CYS405 · Chapter 11 · Annotated SlidesWireless Network Hacking
Original
Overview

Wireless Network Hacking

Wireless modes and components, threats and the SSID, IEEE 802.11 frames and services, WEP and its flaws, WPA, WPA2 and WPA3, securing transmissions and access points, the wireless hacking methodology (discovery, GPS mapping, traffic analysis, attacks such as rogue AP and evil twin, cracking) and defenses.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 51 slides
  1. 1 Slide 1
  2. 2 Wireless Security Overview
  3. 3 Wireless Network Modes
  4. 4 Wireless Network Modes
  5. 5 Key Factors Contributing to Risks
  6. 6 Wireless Networking Components (Facilitating points of attack)
  7. 7 Wireless Network Threats
  8. 8 Service Set Identifier (SSID)
  9. 9 Slide 9
  10. 10 Securing Wireless Networks
  11. 11 IEEE 802.11 Wireless LAN
  12. 12 IEEE 802.11 Protocol Stack
  13. 13 A MAC Frame (MPDU)
  14. 14 IEEE 802.11 Extended Service Set
  15. 15 IEEE 802.11# Wireless Security
  16. 16 WEP - Wired Equivalent Privacy
  17. 17 How WEP works
  18. 18 WEP Flaws and Vulnerabilities
  19. 19 Attacks on WEP
  20. 20 WPA - WI-FI Protected Access
  21. 21 WPA2 - WI-FI Protected Access 2
  22. 22 WPA2
  23. 23 WPA3
  24. 24 Slide 24
  25. 25 Securing Wireless Transmission
  26. 26 Securing Access Point
  27. 27 Securing Wireless Networks
  28. 28 Association Services
  29. 29 Wireless Hacking Methodology
  30. 30 1- Wi-Fi Discovery: 1.1- Wireless Network Footprinting
  31. 31 Wi-Fi Discovery (cont..) 1.2-Finding Wi-Fi Networks in Range to attack
  32. 32 Wi-Fi chalking Symbols
  33. 33 Slide 33
  34. 34 Wi-Fi Discovery (cont..) 1.3- Finding WPS-Enables APs
  35. 35 Wi-Fi Discovery (cont..)
  36. 36 2- GPS Mapping
  37. 37 3-Wireless Traffic Analysis
  38. 38 4- Launch of Wireless Attack: Aircrack-ng Suite
  39. 39 4.1- Launch of Wireless Attacks: Detection of Hidden SSIDs
  40. 40 4.2- MAC Spoofing Attack
  41. 41 4.3- DoS: Disassociation and De-authentication Attacks
  42. 42 4.4- Man in the Middle Attack
  43. 43 4.5- Rogue Access Point
  44. 44 4.6 Evil Twin
  45. 45 4.7 Misconfigured Access Point Attack
  46. 46 Some of the key elements that play an important role in this kind of
  47. 47 4.8- Ad Hoc Connection Attack
  48. 48 4.9- Jamming Signal Attack
  49. 49 5- Wi-Fi Encryption Cracking: WEP Encryption Cracking
  50. 50 How to Defend Against Wireless Attacks
  51. 51 How to Defend Against Wireless Attacks (cont’d)
Slide 1 / 51

Slide 1

Slide 1: Slide 1
Slide 2 / 51

Wireless Security Overview

Slide 2: Wireless Security Overview
Slide 3 / 51

Wireless Network Modes

Slide 3: Wireless Network Modes
Slide 4 / 51

Wireless Network Modes

Slide 4: Wireless Network Modes
Slide 5 / 51

Key Factors Contributing to Risks

Slide 5: Key Factors Contributing to Risks
Slide 6 / 51

Wireless Networking Components (Facilitating points of attack)

Slide 6: Wireless Networking Components (Facilitating points of attack)
Slide 7 / 51

Wireless Network Threats

Slide 7: Wireless Network Threats
Slide 8 / 51

Service Set Identifier (SSID)

Slide 8: Service Set Identifier (SSID)

Notes

  1. SSID: the network name. Hiding it is NOT real security (it still appears in probe traffic).

  2. Trap Hiding the SSID and MAC filtering are easily bypassed; use WPA2/WPA3.

Exam angle

PredictionQ1

Disabling SSID broadcast makes a wireless network secure.

Slide 9 / 51

Slide 9

Slide 9: Slide 9
Slide 10 / 51

Securing Wireless Networks

Slide 10: Securing Wireless Networks
Slide 11 / 51

IEEE 802.11 Wireless LAN

Slide 11: IEEE 802.11 Wireless LAN
Slide 12 / 51

IEEE 802.11 Protocol Stack

Slide 12: IEEE 802.11 Protocol Stack
Slide 13 / 51

A MAC Frame (MPDU)

Slide 13: A MAC Frame (MPDU)
Slide 14 / 51

IEEE 802.11 Extended Service Set

Slide 14: IEEE 802.11 Extended Service Set
Slide 15 / 51

IEEE 802.11# Wireless Security

Slide 15: IEEE 802.11# Wireless Security
Slide 16 / 51

WEP - Wired Equivalent Privacy

Slide 16: WEP - Wired Equivalent Privacy

Notes

  1. WEP: RC4 with a 24-bit IV. IVs repeat quickly, so keys can be cracked in minutes. Never use WEP.

Exam angle

PredictionQ1

WEP’s main weakness is its:

Slide 17 / 51

How WEP works

Slide 17: How WEP works
Slide 18 / 51

WEP Flaws and Vulnerabilities

Slide 18: WEP Flaws and Vulnerabilities
Slide 19 / 51

Attacks on WEP

Slide 19: Attacks on WEP
Slide 20 / 51

WPA - WI-FI Protected Access

Slide 20: WPA - WI-FI Protected Access

Notes

  1. WPA: TKIP (still RC4), per-packet keys, MIC. An interim fix.

Slide 21 / 51

WPA2 - WI-FI Protected Access 2

Slide 21: WPA2 - WI-FI Protected Access 2

Notes

  1. WPA2: AES-CCMP. Personal (PSK) or Enterprise (802.1X/RADIUS).

Exam angle

PredictionQ1

WPA2 uses which encryption?

