hacking the network turned out to be impossible. The number of words in this dictionary is only 6,475,760, which, of course, is very small. You can use dictionaries with a larger capacity, for example, on the Internet you can order a dictionary on three CDs, that is, almost 2 GB in size, but even it does not contain all possible passwords. Indeed, let's roughly calculate the number of passwords from 8 to 63 characters long that can be formed using 26 letters of the English alphabet (case sensitive), ten numbers and 32 letters of the Russian alphabet. It turns out that each symbol can be selected in 126 ways. Accordingly, if we take into account only passwords with a length of 8 characters, then the number of possible combinations will be 1268=6.3·1016. If the size of each word of 8 characters is 8 bytes, then the size of such a dictionary will be 4.5 million terabytes. But these are only combinations of eight symbols! What kind of dictionary will you get if you go through all possible combinations from 8 to 63 characters?! You don’t have to be a mathematician to calculate that the size of such a dictionary will be approximately 1.2·10119 TB.

So don't despair. There is a good chance that the password you are using is not in the dictionary. Simply, when choosing a password, you should not use words that make sense. It is best if it is a random set of characters - something like “FGproukqweRT4j563app”.

Unauthorized access - reading, updating or destroying information without the appropriate authority to do so.

Unauthorized access is carried out, as a rule, by using someone else's name, changing the physical addresses of devices, using information remaining after solving problems, modifying software and information, stealing storage media, installing recording equipment.

To successfully protect your information, the user must have an absolutely clear understanding of possible ways of unauthorized access. The main typical ways to obtain unauthorized information:

· theft of storage media and production waste;

· copying storage media by overcoming security measures;

· disguise as a registered user;

· hoax (disguise as system requests);

· exploiting the shortcomings of operating systems and programming languages;

· use of software bookmarks and software blocks of the “Trojan horse” type;

· interception of electronic radiation;

· interception of acoustic radiation;

· remote photography;

· use of listening devices;

· malicious disabling of protection mechanisms, etc.

To protect information from unauthorized access, the following are used:

1) organizational events;

2) technical means;

3) software;

4) encryption.

Organizational events include:

· access mode;

· storage of media and devices in a safe (floppy disks, monitor, keyboard, etc.);

· restricting access of persons to computer rooms, etc.

Technical means include:

· filters, screens for equipment;

· key to lock the keyboard;

· authentication devices – for reading fingerprints, hand shape, iris, typing speed and techniques, etc.;

· electronic keys on microcircuits, etc.

Software tools include:

· password access – setting user permissions;

· lock the screen and keyboard using a key combination in the Diskreet utility from the Norton Utilites package;

· use of BIOS password protection tools - on the BIOS itself and on the PC as a whole, etc.

Encryption is the transformation (coding) of open information into encrypted information that is inaccessible to outsiders. Methods for encrypting and decrypting messages are studied by the science of cryptology, whose history goes back about four thousand years.

2.5. Protecting information in wireless networks

The incredibly fast pace of implementation of wireless solutions in modern networks makes us think about the reliability of data protection.

The very principle of wireless data transmission includes the possibility of unauthorized connections to access points.

An equally dangerous threat is the possibility of equipment theft. If the wireless network security policy is based on MAC addresses, then a network card or access point stolen by an attacker can open access to the network.

Often, unauthorized connection of access points to a LAN is carried out by enterprise employees themselves, who do not think about protection.

Such problems need to be addressed comprehensively. Organizational measures are selected based on the operating conditions of each specific network. As for technical measures, very good results are achieved by using mandatory mutual authentication of devices and introducing active controls.

In 2001, the first implementations of drivers and programs appeared that could cope with WEP encryption. The most successful one is PreShared Key. But it is only good if there is reliable encryption and regular replacement of high-quality passwords (Fig. 1).

Figure 1 - Algorithm for analyzing encrypted data

Modern protection requirements

Authentication

Currently, in various network equipment, including wireless devices, a more modern authentication method is widely used, which is defined in the 802.1x standard - until mutual verification is carried out, the user can neither receive nor transmit any data.

