Wireless Hacking
Wireless Hacking
The popularity in Wireless technology is driven by two major factors: Convenience and Cost. A
Wireless Local Area Network (WLAN) allows workers to access Digital Resources without being
locked to their desks. Mobile users can connect to a Local Area Network (LAN) through a
Wireless (radio) connection.
Basic Terminologies in Wireless connection
• Access Point: Device which is transmitting the Wireless Network.
• SSID: Name of the Wireless Connection. It is also known as the ESSID.
• BSSID: MAC Address of the Wireless Device Access Point.
• Channel: Frequency of the Wireless Network.
• Power: Strength of the Wireless Network Signals
Wireless Security Overview
• Two methods exist for authenticating wireless LAN clients to an access point: Open
system or Shared key authentication.
• Open system does not provide any security mechanisms but is simply a request to make a
connection to the network.
• Shared key authentication has the wireless client hash a string of challenge text with the
WEP key to authenticate to the network.
War Driving
• War Driving is detecting the Wireless Networks and checking out their properties.
• WAR Driving is of two types:
o Active War Driving
o Passive War Driving
Active War Driving
• Active War Driving is detecting the Wireless Networks whose SSIDs are broadcasted or
the Wireless Networks which are shown to all the Wireless Adapters.
• It can be done through any Wireless Card.
Passive War Driving
• Passive War Driving is detecting the Wireless Networks whose SSIDs are not
Broadcasted or the Hidden Wireless Networks.
• The Wireless card should support the Monitor Mode.
WEP Key Cracking
• Wired Equivalent Privacy (WEP) was the first security option for 802.11 WLANs. WEP
is used to encrypt data on the WLAN and can optionally be paired with shared key
authentication to authenticate WLAN clients. WEP uses an RC4 64-bit or 128-bit
encryption key.
• The process by which RC4 uses IVs is the real weakness of WEP: It allows a hacker to
crack the WEP key.
Applying the Wireless Security
Hide the Wireless Network: Do not broadcast the SSID of the Wireless Network. This will
help you in protecting your Wireless being invisible to the people who do not know about
Passive War Driving.
Use a WEP Key: You can use the WEP Key protection on your Wireless Network to protect
your Wireless Network Connection. Although this is not the ultimate security measure but will help you a lot against
the Script Kiddies who do not know how to break into the WEP
Protection.
WPA: Wi-Fi Protected Access: WPA employs the Temporal Key Integrity Protocol (TKIP)—
which is a safer RC4 implementation—for data encryption and either WPA Personal or WPA
Enterprise for authentication.
WPA Enterprise is a more secure robust security option but relies on the creation and more
complex setup of a RADIUS server. TKIP rotates the data encryption key to prevent the
vulnerabilities of WEP and, consequently, cracking attacks.
Mac Filtering: An early security solution in WLAN technology used MAC address filters: A
network administrator entered a list of valid MAC addresses for the systems allowed to associate
with the Wireless Access Point.
Choosing the Best Key: Always use a long WPA Key with lower as well as upper case letters
including numbers and special characters.
A Sample Key: 12345@abcde&FGHI