-: Wireless attacks. 2 2
In this lesson, we're going to discuss 3 3
the different types of wireless attacks 4 4
that you need to be aware of. 5 5
This includes rogue access points, evil twins, 6 6
deauthentication attacks, password attacks, 7 7
and wireless interception. 8 8
A rogue access point is any wireless access point 9 9
that's been installed on a secure network 10 10
without explicit authorization 11 11
from a local network administrator. 12 12
These are often added by a malicious attacker 13 13
or simply by one of your end users 14 14
who didn't know any better. 15 15
For example, if your office only has a wired network, 16 16
but somebody wanted to add wireless capability 17 17
so they could use their iPad in the office, 18 18
they may go out to the store and buy a wireless access point 19 19
and then connect it to the wall jack in their office. 20 20
Now, this may seem harmless enough, 21 21
but if that wireless access point isn't properly secured 22 22
with a strong password and encryption, 23 23
an attacker can also connect to that access point 24 24
from outside the building 25 25
and now they're going to be fully connected 26 26
to your network, too. 27 27
Another risk with these types of devices 28 28
is that many wireless access points 29 29
sold at the electronic stores 30 30
aren't really wireless access points, 31 31
but instead they're wireless routers or wireless gateways. 32 32
This means that device has a router and a DHCP server in it 33 33
and it's usually enabled by default. 34 34
So when they connect this device, 35 35
they thought it only had an access point, 36 36
but it also has a rogue DHCP server, too. 37 37
Devices like these are added to the network all the time, 38 38
without knowledge of the IT department 39 39
and its system administrators. 40 40
This can lead to many insecure devices 41 41
being all over your network. 42 42
These devices, when we take them all together, 43 43
are known as shadow IT. 44 44
Shadow IT is the use of information technology systems, 45 45
devices, software, applications, or services 46 46
without the explicit approval of the IT department. 47 47
Shadow IT is a major risk to any organization, 48 48
because if the IT department 49 49
doesn't know about these devices, 50 50
how are they supposed to configure them 51 51
and secure them from attacks? 52 52
That's the idea, 53 53
we need to make sure we understand what's out there 54 54
so we can then better protect it. 55 55
Speaking of rogue wireless access points 56 56
being added to your network, 57 57
we also have the threat of evil twins 58 58
in and around our network. 59 59
Now, in an evil twin attack, 60 60
an attacker will set up a wireless access point 61 61
that uses the same name as your own network. 62 62
For example, if you're sitting in Starbucks 63 63
having some coffee and you go to wifi, 64 64
you might see the Starbucks free wifi. 65 65
Now, an attacker can also be sitting there 66 66
with their own wireless access point 67 67
and having it broadcast out the name Starbucks Free Wi-Fi 68 68
with a stronger signal. 69 69
And they're hoping you connect to them 70 70
instead of to Starbucks. 71 71
Now, if you do connect to them, 72 72
their evil twin will still give you access to the internet, 73 73
but it also puts the attacker in a position 74 74
to see and record everything you're doing 75 75
over that wireless connection, 76 76
because you're really connected to them 77 77
and not to Starbucks. 78 78
This is an evil twin. 79 79
And an evil twin is an easy way for an attacker 80 80
to conduct an on path or men in the middle attack. 81 81
The next attack we have is known as a deauthentication, 82 82
or deauth attack. 83 83
Now a deauthentication attack is a type of 84 84
denial of service attack 85 85
that attempts to interrupt communication 86 86
between an end user's client 87 87
and the wireless access point. 88 88
A deauthentication attack is commonly used 89 89
in wireless hacking attacks 90 90
to kick a person off of the network. 91 91
To perform this attack, 92 92
the attacker sends a deauthentication frame 93 93
to the wireless access point 94 94
using the spoofed IP address of their victim, 95 95
which is one of your network clients. 96 96
Then when this happens, 97 97
the client will attempt to reconnect 98 98
and reestablish a connection to the wireless access point 99 99
by conducting a new session establishment and handshake. 100 100
As they do this, 101 101
the attacker can then capture that handshake 102 102
and attempt to crack or break 103 103
the wireless network's password 104 104
from that encrypted handshake. 105 105
Again, this is something you want to be careful of 106 106
and make sure that if you're using a wireless network, 107 107
you're aware of these types of techniques 108 108
because they are extremely common. 109 109
Speaking of password attacks, 110 110
let's talk a little bit more about an attacker 111 111
and how they can crack a password. 112 112
There are really two methods of cracking a password. 113 113
You have a dictionary attack and a brute force attack. 114 114
Now a dictionary attack occurs when an attacker tries to 115 115
guess the password by attempting to check 116 116
every single word or phrase contained within a word list, 117 117
which we call a dictionary. 118 118
Now, an attacker's dictionary 119 119
isn't like the dictionary you used in high school. 120 120
