WLAN Authentication and Encryption

WLAN Authentication Methods

There are three main methods of authentication that are used on today’s wireless LANs:

The open authentication method is the simplest of the methods used and only requires that the end device be aware of the Service-Set Identifier (SSID) used on the network, as long as the SSID is known then the device will be allowed onto the network. The problem with this method is that the SSID is typically broadcast and if it is not, it can be easy to figure out with passive capturing techniques.

The shared authentication method is commonly used on individual and small business wireless LAN implementations; this method uses a shared key (Pre-Shared Key – PSK) that is given to both sides of the connection; if they match then the device is allowed onto the network.

The third method uses the Extensible Authentication Protocol (EAP) and is the most common method used by enterprises. The EAP method utilizes an authentication server that is queried for authentication using a variety of credential options.

WLAN Encryption Methods

The first widely used standard for wireless LANs was 802.11 (prime); this included the Wired Equivalent Privacy (WEP) algorithm which was used for security. WEP utilizes RC4 for encryption and has been depreciated because of vulnerabilities that can be used to find the security keys.

In response to the vulnerabilities found in WEP, Wi-Fi Protected Access (WPA)was defined. WPA utilizes the Temporal Key Integrity Protocol (TKIP) which utilizes dynamic keys that were not supported with WEP and RC4 for encryption. The TKIP method used with WPA was utilized until vulnerabilities were found in TKIP. These vulnerabilities center on the fact that TKIP uses some of the same mechanisms that WEP does which allow similar attacks.

In response to the vulnerabilities in WPA/TKIP, the IEEE 802.11i standard was defined and implemented; the IEEE 802.11i standard is also referred to as WPA2. WPA2 replaced TKIP with Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) which is based on Advanced Encryption Standard (AES); it is common for the WPA2 encryption method to be referred to as AES. As of this writing, there are no easy methods that have been found to break AES.

Top 6 Wireless Network hacking/monitoring tools

The tools used to hack the network is used either for the

• purpose of sniffing the network : as is the case of network admins and
• cracking the password: used by programmers to rectify the trouble shooting and by the people who want to use internet free of cost. It has been seen that based on this concept there are around 10 tools together which can be understood to hack wireless LAN.

• 1. Aircrack : Most popular wireless password cracking tool, it attacks 802.11a/b/g WEP and WPA. This tool manufacturers also provides tutorial for installation of the tool and its usage for cracking the password.
• 2. Cain & Able: This tool intercepts the network traffic and cracks the passwords forcibly using crypt-analysis attack methods.
• 3. WireShark : This is network protocol analyzer. So again good for the network admins to keep a check on the traffic. Basic requirement is that the user should have a good knowledge of the network protocol only then they can use this tool. 
• 4. CoWPAtty : This tool is an automated dictionary attack tool for WPA-PSK. CoWPatty is simple to use however it is slow as tool uses the password dictionary for generating hack for each word contained in the dictionary by using the SSID.
• 5. OmniPeek : network analyzer tool working only on Windows OS. This tools captures and analyzes the network traffic.
• 6. CloudCracker :This is online password cracking for WPA protected WiFi networks. It is used to crack the passwords by using a dictionary of around 300 million words. 

For the network admins and the professional programmers these tools should be more helpful for understanding the cracking of password and hence helping them professionally.

Spread Spectrum

Spread spectrum is a form of wireless communications in which the frequency of the transmitted signal is deliberately varied. This results in a much greater bandwidth than the signal would have if its frequency were not varied.

A conventional wireless signal has a frequency, usually specified in megahertz (MHz) or gigahertz gigahertz), that does not change with time (except for small, rapid fluctuations that occur as a result of modulation). When you listen to a signal at 103.1 MHz on an FM stereo receiver, for example, the signal stays at 103.1 MHz. It does not go up to 105.1 MHz or down to 99.1 MHz. The digits on the radio's frequency dial stay the same at all times. The frequency of a conventional wireless signal is kept as constant as the state of the art will permit, so the bandwidth can be kept within certain limits, and so the signal can be easily located by someone who wants to retrieve the information.

There are at least two problems with conventional wireless communications that can occur under certain circumstances. First, a signal whose frequency is constant is subject to catastrophic interference. This occurs when another signal is transmitted on, or very near, the frequency of the desired signal. Catastrophic interference can be accidental (as in amateur-radio communications) or it can be deliberate (as in wartime). Second, a constant-frequency signal is easy to intercept, and is therefore not well suited to applications in which information must be kept confidential between the source (transmitting party) and destination (receiving party).

Wireless Communication

Wireless communication is among technology’s biggest contributions to mankind. Wireless communication involves the transmission of information over a distance without help of wires, cables or any other forms of electrical conductors. The transmitted distance can be anywhere between a few meters (for example, a television’s remote control) and thousands of kilo meter (for example, radio communication).

Some of the devices used for wireless communication are cordless telephones, mobiles, GPS units, wireless computer parts, and satellite television.

Advantages

i.      Communication has enhanced to convey the information quickly to the consumers.

ii.        Working professionals can work and access Internet anywhere and anytime without carrying cables or wires wherever they go. This also helps to complete the work anywhere on time and improves the productivity.

iii.       Doctors, workers and other professionals working in remote areas can be in touch with medical centres through wireless communication.

iv.       Urgent situation can be alerted through wireless communication. The affected regions can be provided help and support with the help of these alerts through wireless communication.

v.         Wireless networks are cheaper to install and maintain.

Disadvantages

The growth of wireless network has enabled us to use personal devices anywhere and anytime. This has helped mankind to improve in every field of life but this has led many threats as well.

