Wireless Network Security
Low deployment costs make wireless networks attractive to both organisations and end users. However, the easy availability of inexpensive equipment also gives attackers the tools to launch attacks on the network. New security risks come with the benefits of adopting wireless networks.
An Introduction to Wireless Network
Wireless Internet access technology is being increasingly deployed in both office and public environments, as well as by Internet users at home. Some of the basic technologies of wireless network systems are outlined below.
Wireless Local Area Network
A Wireless Local Area Network (WLAN) is a type of local area network that uses high frequency radio waves rather than wires to communicate between network-enabled devices.
Access Point
A wireless access point (AP) is a hardware device that allows wireless communication devices, such as PDAs and mobile computers, to connect to a wireless network. Usually, an AP connects into to a wired network, and provides a bridge for data communication between wireless and wired devices.
Service Set Identifier
A Service Set Identifier (SSID) is a configurable identification that allows wireless clients to communicate with an appropriate access point. With proper configuration, only clients with correct SSID can communicate with the access points. In effect, the SSID acts as a single shared password between access points and clients.
Open System Authentication
Open System Authentication is the default authentication protocol for the 802.11 wireless standard. It consists of a simple authentication request containing the station ID and an authentication response containing success or failure data. Upon successful authentication, both stations are considered mutually authenticated. It can be used with WEP (Wired Equivalent Privacy) protocol to provide better communication security, however it is important to note that the authentication management frames are still sent in clear text during authentication process. WEP is used only for encrypting data once the client is authenticated and associated. Any client can send its station ID in an attempt to associate with the AP. In effect, no authentication is actually done.
Shared Key Authentication
Shared Key Authentication is a standard challenge and response mechanism that makes use of WEP and a shared secret key to provide authentication. Upon encrypting the challenge text with WEP using the shared secret key, the authenticating client will return the encrypted challenge text to the access point for verification. Authentication succeeds if the access point decrypts to the same challenge text.
Ad-Hoc Mode
Ad-hoc mode is one of the networking topologies provided in the 802.11 standard. It consists of at least two wireless stations where no access point is involved in their communication. Ad-hoc mode WLANs are normally less expensive to run, as no APs are needed for their communication. However, this topology cannot scale for larger networks and lack of some security features like MAC filtering and access control.
Infrastructure Mode
Infrastructure mode is another networking topology in the 802.11 standard, in addition to ad-hoc mode. It consists of a number of wireless stations and access points. The access points usually connect to a larger wired network. This network topology can scale to form large-scale networks with arbitrary coverage and complexity.
Wired Equivalent Privacy Protocol
Wired Equivalent Privacy (WEP) Protocol is a basic security feature in the IEEE 802.11 standard, intended to provide confidentiality over a wireless network by encrypting information sent over the network. A key-scheduling flaw has been discovered in WEP, so it is now considered as unsecured because a WEP key can be cracked in a few minutes with the aid of automated tools. Therefore, WEP should not be used unless a more secure method is not available.
Wi-Fi Protected Access
Wi-Fi Protected Access (WPA) is a wireless security protocol designed to address and fix the known security issues in WEP. WPA provides users with a higher level of assurance that their data will remain protected by using Temporal Key Integrity Protocol (TKIP) for data encryption. 802.1x authentication has been introduced in this protocol to improve user authentication.
Wi-Fi Protected Access 2 (WPA2), based on IEEE 802.11i, is a new wireless security protocol in which only authorised users can access a wireless device, with features supporting stronger cryptography(e.g. Advanced Encryption Standard or AES), stronger authentication control (e.g. Extensible Authentication Protocol or EAP), key management, replay attack protection and data integrity.
TKIP was designed to use with WPA while the stronger algorithm AES was designed to use with WPA2. Some devices may allow WPA to work with AES while some others may allow WPA2 to work with TKIP. But since November 2008, vulnerability in TKIP was uncovered where attacker may be able to decrypt small packets and inject arbitrary data into wireless network. Thus, TKIP encryption is no longer considered as a secure implementation. New deployments should consider using the stronger combination of WPA2 with AES encryption.
