wireless security - cs.columbia.edusmb%c2%a0%c2%a0%c2%a0%c2%a0… · wireless security wireless...

Wireless Security

Wireless Security

Wireless Security

Confidentiality

Integrity

WirelessArchitecture

Access Points

Which AP?The Evil TwinAttack

Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving

Network AccessControl

1 / 41

Wireless Security

Wireless Security

Wireless Security

Confidentiality

Integrity


Access Points


Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving


2 / 41

■ What is Wireless Security?■ The usual: confidentiality, integrity,

availability?■ Or Butler Lampson’s “Gold” (Au) standard:

authentication, authorization, audit?■ Both!

Confidentiality

Wireless Security

Wireless Security

Confidentiality

Integrity


Access Points


Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving


3 / 41

■ Obvious danger — it’s easy to intercept traffic■ Obvious countermeasure — cryptography■ But it’s harder to use here than it looks

Integrity

Wireless Security

Wireless Security

Confidentiality

Integrity


Access Points


Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving


4 / 41

■ At first glance, integrity seems ok■ This is radio — how can an attacker change

messages in mid-packet?■ Solution: the “Evil Twin” (or “Sybil”) attack

Wireless Architecture

Wireless Security

Wireless Security

Confidentiality

Integrity


Access Points


Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving


5 / 41

■ The obvious architecture is pure peer-to-peer— each machine has a radio, and talks directlyto any other machine

■ In fact, 802.11 (WiFi) can work that way, butrarely does

■ More common scenario: base stations (alsoknown as access points)

Access Points

Wireless Security

Wireless Security

Confidentiality

Integrity


Access Points


Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving


6 / 41

■ An ordinary wireless node associates with anaccess point (AP)

■ More precisely, it associates with the APhaving a matching network name (if specified)and the strongest signal

■ If another AP starts sending a stronger signal(probably because the wireless node hasmoved), it will reassociate with the new accesspoint

■ All transmissions from the laptop go to theaccess point

■ All transmissions to the laptop come from theaccess point

Which AP?

Wireless Security

Wireless Security

Confidentiality

Integrity


Access Points


Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving


7 / 41

■ Which AP is your laptop associated with?■ Which network (SSID)?■ Many people know neither■ “My ISP is NETGEAR”■ Those who specify anything specify the SSID

The Evil Twin Attack

Wireless Security

Wireless Security

Confidentiality

Integrity


Access Points


Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving


8 / 41

■ Simplest way: carry an access point with you■ Simpler solution: many laptops can emulate

access points■ On Linux, use

iwconfig eth0 mode Master

■ Force others to associate with your laptop, andsend you all their traffic. . .

Why This Works

Wireless Security

Wireless Security

Confidentiality

Integrity


Access Points


Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving


9 / 41

■ Conventionally, we worry about authenticatingthe client to the server

■ Here, we need to authenticate the server tothe client

■ The infrastructure wasn’t designed for that;more important, users don’t expect to checkfor it (and have no way to do so in any event)

■ How do you know what the access point’s keyshould be?

Integrity Attacks

Wireless Security

Wireless Security

Confidentiality

Integrity


Access Points


Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving


10 / 41

■ We now see how to do integrity attacks■ We don’t tinker with the packet in the air, we

attract it to our attack node■ You don’t go through strong security, you go

around it

Availability

Wireless Security

Wireless Security

Confidentiality

Integrity


Access Points


Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving


11 / 41

■ Simple version: black-hole evil twin■ Sophisticated version: battery exhaustion

Black Holes

Wireless Security

Wireless Security

Confidentiality

Integrity


Access Points


Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving


12 / 41

■ Emulate an access point■ Hand out IP addresses■ Do nothing with received packets■ More subtly, drop 10-15% of them —

connections will work, but very slowly

Battery Exhaustion

Wireless Security

Wireless Security

Confidentiality

Integrity


Access Points


Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving


13 / 41

“ Wi-Fi is also a power-hungry technology thatcan cause phone batteries to die quickly in somecases, within an hour or two of talk time.

When you turn on the Wi-Fi it does bring thebattery life down, said Mike Hendrick, director ofproduct development for T-Mobile.”