It doesn't just contain real words. 121 121
Many attacker's dictionaries 122 122
contain things like the word password, 123 123
but the A becomes an @ symbol 124 124
and the S becomes a dollar sign. 125 125
When an attacker attempts to crack your password 126 126
using this list, we consider it a dictionary attack. 127 127
The best defense against a dictionary attack 128 128
is to not use anything that looks like a regular word. 129 129
Even if you've already substituted out symbols for letters 130 130
or numbers for letters. 131 131
On the other hand, 132 132
if a dictionary attack isn't successful, 133 133
the attacker can try to do a brute force attack. 134 134
Now, with a brute force attack, 135 135
they're going to try every possible combination 136 136
until they figure out your password. 137 137
For example, 138 138
if your password was something like a four digit pin number, 139 139
the attacker could start out at zero, zero, zero, zero. 140 140
Then they try zero, zero, zero, one. 141 141
Then zero, zero, zero, two, and so on. 142 142
And eventually they'll get to your four digit code 143 143
of five, two, four, six, or whatever it was. 144 144
The thing about a brute force attack 145 145
is they will always be successful, eventually. 146 146
It's just a matter of time. 147 147
Now, the key is to preventing a brute force attack. 148 148
The longer and more complicated your password is, 149 149
the longer it's going to take for an attacker 150 150
to guess it using brute force. 151 151
Now, in addition to a dictionary and a brute force attack, 152 152
we have something known as a hybrid attack 153 153
where we can basically get a few key words about our victim, 154 154
and we enter those to create a small word list. 155 155
Then we use those as part of our brute force attack. 156 156
It's essentially seeding the brute force of it. 157 157
Now this helps focus the brute force attack 158 158
better than just starting out with the letter A 159 159
and moving upwards from there. 160 160
This gives you some way to actually 161 161
cut down the time of brute force attack. 162 162
But again, you have to know some information 163 163
about your target system. 164 164
Next, we need to discuss the concept 165 165
of wireless interception. 166 166
Now, wireless interception is an attack 167 167
that involves capturing wireless data packets 168 168
as they go across the airwaves. 169 169
Since wireless networks operate much like a hub, 170 170
the data is simply floating through the air 171 171
for any attacker to grab. 172 172
To protect this data. 173 173
most wireless networks use wireless encryption technologies 174 174
like AES in the WPA2 standard. 175 175
But even though these packets are encrypted, 176 176
they can still be intercepted and recorded 177 177
using a packet capture. 178 178
Then the attacker can attempt to crack the password offline 179 179
when they have more time 180 180
using a dictionary, brute force or hybrid technique. 181 181
In addition to wireless interception of wifi networks, 182 182
wireless interception can also focus 183 183
on Bluetooth or cellular signals. 184 184
It just becomes a matter of changing the type of 185 185
antenna and radio that you're using 186 186
to conduct that packet capture. 187 187
For example, a Stingray device, 188 188
also known as an IMSI catcher, 189 189
can be used to act like a cellular tower 190 190
and send out signals and get specific devices 191 191
to connect to it. 192 192
The Stingray can then identify what cellular devices 193 193
are being used in an area by clicking location data 194 194
and other identifying information 195 195
about those cellular devices. 196 196
When the cellular devices connect to it, 197 197
the stingray can then capture any data 198 198
that's sent through it, 199 199
essentially performing an on path, 200 200
or man in the middle attack, 201 201
against any cellular device in range. 202 202
These stingray devices were originally developed 203 203
by the US government for use in criminal investigations, 204 204
but some attackers have them, as well. 205 205
Now, your wired networks 206 206
can also be subject to wireless interception, too, 207 207
using specialized techniques 208 208
that are going to be way beyond the abilities 209 209
of a standard network technician. 210 210
But I want to discuss this 211 211
just so you understand the concept. 212 212
If your wired network is using copper wires, 213 213
like an unshielded twisted pair cable, 214 214
those cables actually admit electromagnetic waves 215 215
as the data travels down the cable. 216 216
Now a highly skilled analyst with specialized equipment 217 217
could collect those electromagnetic waves 218 218
and convert them back into ones and zeros 219 219
that are being sent down the copper cable 220 220
as an electrical impulse. 221 221
To capture these signals, 222 222
the attacker would have to be fairly close 223 223
to the copper cable, though, 224 224
usually within about 10 to 12 inches. 225 225
But it is still technically a type of wireless interception. 226 226
All right, as I said, 227 227
this whole area is a very technical area, 228 228
but it's just one of many different types 229 229
of specialized attacks 230 230
that I wanted to make sure you understood existed. 231 231
And so if anybody ever asked you about it, 232 232
you could be aware of it.