Because wireless communication uses broadcast technology, essentially sending your data packets in every direction for anyone to grab, it makes it a great target for attackers. Learn how to use tools like Aircrack-ng and Wireshark to sniff and grab packets. Also understand the different types of attacks available to you, such as evil twin, deauthentication, fragmentation, credential harvesting, exploiting WPS weaknesses, Bluejacking, Bluesnarfing, RFID cloning, jamming, and repeating.
- So when was the last time you plugged up your laptop or your cell phone into anything else other than a wall socket to get power? Most of the times, if you want to communicate with anything else, you do it wirelessly. We don't need wires for communication anymore. Now clearly, there's still wired networks out there. There's lots of them, especially in a data center, but when you get further and further away from the servers, more and more connections are going to be wireless. We're going to use wireless WiFi, RF, radio frequency communication and when we do that, we're just opening kind of a can of worms when it comes to security because wireless uses broadcast technology.
That means that you got a transmitter that's broadcasting your data packets all over the place in all directions most of the time. That means that all you need to sniff that traffic is a wireless receiver and as long as you have a wireless receiver that's in range, you can grab all the network traffic you want and do with it what you want. It means that the man in the middle attacks is no longer man in the middle, it just means man close by kind of attack. Common tools exist that allow us to do this.
One of the more common tools you'll find across all operating systems is air crack NG. Air crack NG is a tool that allows us to both grab and modify and process wireless transmissions but air crack NG is not the only tool you can use. Remember you can use Wireshark in some cases as long as you have the right operating system. In other words, when you're using Wireshark in Windows, it won't grab anybody else's network traffic, just network traffic that's intended for you.
But if you're using Linux or any other operating system that does support monitor mode, then you can use something like Wireshark and it gives you great feedback on the traffic that's flowing all around you. So let's talk about some of the additional exploits. Evil twin is one particular type of exploit you can use which refers to a wireless access point that's used to eavesdrop. Evil twin is a rogue access point that typically is going to use the same SSID as a valid SSID or a valid wireless access point or WAP and you're going to get your clients or your victims to connect to your evil twin so that you can then interpret all of the data that goes through you.
That way you actually don't have to be in monitor mode. You're communicating, or they're actually connecting to you. One thing that's really popular is if you travel very much, there's probably a handful of maybe a dozen or so SSIDs you probably connect to. If you go to Hilton hotels, they have their networks. All Hilton hotels have a network, a wireless network of H Honors for the Hilton Honors program. So if you have connected to one H Honors program or one H Honors wireless network, chances are you've checked on automatically reconnect so when you come back to the hotel that evening, you just reconnect.
Well if you walk into some coffee shop nowhere near a Hilton property and an attacker has set up an access point with the SSID H Honors, you're going to try to connect to it and that's an evil twin. So that way, you're connecting to another network that's not a real network, but is actually an attacker waiting to grab all your data. Another potential vulnerability which you can use for an exploit would be a karma attack. Karma actually is a self referencing attack.
It stands for karma attacks radio machines automatically. It's actually a device that listens for an SSID request and pretends to be a valid WAP. So this device automatically sets up evil twins based on what the clients are attempting to connect to. You can then use a downgrade attack which is an attempt to negotiate or force a more insecure protocol. Remember when we talked about that with network attacks or different types of network attacks? Again, it's all in communicating with the end point and you have to negotiate the appropriate level of encryption and if you can negotiate a very insecure level of encryption, you can communicate and either see the data in plain text or you can decrypt it very easily.
Another attack would be a deauthentication attack. That's one which is effectively a denial of service attack that disrupts communication between the user and the wireless access point. So again, these are specific types of wireless and RF vulnerability attacks or vulnerabilities we can use as attacks. Continuing our list of wireless and RF exploits, there are fragmentation attacks, which is another denial of service attack that will flood a network with data gram fragments that somebody else has to assemble.
So what you do is you send these fragments or data gram fragments to the other end or to whoever you're trying to attack. The receiving end has to take these fragments and put them together like pieces of a puzzle and when you overwhelm them with too many pieces of that puzzle, it takes too long to reassemble them and effectively makes that node incapable of communicating with anybody else 'cause they're so busy trying to build that little puzzle. So that's denial of service attack. We can also launch credential harvesting attacks.
That's a process of capturing or discovering valid login credentials. We can use social engineering or any other means to harvest these credentials. One of the easiest type of credential harvesting if you have physical access to client devices, especially somebody's laptop's sitting at their desk, if you can roam around without being disturbed, chances are if you can look at the back of monitors, the front of monitors, or underneath keyboards, you don't have to look at too many workstations until you find a little yellow Post-It note with credentials listed on them.