New York Times, 27 November 2006

Battery Exhaustion

Wireless Security

Wireless Security

Confidentiality

Integrity


Access Points


Why This Works

Integrity Attacks

Availability

Black Holes

Battery Exhaustion

Battery Exhaustion

WEP

War-Driving


14 / 41

■ Send your enemy large “ping” packets■ The reply packets will be just as big — and

transmitting such packets uses a lot of power■ The more you transmit, the more power —

often battery power — you use up

WEP

Wireless Security

WEPWEP — Using aFlawed Cipher in aBad Way for theWrong Application

Datagrams andStream Ciphers

Key Setup

Key Setup for WEP

Cryptanalysis of RC4

IV Replay

Packet Redirection

ChecksumsThe Biggest Flaw inWEPWhat WEP ShouldHave Been

War-Driving


15 / 41

WEP — Using a Flawed Cipher in a

Bad Way for the Wrong Application

Wireless Security



Key Setup

Key Setup for WEP


IV Replay

Packet Redirection


War-Driving


16 / 41

■ It was obvious from the start that some cryptowas needed

■ Choice: WEP — Wireline Equivalent Privacy

for 802.11 netorks■ Many different mistakes■ Case study in bad crypto design

Datagrams and Stream Ciphers

Wireless Security



Key Setup

Key Setup for WEP


IV Replay

Packet Redirection


War-Driving


17 / 41

■ WEP uses RC4 because RC4 is very efficient■ But 802.11 is datagram-oriented; there’s no

inter-packet byte stream to use⇒ Must rekey for every packet

■ But you can’t reuse a stream cipher key ondifferent packets. . .

Key Setup

Wireless Security



Key Setup

Key Setup for WEP


IV Replay

Packet Redirection


War-Driving


18 / 41

Actual Key

RC4

Key stream

Packet

IV Encrypted Packet

Counter

104 bits24 bits

Provisioned Key

Per−Packet Key

Key Setup for WEP

Wireless Security



Key Setup

Key Setup for WEP


IV Replay

Packet Redirection


War-Driving


19 / 41

■ Each WEP node keeps a 24-bit packet counter(the IV)

■ Actual cipher key is configured keyconcatenated with counter

■ Two different flaws. . .■ 2

24 packets isn’t that many — you still get keyreuse when the packet counter overflows

■ RC4 has a cryptanalytic flaw■ But it’s worse than that


Wireless Security



Key Setup

Key Setup for WEP


IV Replay

Packet Redirection


War-Driving


20 / 41

■ In 2001, Fluhrer, Mantin and Shamir showedthat RC4 could be cryptanalyzed if the keyswere “close” to each other — a related key

attack■ Because of the IV algorithm, they are close in

WEP■ Key recovery attacks are feasible and have

been implemented

IV Replay

Wireless Security



Key Setup

Key Setup for WEP


IV Replay

Packet Redirection


War-Driving


21 / 41

■ Suppose you recover the complete plaintext ofa single packet

■ You can generate new packets that use thesame counter

■ Receiving nodes don’t — and can’t — checkfor rapid counter reuse

■ Indefinite forgery!

Packet Redirection

Wireless Security



Key Setup

Key Setup for WEP


IV Replay

Packet Redirection


War-Driving


22 / 41

■ Suppose you know (or can guess) thedestination IP address of a packet

■ Because RC4 is a stream cipher, you can makecontrolled changes to the plaintext by flippingciphertext bits

■ Flip the proper bits to send the packet to youinstead, and reinject it

Checksums

Wireless Security



Key Setup

Key Setup for WEP


IV Replay

Packet Redirection


War-Driving


23 / 41

■ WEP does use a checksum■ However, it’s a CRC rather than a

cryptographic hash■ It’s also unkeyed■ Result: it’s feasible to compensate for plaintext

changes without disturbing the checksum

The Biggest Flaw in WEP

Wireless Security



Key Setup

Key Setup for WEP


IV Replay

Packet Redirection


War-Driving


24 / 41

■ There’s no key management; all users at a sitealways share the same WEP key.

■ (Again, fixed in WPA)⇒ You can’t rekey when the counter overflows⇒ Everyone shares the same key; if it’s

cryptanalyzed or stolen or betrayed, everyoneis at risk

⇒ It’s all but impossible to rekey a site of anysize, since everyone has to change their keyssimultaneously and you don’t have a secureway to provide the new keys

What WEP Should Have Been

Wireless Security



Key Setup

Key Setup for WEP


IV Replay

Packet Redirection


War-Driving


25 / 41

■ Use a block cipher in CBC mode■ Use a separate key per user, plus a key

identifier like the SPI■ Provide dynamic key management■ WPA — WiFi Protected Access — is better

than WEP; WPA2 uses AES.■ (WPA is particularly vulnerable to

password-guessing attacks.)