Wi-Fi Protected Access 3 (WPA3) is a new wireless security standard built on WPA2 but brings new features to enhance Wi-Fi security for more robust authentication and enhanced cryptographic strength, while maintaining resiliency of mission critical networks. The WPA3-Personal mode utilises the Simultaneous Authentication of Equals key establishment protocol as defined in IEEE 802.11-2016 to strengthen password-based authentication against brute-force attacks. It has a natural password selection feature to help users choose easy-to-remember and strong passwords. It also provides forward secrecy that prevents attackers who have compromised the network from decrypting data traffic already sent out before the compromise. The WPA3-Enterprise mode comes with an optional security suite that offers 192-bit level encryption instead of WPA2’s 128-bit level encryption for enhanced protection of critical Wi-Fi networks handling sensitive information. WPA3 is compatible with WPA2 and more new Wi-Fi devices will support WPA3 in the years to come.
Security Threats and Risks Associated with Wireless Networks
Low deployment costs make wireless networks attractive to users. However, the easy availability of inexpensive equipment also gives attackers the tools to launch attacks on the network. The design flaws in the security mechanisms of the 802.11 standard also give rise to a number of potential attacks, both passive and active. These attacks enable intruders to eavesdrop on, or tamper with, wireless transmissions.
"Parking Lot" Attack
Access points emit radio signals in a circular pattern, and the signals almost always extend beyond the physical boundaries of the area they intend to cover. Signals can be intercepted outside buildings, or even through the floors in multi-storey buildings. As a result, attackers can implement a "parking lot" attack, where they actually sit in the organisation's parking lot and try to access internal hosts via the wireless network.
If a network is compromised, attacker has achieved a high level of penetration into the network. They are now through the firewall, and have the same level of network access as trusted employees within the corporation.
An attacker may also fool legitimate wireless clients into connecting to the attacker's own network by placing an unauthorised access point with a stronger signal in close proximity to wireless clients. The aim is to capture end-user passwords or other sensitive data when users attempt to log on these rogue servers.
Shared Key Authentication Flaw
Shared key authentication can easily be exploited through a passive attack by eavesdropping on both the challenge and the response between the access point and the authenticating client. Such an attack is possible because the attacker can capture both the plaintext (the challenge) and the ciphertext (the response).
WEP uses the RC4 stream cipher as its encryption algorithm. A stream cipher works by generating a keystream, i.e. a sequence of pseudo-random bits, based on the shared secret key, together with an initialisation vector (IV). The keystream is then XORed against the plaintext to produce the ciphertext. An important property of a stream cipher is that if both the plaintext and the ciphertext are known, the keystream can be recovered by simply XORing the plaintext and the ciphertext together, in this case the challenge and the response. The recovered keystream can then be used by the attacker to encrypt any subsequent challenge text generated by the access point to produce a valid authentication response by XORing the two values together. As a result, the attacker can be authenticated to the access point.
Service Set Identifier Flaw
Access points come with default SSIDs. If the default SSID is not changed, these units can easily be compromised. In addition, SSIDs are sent over the air as clear text if WEP is disabled, allowing the SSID to be captured by monitoring network traffic. For some products, even when WEP is enabled, management messages containing the SSID will still be broadcasted in clear text by access points and clients, making it possible for an attacker to sniff SSIDs and gain access to the wireless LAN.
The Vulnerability Of Wired Equivalent Privacy Protocol
Data passing through a wireless LAN with WEP disabled (which is the default setting for most products) is susceptible to eavesdropping and data modification attacks. However, even when WEP is enabled, the confidentiality and integrity of wireless traffic is still at risk because a number of flaws in WEP have been revealed which seriously undermine its claims to security. In particular, the following attacks on WEP are possible:
ATTACK ON TEMPORAL KEY INTEGRITY PROTOCOL (TKIP)
The TKIP attack uses a mechanism similar to the WEP attack that trying to decode one byte at a time by using multiple replays and observing the response over the air. Using this mechanism, an attacker can decode small packets like ARP frames in about 15 minutes. If Quality of Service (QoS) is enabled in the network, attacker can further inject up to 15 arbitrary frames for every decrypted packet. Potential attacks include ARP poisoning, DNS manipulation and denial of services.
Although this is not a key recovery attack and it does not lead to compromise of TKIP keys or decryption of all subsequent frames, it is still a serious attack and poses risks to all TKIP implementations on both WPA and WPA2 network.