Slide 22 / 51

WPA2

Slide 22: WPA2
Slide 23 / 51

WPA3

Slide 23: WPA3

Notes

  1. WPA3: SAE handshake (resists offline dictionary attacks), forward secrecy, 192-bit enterprise mode.

Slide 24 / 51

Slide 24

Slide 24: Slide 24
Slide 25 / 51

Securing Wireless Transmission

Slide 25: Securing Wireless Transmission
Slide 26 / 51

Securing Access Point

Slide 26: Securing Access Point

Notes

  1. Secure the AP: change defaults, update firmware, strong encryption, disable WPS, limit admin access.

Slide 27 / 51

Securing Wireless Networks

Slide 27: Securing Wireless Networks
Slide 28 / 51

Association Services

Slide 28: Association Services
Slide 29 / 51

Wireless Hacking Methodology

Slide 29: Wireless Hacking Methodology
Slide 30 / 51

1- Wi-Fi Discovery: 1.1- Wireless Network Footprinting

Slide 30: 1- Wi-Fi Discovery: 1.1- Wireless Network Footprinting
Slide 31 / 51

Wi-Fi Discovery (cont..) 1.2-Finding Wi-Fi Networks in Range to attack

Slide 31: Wi-Fi Discovery (cont..) 1.2-Finding Wi-Fi Networks in Range to attack
Slide 32 / 51

Wi-Fi chalking Symbols

Slide 32: Wi-Fi chalking Symbols

Notes

  1. War driving: searching for Wi-Fi from a moving car; war chalking: marking found networks with symbols.

Slide 33 / 51

Slide 33

Slide 33: Slide 33
Slide 34 / 51

Wi-Fi Discovery (cont..) 1.3- Finding WPS-Enables APs

Slide 34: Wi-Fi Discovery (cont..) 1.3- Finding WPS-Enables APs
Slide 35 / 51

Wi-Fi Discovery (cont..)

Slide 35: Wi-Fi Discovery (cont..)
Slide 36 / 51

2- GPS Mapping

Slide 36: 2- GPS Mapping
Slide 37 / 51

3-Wireless Traffic Analysis

Slide 37: 3-Wireless Traffic Analysis
Slide 38 / 51

4- Launch of Wireless Attack: Aircrack-ng Suite

Slide 38: 4- Launch of Wireless Attack: Aircrack-ng Suite
Slide 39 / 51

4.1- Launch of Wireless Attacks: Detection of Hidden SSIDs

Slide 39: 4.1- Launch of Wireless Attacks: Detection of Hidden SSIDs
Slide 40 / 51

4.2- MAC Spoofing Attack

Slide 40: 4.2- MAC Spoofing Attack
Slide 41 / 51

4.3- DoS: Disassociation and De-authentication Attacks

Slide 41: 4.3- DoS: Disassociation and De-authentication Attacks

Notes

  1. De-authentication attack: forged deauth frames disconnect clients (DoS, or to capture the WPA handshake).

Slide 42 / 51

4.4- Man in the Middle Attack

Slide 42: 4.4- Man in the Middle Attack
Slide 43 / 51

4.5- Rogue Access Point

Slide 43: 4.5- Rogue Access Point
Slide 44 / 51

4.6 Evil Twin

Slide 44: 4.6 Evil Twin

Notes

  1. Evil twin: a fake AP with the SAME SSID as a legitimate one to lure clients.

Exam angle

PredictionQ1

An attacker’s AP broadcasting the coffee shop’s exact SSID is a(n):

Slide 45 / 51

4.7 Misconfigured Access Point Attack

Slide 45: 4.7 Misconfigured Access Point Attack
Slide 46 / 51

Some of the key elements that play an important role in this kind of

Slide 46: Some of the key elements that play an important role in this kind of
Slide 47 / 51

4.8- Ad Hoc Connection Attack

Slide 47: 4.8- Ad Hoc Connection Attack
Slide 48 / 51

4.9- Jamming Signal Attack

Slide 48: 4.9- Jamming Signal Attack

Notes

  1. Jamming: radio interference that denies service.

Slide 49 / 51

5- Wi-Fi Encryption Cracking: WEP Encryption Cracking

Slide 49: 5- Wi-Fi Encryption Cracking: WEP Encryption Cracking

Notes

  1. Cracking: WEP by collecting IVs (aircrack-ng); WPA/WPA2-PSK by capturing the 4-way handshake and running a dictionary attack.

Slide 50 / 51

How to Defend Against Wireless Attacks

Slide 50: How to Defend Against Wireless Attacks

Notes

  1. Defenses: WPA2/WPA3 with strong passphrases, 802.1X, WIDS/WIPS, rogue-AP detection, disable WPS.

Slide 51 / 51

How to Defend Against Wireless Attacks (cont’d)

Slide 51: How to Defend Against Wireless Attacks (cont’d)