War-Driving

Wireless Security

WEP

War-Driving

War-Driving

UnprotectedNetworks!

The Consequences


26 / 41

War-Driving

Wireless Security

WEP

War-Driving

War-Driving


The Consequences


27 / 41

■ Put a laptop in network (SSID) scanning mode■ Drive around a neighborhood looking for

access points■ Perhaps include a GPS receiver to log locations■ Detect presence or absence of WEP■ Name from movie “War Games”■ (Commercialized by Skyhook; used by

iPhones!)

Unprotected Networks!

Wireless Security

WEP

War-Driving

War-Driving


The Consequences


28 / 41

■ Statistics show that only O(1/3) use evenWEP

■ The rest tend to be wide open■ Many people don’t change or hide the SSID

The Consequences

Wireless Security

WEP

War-Driving

War-Driving


The Consequences


29 / 41

■ Some incidence of theft of service■ (Is it war-driving a crime? Unclear under US

law)■ Sometimes done to hide criminal activity

Network Access Control

Wireless Security

WEP

War-Driving


No Perimeter

AssociationsAside: IPv6Neighbor Discovery

Tracing Attacks

MAC AddressFiltering

Clayton’s SpoofingAttackWindows XP SP2and Spoofing


Evil Twin Redux

The Gold Standard

Living with Wireless

30 / 41

No Perimeter

Wireless Security

WEP

War-Driving


No Perimeter


Tracing Attacks




Evil Twin Redux

The Gold Standard


31 / 41

■ The fundamental difference: there’s nophysical boundary

■ On a wired net, physical access control cancompensate for lack of technical security

■ Most of the attacks are the same, for wired orwireless nets

■ But physical perimeters let us take shortcuts

Associations

Wireless Security

WEP

War-Driving


No Perimeter


Tracing Attacks




Evil Twin Redux

The Gold Standard


32 / 41

■ Wired nets don’t have a base station thatnodes associate with at layer 2

■ However, ARP attacks can compensate■ ARP attacks are even harder to detect —

there’s no pop-up informing you about localEthernet addresses

Aside: IPv6 Neighbor Discovery

Wireless Security

WEP

War-Driving


No Perimeter


Tracing Attacks




Evil Twin Redux

The Gold Standard


33 / 41

■ Instead of ARP, IPv6 uses a new protocolcalled Neighbor Discovery (ND)

■ Hosts and routers can use Cryptographically

Generated Addresses (CGAs), where (part of)the IP address is a hash of the node’s publickey

■ ND messages can be signed with the host’sprivate key, and verified by the recipient

■ But — what is the proper IP address (andhence public key) of the default router in everyStarbucks hotspot?

Tracing Attacks

Wireless Security

WEP

War-Driving


No Perimeter


Tracing Attacks




Evil Twin Redux

The Gold Standard


34 / 41

■ With wired networks, you can trace an attackto a given switch port

■ With wirless networks, you can trace an attackto a given AP, but the AP might servehundreds or thousands of square meters

■ No good way to trace — all you can do is logand block MAC addresses

MAC Address Filtering

Wireless Security

WEP

War-Driving


No Perimeter


Tracing Attacks




Evil Twin Redux

The Gold Standard


35 / 41

■ Can allow or block endpoints based on MACaddress

■ However – MAC address spoofing is pretty easy■ Evade blocks and/or impersonate accepted

hosts■ What’s accepted? Look for machines that

receive non-SYN TCP packets

Clayton’s Spoofing Attack

Wireless Security

WEP

War-Driving


No Perimeter


Tracing Attacks




Evil Twin Redux

The Gold Standard


36 / 41

■ Impersonate a known-good IP and MACaddress

■ TCP replies will go to the real owner and thefake one

■ The real one will send out a TCP RST packet■ Build a circuit that listens for the bit pattern

