All
right, creating an inventory of wireless devices.
You should know what is nearby, what's authorized, and what's not authorized.
So we'll call that a site survey.
It's creating a list.
You have asset inventory of allowable
wireless devices, documentation of their MAC addresses, but
creating an inventory is just running the scanner.
Tools like acrylic WiFi heat maps and a
bunch of other site surveying utilities can be used to map out wireless devices.
The placement of wireless AP.
This is a balance between enough signal and too much signal.
In a nutshell, the guidelines for AP mounting, place them in central locations
because typically they are omnidirectional.
Install on a ceiling, avoid placing APs too high on ceilings,
avoid mounting on a wall, it may restrict its 360 coverage, avoid installing in
corridors, above suspended ceilings, locks and plastic sterile encloser to secure the
AP from theft, avoid closing in a metal cage that tends to degrade the signal if
not encapsulated entirely, keep it entirely.
Keep it away from metal objects, which causes obstruction.
In a nutshell, here is your organization, and here's your perimeter.
Let's say that you've got several buildings on the campus.
Let's say you have a moat around your facility, the nice big circle here, but
you want your APs to give you enough coverage so that you have enough signal,
but it doesn't bleed out across your security parameters.
More often than not, you're probably not
going to have a moat around your organization, but you want to draw a
physical boundary and you want your APs to be positioned, and you call this cell
sizing, to position so that the signal doesn't bleed over your borders.
Enough coverage internally, overlapping
coverage if necessary, but nothing that extends past the corporate perimeter.
You have the same considerations with any type of control zoning and so forth.
You want to be sure that you have enough coverage.
Hold on, I'm skipping gears here to physical control zones.
Light sources, again, need to provide adequate coverage.
Light sources can overlap.
That's not a problem.
But when you look at your light radiuses, you want them to be overlapping.
There should be no laps of coverage.
Same consideration through light sources.
You need to have adequate continuous coverage.
Let's play some of the wireless AP.
Place with a wireless antenna. We'll try on here.
It all boils down to your site surveying
utility and whether or not the signal is adequate.
Can you hear me now?
You're going to walk around the perimeter.
You're going to use a meter and make sure
that you've got adequate uniform coverage everywhere.
You don't want any dead spots.
Some of this may or may not apply,
depending on the antennas, avoid keeping the antenna at a 45 angle degree.
Remember, it wants to radiate outwards
horizontally, so when you do it like this, you get this disk radiation.
When I point the antenna gain towards users.
You have directionals pointing inward.
That's always helpful.
Then your adjustment of your power levels,
your cell sizing, allows you to expand or contract your radius.
There we go. Diameter, perimeter.
Our disabling SID broadcasting.
It's recommended, but when you disable SID
broadcasting, it typically shows up in your wireless clients as hidden network,
which always makes me a little bit more suspicious.
What you hiding from there?
Disabling SID broadcasting is recommended.
Selecting strong wireless encryption mode,
use the latest greatest, WPA3, and this is the order for choosing encryption mode.
Wpa3, enterprise the radius, enterprise PSK, all the way down.
Our dependent against WPA cracking, use
random pass phrases not made up of dictionary words.
Dictionary lists are going to take less
time to run because there's just fewer possibilities.
Brute force, on the other hand, is going
to take a lot more time because there's more variations.
We talked about this already a bit in password cracking.
Select a random passphrase not made up of
dictionary words that wouldn't appear in a word list.
Select a complex passphrase with a minimum
of 20 characters and change the passphrase at regular intervals.
I'll give you an example.
The key rate for cracking an N TLM hash.
My ESX box, one of my VMS will crank along at about 12 million passwords per second.
12 million trials per second.
That's a lot.
When you fire up like
Aircrack and Aircrack NG, it rocks about 2,000 keys per second.
2,000 versus 12 million.
Quite a bit slower. It is.
It's a lot more complex.
Mathematically, you can still do it.
It just takes a lot more time.
Anything that's 20 characters long would take a long time to crack.
That's brute forcing.
There's other types of attacks against wireless.
You have WPS attacks if you're using WiFi
protected set up, which is a good case for not using WiFi protected set up.