That's the easiest type of credential harvesting. We can also engage in other types that are more technical in nature, social engineering, or purely technical types of attacks but the idea is grabbing credentials so that we can login as authenticated users or as authorized users. And lastly, we can use WPS implementation weaknesses attacks. Those are specific attacks set up for, made for the ease of use in connecting to new wireless networks.
If you were to buy a printer, let's say you have a printer that supports wireless and you take it home, most new devices such as printers have the ability to connect to WPS wireless access points. It basically means that you press a button on the printer, you go press a button on your router or your gateway or your wireless access point and they'll negotiate with each other and basically exchange the PIN without you having to type anything in.
While that's extremely convenient, if it's not implemented well, anyone who's monitoring that wireless channel can intercept and grab those network packets going back and forth and can determine what the PIN is and once you grab that PIN, then the attacker can connect to your network as well without you knowing about it. So that's a short list of vulnerabilities but again, it's not the end of the list. We've talked mainly so far about WiFi.
So when we refer to wireless, wireless is bigger than just WiFi. WiFi tends to talk about or tends to focus on the 802.11 standard which is what we currently kind of assume when we talk about a wireless connection but remember, there are other protocols out there. One of the more popular other protocols is Bluetooth protocol. The Bluetooth protocol allows devices to connect at a very close proximity. It doesn't quite have the range of WiFi, especially the newer versions of WiFi, but it's very convenient for connecting things such as keyboards, mice, even data repositories, and speakers.
There's lots of reasons why we want to use WiFi, or Bluetooth, excuse me, but it also opens us up to more exploits. Several different Bluetooth oriented exploits include bluejacking. Bluejacking is sending unsolicited messages to a Bluetooth enabled device. In fact, there was a particular type of bluejacking that was fairly early on in the Bluetooth phenomenon lifecycle called the car whisperer.
The car whisperer allowed an attacker to connect to Bluetooth enabled devices and the idea was to be driving along the highway and when you run into a car that has Bluetooth enabled, which very many have now, you could actually co-opt that connection and connect to the car's speaker. You could actually talk to someone in another car and it was really weird because you're driving along and all of the sudden, boom, you hear somebody else talking. So that was called the car whisperer and that would be an example of bluejacking.
Bluesnarfing is kind of the other way, or instead of sending Bluetooth commands and packets, you're actually receiving them. So you're stealing information from the Bluetooth enabled device. If we move to other types of technology, we can also look at RFID for radio frequency identification. RFID is commonly used for things such as proximity cards. If you ever have a card where you can just walk up and tap it and it will do something, it'll either unlock a door or will allow you to pass through a gate, that is typically RFID and you don't have to be in physical contact, it just has to be close to the reader.
If you could take that RFID transmitter and clone it into a new card, then you could pretend to be the owner of the original RFID card. So it's unauthorized copying of a device's RF signal. So that is allowing a copy but what if you wanted to stop RFID? Well you can using jamming. Jamming is a denial of service attack that disables communications among devices. Now it's not a stealthy attack at all.
Whenever you jam something, what you do is you saturate the network bandwidth so that nobody can communicate. You may have heard of jamming when it comes to military aviation, fighter jets or bombers actually if they're going in to bomb a particular target, oftentimes there would be an electronics warfare aircraft that went along with the bombers that would jam signals so that the defenders would not be able to use their radar or their electronic devices to defend their target so the bombers would be able to get through.
Same idea. It's very loud and it announces the fact that somebody's there, it just doesn't allow any communication to occur because the network bandwidth at a particular frequency range is saturated. And finally, repeating is receiving and transmitting or retransmitting a signal to increase range. Now with older WiFi technologies, specifically the 802.11 technologies that are slightly older, before the N and AC and newer protocols and standards had limited range.
So if you had a large expanse and you wanted to have a wireless network over a very large area, you would have to have the primary access point then before the signal actually waned and was undetectable, you would put another device that would receive that weak signal then retransmit it so that you extended the range which is great for utility value. However, it allowed attackers more of a coverage area to be able to sit by and attack the system.
So it's a good and a bad thing. Repeaters can extend the range but also provide easier access for an attacker. So the moral of this whole story is use wireless. Use WiFi, sue Bluetooth, use whatever wireless technologies you want. However, remember that an attacker can see everything that is transmitted in the clear so you need another layer of controls and most of the time, that's encryption. Encryption will defeat many types of wireless attacks so you really can get rid of a whole layer by using good, strong encryption but continue to use wireless, just use it securely.