of the RST and sends a jam signal instead

Windows XP SP2 and Spoofing

Wireless Security

WEP

War-Driving


No Perimeter


Tracing Attacks




Evil Twin Redux

The Gold Standard


37 / 41

■ With SP2, the built-in firewall blocks mostinbound packets

■ In particular, it only allows in replies tooutbound packets

■ The TCP reply packets don’t match anyoutbound connections

■ TCP never sees the reply, and hence doesn’tgenerate RST

■ No need for Clayton’s attack

Network Access Control

Wireless Security

WEP

War-Driving


No Perimeter


Tracing Attacks




Evil Twin Redux

The Gold Standard


38 / 41

■ Fundamentally, the problem is network accesscontrol

■ We have none with wireless■ Usual solution: let people onto your network,

but require some sort of Web-based login

Evil Twin Redux

Wireless Security

WEP

War-Driving


No Perimeter


Tracing Attacks




Evil Twin Redux

The Gold Standard


39 / 41

■ Set up your evil twin in a hotspot■ Intercept the login session and/or the

registration■ Registration often involves a credit card. . .

The Gold Standard

Wireless Security

WEP

War-Driving


No Perimeter


Tracing Attacks




Evil Twin Redux

The Gold Standard


40 / 41

■ No authentication at the WEP layer;higher-layer authentcation susceptible to eviltwin attack

■ Authorization based on MAC address andWEP key; both are vulnerable

■ Rarely any logging for audit■ Oops. . .


Wireless Security

WEP

War-Driving


No Perimeter


Tracing Attacks




Evil Twin Redux

The Gold Standard


41 / 41

■ For residential use, turn off SSID broadcast■ (Hard to do in an enterprise)■ Put your wireless net outside the firewall■ Use WEP — it’s still (marginally) better than

nothing■ Better yet, use WPA■ Use a VPN■ Use end-to-end crypto■ Check the certificate on registration or login

pages

wireless security - cs.columbia.edusmb%c2%a0%c2%a0%c2%a0%c2%a0… · wireless security wireless...

Documents

FORMAT : A0 C1 C2

Doing History in the Internet Agesmb%c2%a0%c2%a0%c2%a0... · the Freemasons (1829), the Templars (1867), and the Ku Klux Klan (1872) Neither of these two meanings is listed in the

The Crypto Warssmb%c2%a0%c2%a0%c2%a0%c2%a0...The American Black Chamber The US originally did little of this, but learned rapidly during World War I (During the Civil War, the Union

Biometrics; Authentication as a Systems Problemsmb%c2%a0%c2%a0%… · · 2013-09-26the problmes are likely to remain difﬁcult issues for system designers? Steven M. Bellovin

C2%A0… · Created Date: 12/11/2018 2:39:08 PM

Documento1 - transparencia.saltillo.gob.mxtransparencia.saltillo.gob.mx/Articulo%2028/VIII.%c2%a0%c2%a0%c2… · del IMCS, o de quienes el Comité designe, y la decisión será inapetable,

Case Studies in Access Control - cs.columbia.edusmb%c2%a0%c2%a0%c2%a0%c2%a0%c2%a0/cl…Situations Case Studies in Access Control Joint Software Development Situations Roles Permissions

Authentication - cs.columbia.edusmb%c2%a0%c2%a0%c2%a0%c2%a0… · password as the key + This is where the 8-character limit comes from Any decent cryptosystem can resist ﬁnding

Employment and Computers - cs.columbia.edusmb%c2%a0%c2%a0%c2%a0... · Alcatel “merged” with Lucent; Nokia is buying the new ... remained a monopoly—and didn’t drop in price

planificacion wireless -c2

Google versus Chinasmb%c2%a0%c2%a0%c2%a0%c2%… · including from Chinese companies like Huawei. ... • Some of the attacks were directed at dissidents and activists ... they could

Computers, Society, and the Lawsmb%c2%a0%c2%a0%c2%a0%c2%a0... · 2017-04-13 · Recording Electronic) voting machines and Internet voting ... lUse machine learning to make predictions

Program Structure IIsmb%c2%a0%c2%a0%c2%a0%c2%a0... · 2015-11-18 · Linux 2.6 Kernel.17 Commercial code 20–30 ... Windows 7 has cut down on the prompts—but some say that makes

แนวทางการบ าบัดรักษาด้วยเมทาโดนระยะยาวe-lib.ddc.moph.go.th/images/pic_book/68.%C3%A0%C2... · แนวทางการบ

Practical Issues with Intrusion Detectionsmb%c2%a0%c2%a0%c2%a0%c2%a0... · 2006. 11. 14. · Extrusion Detection Simple Logging Log Files Finding Compromised Hosts 3 / 42. Locations