There's also expediting this with password
cracking pods and GPUs, so you can definitely speed things up.
But that complex passphrase is going to be pretty secure.
There was a vulnerability discovered
called crack, which was a key reinstallation attack for years.
Wpa2 is pretty darn secure, depending on the complexity of the passphrase.
The crack vulnerability was the ability to renegotiate a null encryption key.
That was on the transport encryption.
It wasn't the PSK, it was nulling the key values for the transport encryption, and
that got patched pretty quickly once the vulnerability was discovered.
Select client settings properly.
In the lab, you're going to go through the configuration of a wireless access point.
So I'll show you some examples.
Use a VPN such as a remote access VPN, extranet, intranet, etc.
Implement a network access control or network access protection solution for
additional control over end user connectivity.
Detecting rogue access points.
I had a student from a Microsoft course from years ago, hit me up out of the blue.
This guy owns a company and they service a lot of college campuses.
One of the college campuses here in Florida, they're having some problems.
He gets in touch with me, he say, Hey,
Eric, you know, I understand you're teaching CH stuff now and got a problem.
They're going to run by it. Hey, no problem.
What do you got? Well, we got a rogue access point.
We can't find it.
It's like a rogue access point, can't find it.
Okay, what do you mean?
Well, we know it's there, but we can't find it.
Okay, that sounds like a conflicting statement.
What do you mean you know it's there? Well, we see it.
Okay, where do you see it?
We actually see it in our nearby networks. They're scanning for it.
They're seeing the beacon frames. It's announcing its presence.
Okay, great. Why can't you find it?
Well, we're scanning for it on the network and we can't find it.
It's like, all right, so it's not connected to your network.
You've got somebody that's using an internet connection.
They're impersonating your access points
and they're using that for a man in the middle evil twin thing.
Yeah, no problem.
Go get yourself a YAGI antenna and a 4 inch desktop tripod.
Hold that thing like a gun and just swing it right and left until you get
the strongest signal and then just walk towards it.
Sure enough, a couple of days later, we found it.
They narrowed it down to one of the dorms, found the rogue AP in one of the rooms.
So wireless scanning is looking for...
If there's a wireless device there, you're going to see it.
Unless it's dormant, you're going to be working on a standard channel.
It's pretty difficult to hide that.
If it's there, you're going to see the signal.
So perform wireless network scanning to
detect the presence of wireless APIs in the vicinity.
Any wireless client should be able to do that.
So any cell phone, anything that can scan for nearby networks would work.
Now, we've got some cooler equipment for
that, flip meters and air magnets and that thing.
But anything that sees those beacon frames is adequate.
All right, wired network scanning.
Can you run a scan like Nmap to identify
APIs on the network helps locating road devices.
You're actually scanning Nmap.
There's also plug ins for Nessus from the wired side.
So sometimes employees or malicious
insiders or whatever connect device to internal network, and
that gives you outside access from the outside world.
Sometimes it's just an employee that doesn't think twice, they do it.
Sometimes you see the same repeat offender over and over again, but it happens.
So you can scan it wired side, of course,
you can be looking for them through wireless.
Simple network management protocol
polling, SNMP polling can also be used to identify managed rogue access points.
That's another option.
All right, so wireless security tools.
Cisco Adaptive Wireless IPS, it provides wireless network threat protection and
mitigation against malicious attacks and security vulnerabilities.
There's lots of commercial wireless
security tools, Air Magnate or protect and WiFi cracker, etc.
All right, configuring administrative security on wireless routers.
Generally, that is a administration page through a web based interface.
It's always recommended you don't allow admin interfaces to the public connection,
and you're going to be walking through a pretty comprehensive lab.
It touches on a lot of these settings.
We're going to be going through and configuring a L inksys WRT router.
Speaking of configuring administrative security and routers, again, your lab is
going to take you through a bunch of these settings.
Now, again, it's showing you some things
to consider, and I'll, again, comment on that in the lab, but it'll take you
through some of the various settings that you should pay attention to.
All right, and that's going to wrap up Module 11, wireless network security.