Wireless network has led to many security threats to mankind. It is very easy for the hackers to grab the wireless signals that are spread in the air. It is very important to secure the wireless network so that the information cannot be exploited by the unauthorized users. This also increases the risk to lose information. Strong security protocols must be created to secure the wireless signals like WPA and WPA2. Another way to secure the wireless network is to have wireless intrusion prevention system.  

Wireless Technology

Wireless is a term used to describe telecommunications in which electromagnetic waves (rather than some form of wire) carry the signal over part or all of the communication path. Some monitoring devices, such as intrusion alarms, employ acoustic waves at frequencies above the range of human hearing; these are also sometimes classified as wireless.

The wireless method of communication uses low-powered radio waves to transmit data between devices. High powered transmission sources usually require government licenses to broadcast on a specific wavelength. This platform has historically carried voice and has grown into a large industry, carrying many thousands of broadcasts around the world. Radio waves are now increasingly being used by unregulated computer users.

Humans communicate in order to share knowledge and experiences. Common forms of human communication include sign language, speaking, writing, gestures, and broadcasting. Communication can be interactive, transactive, intentional, or unintentional; it can also be verbal or nonverbal. In addition, communication can be intrapersonal or interpersonal.

We owe much to the Romans that in the field of communication it did not end with the Latin rootcommunicare. They devised what might be described as the first real mail, or postal system, in order to centralize control of the empire from Rome. This allowed Rome to gather 

knowledge about events in its many widespread provinces.

Countermeasures for Wireless Attacks

Wireless communication poses formidable challenges for the security professional. Many wireless manufacturers design their devices for easy set up and use, often at the expense of sound security practices. Many wireless devices default to little or no security. A security professional must take extra precautions to protect sensitive data transmitted over wireless devices.

Two protocols that have been implemented to provide security for wireless communication are:

• Wired Equivalent Privacy (WEP) implements the 802.11 specification for wireless network connections.
• Wireless Application Protocol (WAP) is used with mobile devices such as PDA's and smart phones.
• The following table describes weaknesses with both WEP and WAP:

  Protocol	Vulnerabilities
  Wired Equivalent Privacy (WEP)	WEP suffers from the following weaknesses: The key is vulnerable during authentication. The same WEP key is used for authentication and data encryption. The WEP key is static. Because it doesn't change, it can be captured and broken. Every host on the network uses the same key. Key rotation is difficult. WEP uses a very short initialization vector (IV) - a mechanism that allows a cipher to be executed in any of several streaming modes of operation to produce a unique cipher text using the same encryption key. The integrity check value (ICV) is easily defeated. Unless you specify data encryption, all frames are sent in plaintext. The RC4 encryption cipher could be replaced by a stronger encryption cipher. The Service Set Identifier is broadcast. Authentication can be open, meaning that identity is not checked. Most wireless stations can be configured using the network name ANY.
  Wireless Application Protocol (WAP)	The most significant weakness of WAP is referred to Gap in the WAP, a security gap between a WAP client (handset) and a LAN host. The Gap in the WAP attack: Exploits the decryption of transmissions at a carrier midpoint. Compromises the carrier before the data is re-encrypted. Exposes plaintext data. WAP deploys Wireless Transport Layer Security Protocol (WTLS) for authentication: Class 1, Anonymous Authentication Class 2, Server Authentication Class 3, Two-Way Client and Server Authentication

  Countermeasures for wireless communications are:
  • First and foremost, treat a wireless network as though it were a publicly accessible network. Don't assume that the traffic on that network is private and secure.
  • Put the access points in separate virtual LANs and implement some type of intrusion detection to help identify when an attacker is attempting to set up a rogue access point or is using a brute force attack to gain access.
  • Encrypt all data transmitted through your access point.
  • Set the access point to accept only Media Access Control (MAC) addresses.
  • Use firewalls on each network access point.
  • Avoid storing sensitive data on wireless machines whenever possible. Encrypt sensitive data that must be stored on the machine.
  • Install security updates as soon as they are available.
  • Install antivirus software on the wireless computer.
  • Require that users connect to the wireless access point with a network cable when sending sensitive data.
  • Disable the broadcasting of the SSID from all access points.
  • Implement EAP-TLS to use different keys for encryption and broadcast traffic.
  • Set the WEP broadcast traffic key to be renegotiated at a certain interval.
  • Set up a RADIUS server and a certificate authority. The RADIUS server authenticates the user back against your network directory service. 

Service Set Identifiers (SSID)

Service Set Identifiers -SSID

(Service Set IDentifier) The name assigned to a Wi-Fi (wireless) network. All devices in the network must use) 

this case-sensitive name to communicate over Wi-Fi, which is a text string up to 32 bytes long. Out of the box, wireless routers and access points have a default SSID, which may be the manufacturer's name, such as "linksys" or "netgear" or simply "default." Some devices use their model number as the SSID. Using a Web browser, the SSID (and password) can be manually changed in the device's configuration settings. See WPA.

The SSID Normally Broadcasts Itself

Computers identify all the wireless networks they find when they boot up, because Wi-Fi networks normally broadcast their SSID identity (see SSID broadcast). Even if the SSID is hidden to the general public, the name can be entered permanently into the users' machines in order to reconnect at start up. See wireless LAN andaccess point.

For Wireless Access - Not For Sharing

The SSID is the name used to connect to a wireless network. A workgroup or domain name is the name used for user groups to share files over any network, wired or wireless. In short, Wi-Fi is accessed by SSID; files are accessed by workgroup or domain name. See workgroup-based network and domain-based network.