Complex Access Control - cs.columbia.edusmb%c2%a0%c2%a0%c2%a0%c2%… · hTop, Planesi and hSecret, Subsi are not comparable, Steven M. Bellovin September 14, 2010 30. Using this Scheme

Viruses, Worms, and Trojan Horsessmb%C2%A0%C2%A0%C2%A0%C2%A0%… · How do they spread? What can be done about them? Steven M. Bellovin February 9, 2020 2. Worms in Science Fiction

Internet Security: Then and Nowsmb%c2%a0%c2%a0%c2%a0...13 SSL To some extent, a fig leaf: “it's safe to shop here, because your traffic is encrypted” 99.999% of consumers don't

Año 20 Saltillo, Coahuila 10 de junio de 2019 Número 241 ...transparencia.saltillo.gob.mx/Articulo%2028/VII.%C2%A0%C2%A0%C… · Asignación de nomenclatura al Bulevar El Minero,

A Introduction to Modern Cryptographysmb%c2%a0%c2%a0%c2%a0...on the history of cryptography. The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography, Simon

Databases and the Lawsmb%c2%a0%c2%a0%c2%a0... · or more databases Steven M. Bellovin February 11, 2010 4. Scale • Vastly more data is in machine-readable form • A lot of data

Web Server-Side Securitysmb%c2%a0%c2%a0%c2%a0%c2%a0… · Most interesting web sites use server-side scripts: CGI, ASP, PHP, server-side include, etc. Each such script is a separate

Software Complexitysmb%c2%a0%c2%a0%c2%a0%c2%a0%c2%a0/tal… · Why Technologists Oppose Golden Keys • It has nothing to do with dislike of the FBI or the NSA • Technologists can

System Structure - cs.columbia.edusmb%c2%a0%c2%a0%c2%a0... · The Web Server Complex Web Server Web Server Router Router Inverse Proxy/ Load Balancer Load Balancer Proxy/ Inverse

Final Review - cs.columbia.edusmb%c2%a0%c2%a0%c2%a0%c2%a0… · Final Review The Test Conditions Format Material Limits Memory and Virtual Memory Paging File Systems Permissions Device

Voluntary Disclosuressmb%c2%a0%c2%a0%c2%a0%c2%a0...update letting friends know that his unit was preparing to go to a West Bank village near Ramallah: On Wednesday we clean up Qatanah,

Encryp’on, Security, and Privacysmb%c2%a0%c2%a0%c2%a0%c2%a0… · Examples l Incorrectly padding a short message to match the encryp’on algorithm’s requirements has resulted

Authentication - cs.columbia.edusmb%c2%a0%c2%a0%c2%a0%c2%a0… · password as the key (Why not encrypt the password?) + This is where the 8-character limit comes from Any decent cryptosystem

Frank Miller’s Codebooksmb%c2%a0%c2%a0%c2%a0%c2%a0… · Lots of Google and Google books searches; ... memory of it in 1912 when he formulated his maxim? Does the evidence exist

The Cybersecurity Challengesmb%c2%a0%c2%a0%c2%a0%c2%a0...The Problem “Our first observation is that we are hard pressed to say that cyberspace is more secure than it was 35 years

Introduction to Cryptography, Part IIsmb%c2%a0%c2%a0%c2%a0%c2%… · Homomorphic Vs. Non-malleable •Homomorphic encryption ... •How many people need to be in a room for the probability

คู่มือสมัครเข้ารับการศึกษาskmo.moph.go.th/sites/default/files/File_patbook/%C3%A0%C2%B8%… · คู่มือสมัครเข้ารับการศึกษา

Preparing Your Google Cloud VM for W4187smb%c2%a0%c2%a0%c2%a0%c2%a0… · 7. Select No for \Please email me updates ..." unless you actually want email updates on new o erings. 8

Protecting the Internet Against Large-Scale Passive Monitoringsmb%c2%a0%c2%a0%c2%a0%c2%a0… · Types of Attack Passive Attacker just listens Active Attacker transmits messages; may

DISTRIBUTION ONLYsmb%c2%a0%c2%a0%c2%a0%c2%a0... · 2017. 5. 29. · 3-4. mum m- ” 4..mm.mm.m . we ... In nuclearweapons that areinherently one-point safe,‘nuclearsafety is dependent