A number of developers use the EAP-TLS and PEAP protocols for authentication in their devices. Cisco Systems offers the following protocols for its wireless networks, in addition to those mentioned: EAP-TLS, PEAR, LEAP, EAP-FAST.

All modern authentication methods require support for dynamic keys.

The main disadvantage of LEAP and EAP-FAST is that these protocols are supported mainly in Cisco Systems equipment (Fig. 2).

Figure 2 - 802.11x packet structure using TKIP-PPK, MIC and WEP encryption.

Encryption and integrity

Based on Cisco Systems 802.11i recommendations, the TCIP (Temporal Integrity Protocol) protocol has been implemented, which ensures the change of the PPK encryption key (Per Packet Keying) in each packet and monitoring the integrity of MIC messages (Message Integrity Check).

Another promising encryption and integrity protocol is AES (Advanced Encryption Standard). It has better cryptographic strength compared to DES and GOST 28147-89. It provides both encryption and integrity.

Note that the algorithm used in it (Rijndael) does not require large resources either during implementation or operation, which is very important for reducing data latency and processor load.

The security standard for wireless local area networks is 802.11i.

The Wi-Fi Protected Access (WPA) standard is a set of rules that ensure the implementation of data protection in 802.11x networks. Since August 2003, compliance with WPA standards has been a mandatory requirement for equipment certified as Wi-Fi Certified.

The WPA specification includes a modified TKOP-PPK protocol. Encryption is performed using a combination of several keys - the current and subsequent ones. In this case, the length of IV is increased to 48 bits. This makes it possible to implement additional measures to protect information, for example, to tighten the requirements for re-associations and re-authentication.

The specifications include support for 802.1x/EAP, shared key authentication, and, of course, key management.

Table 3 - Methods for implementing security policy

Index
Support for modern OS
Software complexity and resource intensity of authentication
Difficulty of control
Single Sign on (single login on Windows)
Dynamic Keys
One-time passwords

Continuation of table 3

Provided that modern equipment and software are used, it is now quite possible to build a secure and attack-resistant wireless network based on the 802.11x series standards.

Almost always, a wireless network is connected to a wired one, and this, in addition to the need to protect wireless channels, it is necessary to provide protection in wired networks. Otherwise, the network will have fragmented security, which is essentially a security risk. It is advisable to use equipment that has a Wi-Fi Certified certificate, that is, confirming compliance with WPA.

We need to implement 802.11x/EAP/TKIP/MIC and dynamic key management. In the case of a mixed network, VLANs should be used; If there are external antennas, VPN virtual private network technology is used.

It is necessary to combine both protocol and software protection methods, as well as administrative ones.

What could be more important in our time than protecting your home Wi-Fi network :) This is a very popular topic, on which more than one article has been written on this site alone. I decided to collect all the necessary information on this topic on one page. Now we will look in detail at the issue of protecting a Wi-Fi network. I’ll tell you and show you how to protect Wi-Fi with a password, how to do it correctly on routers from different manufacturers, which encryption method to choose, how to choose a password, and what you need to know if you are planning to change your wireless network password.

In this article we will talk exactly about protecting your home wireless network. And about password protection only. If we consider the security of some large networks in offices, then it is better to approach security there a little differently (at least a different authentication mode). If you think that one password is not enough to protect your Wi-Fi network, then I would advise you not to bother. Set a good, complex password using these instructions and don't worry. It is unlikely that anyone will spend time and effort to hack your network. Yes, you can, for example, hide the network name (SSID) and set filtering by MAC addresses, but these are unnecessary hassles that in reality will only cause inconvenience when connecting and using a wireless network.

If you are thinking about protecting your Wi-Fi, or leaving the network open, then there can only be one solution - protect it. Yes, the Internet is unlimited, and almost everyone at home has their own router, but eventually someone will connect to your network. Why do we need this, because extra clients are an extra load on the router. And if it’s not expensive, then it simply won’t withstand this load. Also, if someone connects to your network, they will be able to access your files (if local network is configured), and access to your router settings (after all, you most likely did not change the standard admin password that protects the control panel).

