Wireless LAN

1
Wireless LAN

• Khoh Chih Jeun
• chihjeun_at_alumni.nus.edu.sg

For SIG2 10 Dec 2002
2
Agenda

• Introduction
• Known Issues
• Existing Tools and Activities
• Known Solutions
• Existing Gaps
• Wireless Intrusion Detection

For SIG2 10 Dec 2002
3
Introduction

• IEEE 802.11
• IEEE 802.11b
• IEEE 802.11a
• IEEE 802.11g
• IEEE 802.11i

For SIG2 10 Dec 2002
4
802.11b Protocol

• 2.4 GHz DSSS
• 14 channels
• 1W maximum
• Ad-hoc or infrastructure mode
• WEP

For SIG2 10 Dec 2002
5
Management Frames

• Beacon
• Probe Request and Response
• Association Request and Response
• Disassociation

For SIG2 10 Dec 2002
6
Known Issues

• WEP vulnerabilities
• Limited key length
• IV weakness
• Static key management
• Management frames
• In clear text
• Unauthenticated
• Vendor Specific
• Backdoors
• SNMP
• Web Management

For SIG2 10 Dec 2002
7
Tools

• Sniffers
• Kismet/NetStumbler/Wellenreiter
• Airopeek/Network Associates/
• WEP Crackers
• Airsnort
• Bsd-airtools
• WEPCrack
• Packet Injections
• Omerta and Radiate

For SIG2 10 Dec 2002
8
Activities

• Wardriving/ Sniffing
• Spoofing
• Man in Middle
• Open AP movement
• Wireless Honeynet

For SIG2 10 Dec 2002
9
Solutions

• Depends on cost effectiveness
• 128bit WEP
• TKIP
• 802.1x RADIUS
• IPSec

For SIG2 10 Dec 2002
10
Existing Gaps

• What's happening at the 802.11 link layer?

For SIG2 10 Dec 2002
11
Wireless IDS
For SIG2 10 Dec 2002
12
Conclusion

• Define requirements
• Understand vulnerabilities
• Select appropriate counter measures
  (multi-layered)

For SIG2 10 Dec 2002
13
Reference

• Kismet www.kismetwireless.net
• Netstumbler www.netstumbler.com
• Wellenreiter www.remote-exploit.org
• Airopeek www.airopeek.com
• Sniffer Tech www.sniffer.com/products/sniffer-wir
  eless
• Bsd-tools www.dachb0den.com/projects/bsd-airtools
  .html
• Airsnort airsnort.shmoo.com
• WEP crack wepcrack.sourceforge.net
• OpenAP opensource.instant802.com
• Open1x www.open1x.org
• Omerta, Radiate www.packetfactory.net

For SIG2 10 Dec 2002