Wi-Fi Protected Access (WPA)

Wi-Fi Protected Access (WPA) is a security standard for users of computers equipped with Wi-Fi wireless connection. It is an improvement on and is expected to replace the original Wi-Fi security standard, Wired Equivalent Privacy (WEP). WPA provides more sophisticated data encryption than WEP and also provides user authentication (WEP's user authentication is considered insufficient). WEP is still considered useful for the casual home user, but insufficient for the corporate environment where the large flow of messages can enable eavesdroppers to discover encryption keys more quickly.

WPA's encryption method is the Temporal Key Integrity Protocol (TKIP). TKIP addresses the weaknesses of WEP by including a per-packetmixing function, a message integrity check, an extended initialization vector, and a re-keying mechanism. WPA provides "strong" user authentication based on 802.1x and the Extensible Authentication Protocol (EAP). WPA depends on a central authentication server such as RADIUS to authenticate each user.

Wi-Fi Protected Access is a subset of and will be compatible with IEEE 802.11i (sometimes referred to as WPA2), a security standard under development. Software updates that will allow both server and client computers to implement WPA are expected to become widely available during 2003. Access points (see hot spots) can operate in mixed WEP/WPA mode to support both WEP and WPA clients. However, mixed mode effectively provides only WEP-level security for all users. Home users of access points that use only WPA can operate in a special home-mode in which the user need only enter a password to be connected to the access point. The password will trigger authentication and TKIP encryption.

Kismet

Kismet is a network detector, packet sniffer, and intrusion detection system for 802.11 wireless LANs. Kismet will work with any wireless card which supports raw monitoring mode, and can sniff 802.11a, 802.11b, 802.11g, and 802.11ntraffic. The program runs under Linux, FreeBSD, NetBSD, OpenBSD, and Mac OS X. The client can also run on Microsoft Windows, although, aside from external drones (see below), there's only one supported wireless hardware available as packet source.

Another common product for conducting wardriving attacks is Kismet (www. kismetwireless.net), written by Mike Kershaw. 

This product is free and runs on Linux, BSD UNIX, Mac OS X, and even Linux PDAs. The software is advertised as being more than just a wireless network detector. Kismet is also a sniffer and an intrusion detection system (IDS, covered in   Chapter 13) and can sniff 802.11b, 802.11a, 802.11g, and 802.11n traffic.

: It offers the following features

Wireshark- and Tcpdump-compatible data logging

Compatible with AirSnort and AirCrack (covered later in “Tools of the Trade”)

Network IP range detection

Detection of hidden network SSIDs 

 

Graphical mapping of networks

Client/server architecture that allows multiple clients to view a single Kismet server at the same time

Manufacturer and model identification of APs and clients

Detection of known default AP configurations

XML output

Support for more than 25 card types (almost any card that supports monitor mode) 

 

 
 

Protect Myself from Cyber Attacks.

What You Need To Know

The Department of Homeland Security plays an important role in countering threats to our cyber network. We aim to secure the federal civilian networks, cyberspace and critical infrasture that are essential to our lives and work.

DHS’s National Cybersecurity and Communications Integration Center (NCCIC) is a 24x7 center responsible for the production of a common operating picture for cyber and communications across the federal, state, and local government, intelligence and law enforcement communities and the private sector.   

Next Steps

The following preventative strategies are intended to help our public and private partners proactively look for emails attempting to deceive users into "clicking the link" or opening attachments to seemingly real websites:

• Never click on links in emails. If you do think the email is legitimate, whether from a third party retailer or primary retailer, go to the site and log on directly. Whatever notification or service offering was referenced in the email, if valid, will be available via regular log on.

• Never open the attachments. Typically, retailers will not send emails with attachments. If there is any doubt, contact the retailer directly and ask whether the email with the attachment was sent from them.

• Do not give out personal information over the phone or in an email unless completely sure. Social engineering is a process of deceiving individuals into providing personal information to seemingly trusted agents who turn out to be malicious actors. If contacted over the phone by someone claiming to be a retailer or collection agency, do not give out your personal information. Ask them to provide you their name and a call-back number. Just because they may have some of your information does not mean they are legitimate!

Other practical tips to protect yourself from cyberattacks:

• Set secure passwords and don't share them with anyone. Avoid using common words, phrases, or personal information and update regularly.
• Keep your operating system, browser, anti-virus and other critical software up to date. Security updates and patches are available for free from major companies.
• Verify the authenticity of requests from companies or individuals by contacting them directly. If you are asked to provide personal information via email, you can independently contact the company directly to verify this request.
• Pay close attention to website URLs. Pay attention to the URLs of websites you visit. Malicious websites sometimes use a variation in common spelling or a different domain (for example, .com instead of .net) to deceive unsuspecting computer users.
• For e-Mail, turn off the option to automatically download attachments.
• Be suspicious of unknown links or requests sent through email or text message. Do not click on unknown links or answer strange questions sent to your mobile device, regardless of who the sender appears to be.

