WLAN• What is WLAN?

– Wireless Local Area Network– Extension of a wired LAN– Uses high frequency radio waves (RF)– Speed: 2 MB/s to 54 Mb/s– Distance:100 feet to 15miles

• Physical vs. Wireless LAN– Physical LAN has defined borders– Wireless is difficult to determine where access stops– Both are vulnerable to attacks

802.11 Standard• 802.11

– IEEE family of specifications for WLANs– 2.4GHz 2Mb/s– Includes WEP

• 802.11a– 5GHz, 54Mb/s

• 802.11b– Often called Wi-Fi, 2.4GHz, 11Mb/s

• 802.11e– QoS & Multimedia support to 802.11b & 802.11a

• 802.11g– 2.4GHz, 54Mb/s

• 802.11i– An alternative of WEP, known as WPA2

Modes of WLANs• Ad-Hoc

– Peer to Peer• Communication only to computers within

transmission range• If communication to the internet is required then

one of the members must act as a router

– Called the Independent Basic Service Set (IBSS)

Modes of WLANs• Infrastructure

– Each client sends its data to an access point– The access points acts as a bridge and forwards

the packets to other clients or to the wired network.

– Called the Basic Service Set (BSS)

War Driving & Chalking• People drive around looking for access

points.• When an access point is found, a chalk

mark is placed on the sidewalk or building

WEP• WEP – Wired Equivalent Privacy• Supposed to give the same amount of

privacy as a wired LAN• Used to prevent eavesdropping• Used to prevent unauthorized access to the

LAN (not explicitly a goal of WEP)

Application

Transport(TCP, UDP)

Network (IP)

802.11b Link

802.1bPhysical

SSL

(VPN)

WEP

Network (IP)

802.11b Link

802.1bPhysical

WEP

Network (IP)

Ethernet Link

EthernetPhysical

Application

Transport(TCP, UDP)

Network (IP)

EthernetLink

EthernetPhysical

SSL

(VPN)

Router

Secure Protocols For Encryption

Beacon Frame• Each access point broadcasts a beacon frame

several times a second• It contains:

– The beacon interval – How often does the frame get broadcast

– A time stamp– Service Set Identifier (SSID)– Supported transmission rates– Parameter sets – frequency hops, delay, etc– Compatibility info – such as: all clients must use WEP– Traffic Map – What AP are in power saver mode

Probe Frame• A client may broadcast a probe frame to

find the AP associated with an SSID.• The SSID is required for all communication

with an access point.

Association• Before a client can communicate with the AP, a

relation or association must be established.• There are 3 association states

– 1)Unauthorized and unassociated– 2)Authenticated and unassociated– 3)Authenticated and associated

• To move from state1 to state 2 in an open system, a client sends a authentication request, and the AP responds with an authorization success frame.

• Open systems may also employ MAC access lists to determine if the AP responds with an authorization success frame.

WEP Association• WEP relies on a shared key• The client sends a authentication request

indicating the use of a shared key• The AP responds with a challenge containing 128

Octets generated with the WEP pseudo-random number generator (PRNG) seeded with the shared key and an initialization vector (IV).

• The client then encodes the message using the key, a new IV and sends it to the AP.

• The AP decrypts and compares. This authenticates the client to the AP

WEP• Uses an RC4 stream cipher

– Creates a repeatable stream of “random” data– The data is XORed with the data to get the encrypted

data• Uses a shared key

– Can be “64 bit or 128 bit”• Uses an initialization Vector (IV)

– 24 bit– Actually used as part of the key so…

• The 64 bit key is actually a 40 bit shared key• The 128 bit key is actually a 104 bit shared key.

– Increments with each frame (by convention)– Sent as clear text in each frame.

IP Data

Encrypted IP DataIV802.11 Hdr ICV

Seed RC4 with IV + shared key, XOR output with data

IV Sent in clear text

ICV is a 32 bit CRC of the plain IP data

Problems• Because of the XOR and the static shared key, getting two

frames with the same IV one can statistically figure out the message.

• Becomes even easier if you have multiple frames with the same IV

• An AP sending out 1500byte packets at 11Mb/s will use every IV in about 5 hours. But most packets are smaller so the rollover will occur even sooner.

• Most wireless cards reset their IV to 0 on reset.• Even worse…The 802.11 standard makes changing the IV

optional.• The ICV uses CRC32 which is good at detecting

transmission problems, but easy to get a valid crc with altered data

• Subject to replay attacks.

Attacks• Passive

– Listen to the air waiting for a duplicate IV and apply statistics.

• Active– With knowledge of the contents (tcp/ip), the attacker

can guess where the destination is, and by flipping some bits, the AP will send the packet to another address.• Once the attacker has the encrypted text and the decrypted text

the XOR is easily gotten– Another active attack is to send a packet from the

internet to a destination on the WLAN. The AP will encode the message, thus the attacker has both the encrypted and plan text again.

Defense• Stop the AP from broadcasting the SSID• Change the SSID from the factory default

– Don’t use any identifying number• Enable MAC authentication• Use 128 bit WEP• Change the default passwords on the AP itself• Set /change the shared key!!!• Place a firewall between the AP and the intranet• Use a higher level encryption such as SSL or VPN• Use WPA. This standard addresses these

problems.

WPA• WPA – Wi-Fi Protected Access• Designed to run with existing WEP access

points with just a firmware change• Changes to WEP

– TKIP (Temporal Key Integral Protocol)• 48 Bit IV (instead of 24 bit)

– At current 802.11a (54 Mb/s) it will take 645 years before the IV will roll

– Initialized to 0 when the shared key is initialized– Increments with every packet sent out– AP rejects any packet with a IV less then the current count– Traffic halts if the key gets to it’s max value

WPA• Changes to WEP

– TKIP (Temporal Key Integral Protocol)• Change the per packet key with every association (instead of

static)– Employ 802.1X EAPOL key message (RADIUS)

• Use the transmitter’s MAC Address in the key (TA)

Shared Key TA IV

Phase 1

XOR

IV

Per Packet Key

RC4

Shared Key

WPA• Changes to WEP

– Addition of a MIC (message Integrity Check)• Often referred to as Michael• A hash used to prevent message alteration

– Hash the shared key, source address, destination address, and the data

WPA

MIC

IP Data

Encrypted IP DataIV802.11 Hdr

Seed RC4 with TKIP XOR output with data

IV Sent in clear text

MICEncrypted IP DataIV802.11 Hdr ICV

CRC32

+IV

IV

+Source MAC+Dest MAC+Per packet Key

WPA Problems• If you know the type of packet (most likely ARP), the crc32

checksum will allow you to guess the bytes of the packet• Once you have a guess, you submit the packet to the AP. If the

AP accepts the packet, you guessed the bytes correctly. Continue guessing.

• WPA counter measure requires a 60 second delay between guesses

• Using an ARP packet, you can generate your own ARP packets in about 12 minutes.

• One you have ARP, you can do a man in the middle attack and see both the clear text and the encrypted text, and get the key stream, but…

• You must use the QoS channel (if enabled) and then you can only send 15 packets before the IV changes the entire key stream.

WPA2• Fixes the WPA problems by only using a block cipher

– Impossible to get a “key stream” as they don’t exist.– Problem: All packets are the increment of the block size!

(multiples of 128 bit). • Uses AES –symmetric key, block cipher

– Personal mode• Pre-shared key

– Enterprise mode• Requires a pre-shared key• Uses 802.1x EAPOL key message (RADIUS) to generate a

session key• Called a Robust Security Network (RSN)

– Requires different hardware then WPA equipment– RSN is incompatible with WPA