LM 4 Wireless Network Threats Vulnerabilities Dr Lei

LM 4. Wireless Network Threats & Vulnerabilities Dr. Lei Li

Road Map Introduction WLAN Security Mobile Security Evolution of Wireless Network WLAN Overview Mobile Network Overview Infor. Security Essentials WLAN Threats & Vulnerabilities Cellular Network Security WLAN Security Mobile Security Threats WLAN Security Tools Mobile Devices Security Auditing & Risk Analysis 2

Learning Outcomes After this module, a student will be able to: �Describe different types of attackers �Describe the vulnerabilities of WLAN in general �Describe WEP, WPA and WPA 2 and their vulnerabilities. �Explain what’s passive attack and what’s active attack. List two examples of each types attack. �Describe confidentiality, access control, availability, authentication and integrity attacks on WLAN. �Discuss Bluetooth security features �Describe Bluetooth vulnerabilities and threats �Describe threat models of the Ad Hoc wireless network 3

General Profiles of A Cyber Attacker Example Script Kiddie/Skid People interested in or only partially engaged in understanding offensive tools @th 3 j 35 t 3 r, Ed Skodus, Kevin Mitnick, Expert Attackers Activist/Hack Manning, Snowden, tivists Anonymous Motive Curious, Mischievous, Street Cred Various motives, curiosity, money, patriotism, etc. Further a Cause Action Since they don’t know the tools they may be very noisy when attacking and perform a lot of attempts, may have the most harmful consequences Only limited by their imagination, can steal, spy, and sell exploits on the unethical market Reveal Information, further a cause, deface websites, or disrupt progress of opposition Nation States Stuxnet Espionage: Stealing, Disrupting Services Logic Bombs, support law enforcement & military Gain a greater understanding of allies and enemies Terrorists ISIS Defacement of US disabled Veteran websites, DDo. S of power grids, Chemical Changes in Water Further a Cause Infiltrate, destroy data, cause political upheaval, death, manipulate data in order to promote a cause Cybercrime Mafia Money Insider Attacker Current or Former Employee Revenge, could be clueless employees too DOS against financial institutions, steal credentials, sell illegal goods, anything for money, Crime as a Service (Caa. S), Ransomware variants, credit card theft, etc. Destruction of data, altering data, or stealing information

WLAN Vulnerabilities �WLAN-Flexibility, cost-effectiveness, & easy of installation �Use of Radio Frequency �Difficult to contain the signals �Vulnerabilities in security standards �Easy to setup often means more network not properly configured for secure access 5

Security Standards �WEP (Wired Equivalent Privacy) �Created in 1999 by IEEE 802. 11 b �Provide same level of privacy as that of wired LAN � 40/104 bit key are static & IV is short �No effective key management �Encryption algorithm (RC 4) Known flaws �Easy target for cryptanalysis �Shouldn’t be used in today’s WLAN 6

Wi-Fi Protected Access (WPA) �Developed in 2004 by 802. 11 i to address issues of WEP �Use 48 bits TKIP �Add Integrity protection �Enterprise and personal mode �Enterprise mode use EAP and 802. 1 x for access control and authentication �Backward compatible with old device employs WEP �Still uses RC 4 �Vulnerable to dictionary, brute force, and Do. S attacks 7

WPA 2 �Successor to WPA, ratified by IEEE 11 i in 2004 �Most secure security standard available �Replace RC 4 & TKIP with AES and CCMP for encryption and authentication �More seamless roaming �Still have vulnerability 8

Enterprise Mode Vs. Personal Mode �Exist in WPA & WPA 2 �Same encryption algorithms �Different authentication method �Enterprise mode – 802. 1 x, designed for organizations �Personal mode – pre-shared keys, designed for home use 9

http: //searchnetworking. techtarget. com/feature/Wireless-encryptionbasics-Understanding-WEP-WPA-and-WPA 2 10

Attacks to WLAN �Passive attack �Traffic analysis �Active attack �Unauthorized access �Rogue access point 11

Confidentiality Attacks �Traffic analysis �Eavesdropping �Man-in-the-Middle attack �Evil Twin AP 12

Access Control Attacks �War driving �Rogue access point �MAC address spoofing �Unauthorized access 13

Integrity Attack �Session hijacking �Reply attack � 802. 11 frame injection attack � 802. 11 data replay attack � 802. 11 data deletion 14

Availability Attacks �Do. S/ Queensland Do. S �RF Jamming � 802. 11 beacon flood � 802. 11 association flood � 802. 11 de-authentication �Fake SSID �EAPOL flood �AP theft 15

Authentication Attack �Dictionary & brute force �Shared key guessing �PSK cracking �Application login theft �Etc. 16

Bluetooth Security �Security mode 1 �Security mode 2 �Security mode 3 �Security mode 4 17

Bluetooth Threats & Vulnerabilities �Encryption key length negotiate �No user authentication �Much more �Threats �Bluesnarfing �Bluejacking �Bluebugging �Etc. 18

Ad Hoc Wireless Network Threats �Internal threats �External threats �Routing threats 19

Reference �Praphul Chandra, Bulletproof Wireless Security: GSM, UMTS, 802. 11, and Ad Hoc Security, ELSEVIER, 2005. �Jim Doherty, Wireless and Mobile Device Security, Jones & Bartlett Learning, 2016. �https: //www. walshcollege. edu/upload/docs/Cyber. Spring/ Profile%20 of%20 a%20 Cyber%20 Attacker%20 Presentation. pdf �https: //thesai. org/Downloads/Volume 5 No 1/Paper_25 Wireless_LAN_Security_Threats_Vulnerabilities. pdf �http: //nvlpubs. nist. gov/nistpubs/Legacy/SP/nistspecialpu blication 800 -121 r 1. pdf �https: //www. utc. edu/center-information-securityassurance/pdfs/course-paper-5620 -ad-hoc-security. pdf 20