Be sure to protect your Wi-Fi network with a good password with the correct (modern) encryption method. I recommend installing protection immediately when setting up the router. Also, it would be a good idea to change your password from time to time.

If you are worried that someone will hack your network, or has already done so, then simply change your password and live in peace. By the way, since you will still be logging into the control panel of your router, I would also recommend , which is used to enter the router settings.

Proper protection of your home Wi-Fi network: which encryption method to choose?

During the password setting process, you will need to select a Wi-Fi network encryption method (authentication method). I recommend installing only WPA2 - Personal, with encryption algorithm AES. For a home network, this is the best solution, currently the newest and most reliable. This is the kind of protection that router manufacturers recommend installing.

Only under one condition that you do not have old devices that you want to connect to Wi-Fi. If, after setting up, some of your old devices refuse to connect to the wireless network, you can install a protocol WPA (with TKIP encryption algorithm). I do not recommend installing the WEP protocol, as it is already outdated, not secure and can be easily hacked. Yes, and there may be problems connecting new devices.

Protocol combination WPA2 - Personal with AES encryption, this is the best option for a home network. The key itself (password) must be at least 8 characters. The password must consist of English letters, numbers and symbols. The password is case sensitive. That is, “111AA111” and “111aa111” are different passwords.

I don’t know what router you have, so I’ll prepare short instructions for the most popular manufacturers.

If after changing or setting a password you have problems connecting devices to the wireless network, then see the recommendations at the end of this article.

I advise you to immediately write down the password that you will set. If you forget it, you will have to install a new one, or .

Protecting Wi-Fi with a password on Tp-Link routers

Connecting to the router (via cable or Wi-Fi), launch any browser and open the address 192.168.1.1, or 192.168.0.1 (the address for your router, as well as the standard username and password are indicated on the sticker at the bottom of the device itself). Provide your username and password. By default, these are admin and admin. In , I described entering the settings in more detail.

In settings go to the tab Wireless(Wireless mode) - Wireless Security(Wireless Security). Check the box next to the protection method WPA/WPA2 - Personal(Recommended). In the drop down menu Version(version) select WPA2-PSK. On the menu Encryption(encryption) install AES. In field Wireless Password(PSK Password) Enter a password to protect your network.

Setting a password on Asus routers

In the settings we need to open the tab Wireless network, and make the following settings:

• In the "Authentication Method" drop-down menu, select WPA2 - Personal.
• "WPA encryption" - install AES.
• In the "WPA Pre-Shared Key" field, write down the password for our network.

To save the settings, click the button Apply.

Connect your devices to the network with a new password.

Protecting your D-Link router's wireless network

Go to the settings of your D-Link router at 192.168.0.1. You can see detailed instructions. In settings, open the tab WiFi - Security Settings. Set the security type and password as in the screenshot below.

Setting a password on other routers

We also have detailed instructions for ZyXEL and Tenda routers. See the links:

If you haven’t found instructions for your router, then you can set up Wi-Fi network protection in the control panel of your router, in the settings section called: security settings, wireless network, Wi-Fi, Wireless, etc. I think I can find it it won't be difficult. And I think you already know what settings to set: WPA2 - Personal and AES encryption. Well, that's the key.

If you can't figure it out, ask in the comments.

What to do if devices do not connect after installation or password change?

Very often, after installation, and especially after changing the password, devices that were previously connected to your network do not want to connect to it. On computers, these are usually errors “The network settings saved on this computer do not meet the requirements of this network” and “Windows could not connect to...”. On tablets and smartphones (Android, iOS), errors such as “Could not connect to the network”, “Connected, protected”, etc. may also appear.

These problems can be solved by simply deleting the wireless network and reconnecting with a new password. I wrote how to delete a network in Windows 7. If you have Windows 10, then you need to “forget the network” using . On mobile devices, press and hold your network and select "Delete".

If connection problems occur on older devices, then set the WPA security protocol and TKIP encryption in the router settings.