Understanding 802.1X

The 802.1X is a specification that defines EAP (Extensible Authentication Protocol) over LAN. This is also known as EAPOL. EAP is an authentication framework with supports multiple authentication methods. It is defined in RFC 3748. EAP defines three terminologies:

Supplicant:

A device (usually workstation) that requests access to the LAN and switch services. The workstation running the IEEE802.1X-compliant client software is called the Supplicant

Authenticator:

A device (a switch or a wireless access point) that controls the physical access to the network based on the authentication status of the Supplicant. The Authenticator requests the identity from the Supplicant, verifies that information with the Authentication Server and relays the response to the Supplicant. The Authenticator includes the RADIUS Client. The EAP messages are encapsulated and decapsulated by the Authenticator while interacting with the Authentication Server.

Authentication Server:

A device that performs the actual authentication of the Supplicant. The Authentication Server validates the identity of the Supplicant and notifies the Authenticator whether the Supplicant is allowed to use the LAN and switch services.

wireless network interface card (WNIC)

A wireless network interface card (WNIC) is a network card which connects to a radio-based computer network. A WNIC, just like a NIC, works on the Layer 1 and Layer 2 of the OSI Model. A WNIC is an essential component for wireless desktop/laptop computer. This card uses an antenna to communicate through microwaves. A WNIC in a desktop computer usually is connected using the PCI bus. Other connectivity options are USB and PC card. Integrated WNICs are also available.

Wireless Network Interface Cards and Wireless Access Points are designed to work at certain specifications based on the IEEE. The most popular wireless specifications in 2010 are 802.11g (Wireless G) and 802.11n (Wireless N).Wireless G works on the 2.4 GHz frequency which allows for backwards compatibility with Wireless B technologies. Wireless G technologies allow for a maximum data rate of 54Mbps. 802.11g is by the far the most popular wireless technology in terms of rapid adoption. Unfortunately, since it suffers from the same interference as 802.11b (Wireless B), because of the 2.4GHz frequency. As a result, in the United States and elsewhere, Wireless G is often implemented in Channels 1, 6, and 11 because these are the three non-overlapping usable channels.

Wireless N improves 802.11g (Wireless G) bringing faster overall speeds, new antenna technologies, and dual-band frequency devices. 802.11n WAPs are backwards compatible with all previous wireless standards including 802.11g (Wireless G) and 802.11b (Wireless B). When this standard is finalized, 802.11n connections should support data rates of over 100 Mbps. 802.11n also offers somewhat better range over earlier Wi-Fi standards due to its increased signal intensity. 

Access Point

In computer networking, a wireless access point (AP) is a device that allows wireless devices to connect to a wired network using Wi-Fi, or related standards. The AP usually connects to a router (via a wired network) as a standalone device, but it can also be an integral component of the router itself. An AP is differentiated from a hotspot, which is the physical space where the wireless service is provided.

Wireless access has special security considerations. Many wired networks base the security on physical access control, trusting all the users on the local network, but if wireless access points are connected to the network, anybody within range of the AP (which typically extends farther than the intended area) can attach to the network

The most common solution is wireless traffic encryption. Modern access points come with built-in encryption. The first generation encryption scheme 'WEP' proved easy to crack; the second and third generation schemes, WPA and WPA2, are considered secure if a strong enough password or passphrase is used.

EAP methods

0. 
   

   
   

   
   

1. :Methods

   EAP is an authentication framework, not a specific authentication mechanism.^[1] It provides some common functions and negotiation of authentication methods called EAP methods. There are currently about 40 different methods defined. Methods defined in IETF RFCs include EAP-MD5, EAP-POTP, EAP-GTC, EAP-TLS, EAP-IKEv2, EAP-SIM, EAP-AKA and EAP-AKA'. Additionally a number of vendor-specific methods and new proposals exist. Commonly used modern methods capable of operating in wireless networks include EAP-TLS, EAP-SIM, EAP-AKA, LEAP and EAP-TTLS. 
   
   

   Encapsulation

   EAP is not a wire protocol; instead it only defines message formats. Each protocol that uses EAP defines a way to encapsulate EAP messages within that protocol's messages.
   
   

   IEEE 802.1X

   The encapsulation of EAP over IEEE 802 is defined in IEEE 802.1X and known as "EAP over LANs" or EAPOL

   PEAP

   The Protected Extensible Authentication Protocol, also known as Protected EAP or simply PEAP, is a protocol that encapsulates EAP within a potentially encrypted and authenticated Transport Layer Security (TLS) tunnel.

   RADIUS and Diameter

   Both the RADIUS and Diameter AAA protocols can encapsulate EAP messages.

   PANA

   The Protocol for Carrying Authentication for Network Access (PANA) is an IP-based protocol that allows a device to authenticate itself with a network to be granted access.

   PPP

   EAP was originally an authentication extension for the Point-to-Point Protocol (PPP).