Instructor: Wireless assessment tools. 2 2
In this lesson, we are going to talk about a couple 3 3
of different wireless assessment tools 4 4
that help us detect if there are wireless networks around. 5 5
Now, when we talk about wireless assessment tools, 6 6
these are tools to detect the presence of wireless networks 7 7
to identify what security type 8 8
and configuration those networks are using 9 9
and even try to exploit any weaknesses 10 10
in that security to gain unauthorized access to the network. 11 11
Now, the real benefit of wireless assessment tools 12 12
is they allow us to get information 13 13
about these wireless networks. 14 14
As a network defender, your wireless networks 15 15
are one of the most vulnerable things in your network, 16 16
so you need to understand what vulnerabilities exist 17 17
by going through and conducting assessments against them. 18 18
For example, for somebody to just sniff 19 19
your wireless traffic, it's really easy. 20 20
If I'm close enough to your building, 21 21
I can turn my card into what's known 22 22
as monitor mode or promiscuous mode, 23 23
and if I can do that, 24 24
I can start sniffing 25 25
all your non-unicast traffic immediately 26 26
and start collecting it 27 27
and then I can use that to crack your network password 28 28
and then break onto your network. 29 29
That's the idea of how vulnerable 30 30
these wireless networks are. 31 31
So we have to understand that 32 32
and that's why we have these wireless assessment tools. 33 33
In this lesson, we're going to talk about two main tool suites. 34 34
The first is Aircrack-ng, and the second is Reaver. 35 35
Let's start with Aircrack-ng. 36 36
Aircrack-ng, as a tool suite, is a suite of utilities 37 37
that's designed for wireless network security testing. 38 38
Now the reason we call this a suite of tools 39 39
is because there are actually four tools inside of it. 40 40
There's Airmon-ng, 41 41
which allows us to enable or disable monitor mode 42 42
on our cards. 43 43
There's Airodump-ng, 44 44
which allows us to capture those wireless frames 45 45
that are going across the air 46 46
and we'll be able to identify that information 47 47
of the wireless access point based on its Mac address. 48 48
And we can also identify clients based on their Mac address. 49 49
We also have Aireplay-ng, 50 50
which is going to inject frames 51 51
to perform the attacks to obtain authentication credentials 52 52
for an access point. 53 53
Essentially, I can deauthenticate you from a device 54 54
and then try to reconnect to that device 55 55
when I capture your reauthentication. 56 56
And then we have Aircrack-ng. 57 57
Aircrack-ng allows us to extract the authentication key 58 58
and try to retrieve the plain text version of your password 59 59
for that network. 60 60
Now, lucky for us, Aircrack-ng is really only effective 61 61
against WEP-based networks. 62 62
For a WEP-based network, you can crack that password 63 63
every single time. 64 64
Refusing WPA or WPA2 with a long, strong password, 65 65
it would take a really long time to brute force 66 66
that password. 67 67
So one of your best mitigations here 68 68
is using long, strong passwords, 69 69
especially in a home environment. 70 70
Now, in a corporate environment, 71 71
it is much better for you to use RADIUS authentication. 72 72
RADIUS authentication is a completely effective mitigation 73 73
against tools like Aircrack-ng, 74 74
because by using RADIUS, 75 75
we are no longer going to be vulnerable 76 76
to those password attacks across the network 77 77
because now we're using digital certificates 78 78
as our method of authentication here. 79 79
The next tool I want to talk about is Reaver. 80 80
Now, Reaver is a command-line tool 81 81
that's used to perform brute force attacks 82 82
against WPS-enabled access points. 83 83
Now, what is WPS? 84 84
Well, WPS is the Wi-Fi Protected Setup mechanism. 85 85
If you look at your router 86 86
and on the front of your wireless router, 87 87
you have a button that says WPS. 88 88
And let's say you got a new printer 89 89
and you have a long, strong password for your network. 90 90
Well, it's really a difficult thing 91 91
to start typing in that long, strong password 92 92
into a printer 93 93
when you have to use just up and down arrow keys. 94 94
So they built this thing called WPS. 95 95
Essentially, you push the button on your router, 96 96
you push the button on your printer, 97 97
and if you do both of those within 60 seconds, 98 98
they would auto communicate, 99 99
pass the password back and forth, 100 100
and then they would reconfigure themself. 101 101
This would allow you 102 102
to really quickly and easily set up your network. 103 103
Great for operations, horrible for security. 104 104
The problem is WPS uses a PIN 105 105
and that PIN can be brute forced. 106 106
With WPS, you can do brute force attempts 107 107
against that PIN 108 108
and crack it within several hours, generally. 109 109
The reason is that PIN is only eight digits long. 110 110
In addition to that, 111 111
the way that PIN is actually calculated 112 112
is actually a four plus four number. 113 113
So they actually take that eight-digit PIN 114 114
and break it up into two sets of four. 115 115
So if we want to brute force that, 116 116
we're really only having to try 10,000 combinations 117 117
and 10,000 combinations, 118 118
and my computer can go through 20,000 combinations 119 119
pretty darn quickly. 120 120
And so that's the idea 121 121
of why this is such a weak thing to use. 122 122
Now to mitigate this brute force attack, 123 123
you can mitigate this 124 124
by enabling rate-limiting for PIN authentications. 125 125
Now what does that mean? 126 126
Well, when I try to brute force the PIN here, 127 127
my system's actually going to connect to your access point 128 128
and try PIN, 0001, 129 129
and that's going to try the next PIN, 0002. 130 130
Well, if you put a wait time in between there of 15 seconds 131 131
or 30 seconds or three minutes, 132 132
you can actually have that backup delay, 133 133
and that delay makes it so it takes me infinitely longer 134 134
for me to go and get that password cracked. 135 135
If you have no delay, 136 136
I can get through 10,000 attempts 137 137
in maybe a couple of minutes, 138 138
but if you put in a 30-second delay each time, 139 139
it's now going to take me several hours 140 140
or several days to crack that PIN. 141 141
The problem is, even with doing this mitigation, 142 142
you're just going to frustrate the attacker, 143 143
but if they're determined and you have WPS enabled, 144 144
they are going to get in eventually 145 145
because, again, there's only 10,000 plus 10,000, 146 146
or 20,000 options here for them to be able to guess. 147 147
So what do I recommend? 148 148
If you have WPS, turn it off on your networks. 149 149
It is bad, bad, bad. 150 150
It is a huge vulnerability. 151 151
So make sure you disable WPS on your networks.