Hi, and welcome to Specialized Attacks: Wireless.
I'm Matt Lloyd Davies. In this course,
you'll learn to identify weaknesses in wireless protocols,
infrastructure, and client devices, and the vectors
used by real‑world threat actors.
You'll also be able to conduct attacks against target infrastructure
in order to gain access to networks and assets,
steal information, and deny access to systems.
Before we dive into exploring the wireless attack surface,
let's take a look at how different technologies relate to each other.
There are two important parameters when it comes to
comparing wireless protocols.
First, we have range, which is the distance wireless signals
can travel, and then we have data rate,
which is the number of bits transmitted from one
device to another in a given time.
At the lower end of both of these parameters we have
near field communications, or NFC.
NFC, which operates up to a range of a few centimeters, is used for
things like electronic identity confirmation,
access control key cards, and contactless payment
systems. With a slightly longer range,
typically up to about 30 feet, and a higher data rate, we have the ubiquitous
Bluetooth. With the same range, but with lower data rate is Bluetooth Low
Energy, or BLE, which is a variant of Bluetooth specifically designed for use in
systems that require low power consumption, such as wearable technologies.
Thread is a low‑power and low‑latency wireless mesh networking protocol
developed specifically for IoT systems.
IoT systems don't typically require high data rates, so
Thread is comparable to BLE in this sense.
However, Thread has a longer range of about 100 feet,
which offers greater flexibility for IoT systems than Bluetooth.
Next up,
we have the familiar 802.11 Wi‑Fi protocol. When using the traditional 2.4 GHz
band, Wi‑Fi access points generally have a range of up to 150 feet indoors and
300 feet in open areas. When operating at 5 GHz,
the range is reduced, but the data rate is increased.
Mobile radio signals are more complex, as there is a mixture of
technologies and factors that influence both range and data rate.
However,
they're typically capable of traveling up to several kilometers, but with range
reducing with increasing frequency from 2G through to 5G.
However,
the opposite is true for data rate with 2G signals capable of
transmitting just 64 Kbps and 5G reaching 10 Gbps. Finally,
we have a wide range of proprietary protocols broadly spanning
both data rate and range to meet the specific requirements of an
individual device or technology.
We can't cover attacks against all of these technologies in this course,
so we'll focus on Wi‑Fi as the protocol that you're most likely to
encounter during a penetration testing engagement. When approaching a
penetration test that includes Wi‑Fi in its scope, there are three key
areas you should focus on.
First, the protocol, which includes the structure and contents of wireless
frames, in particular, management, control, and data frames.
Next, the infrastructure,
the devices that make up the backbone of the wireless networks
such as access points and wireless routers.
Finally, clients, where we can target users or their devices.
Let's take a look at each of these in more detail. Attacks
against the Wi‑Fi protocol fall broadly into two categories.
Firstly, authentication attacks, which can be as simple as
connecting to an open access point.
But we can also use techniques to find hidden access points
or bypass MAC filtering, which may be enabled as a security
measure on a target access point, both of which we'll see in later demos.
The second area of focus is encryption.
Our approach to this will depend on the security settings of the access
point. Cracking 104‑bit WEP can be done in around 1‑2 minutes.
WPA2‑PSK uses the much stronger AES encryption algorithm. Brute forcing an
8‑character WPA2 key on _____Nvidia 980 GPUs would take nearly 100 days, but if
the password is weak, then the encryption protocol may be vulnerable to a
dictionary attack, as we'll see in a demo later.
Once we have the key, we can decrypt all traffic sent between
the client and the wireless access point.
There are many different types of attacks that can be used
to target Wi‑Fi infrastructure. At the most basic level, we
can try default credentials.
Why go to the effort of carrying out a complex attack when
the key to the door is on the internet.
The TP‑Link access point used for demos in this course,
for example, has default credentials of _____ admin,
admin.
More sophisticated attacks include denial‑of‑service attacks and
creating fake access points that look legitimate to trick users into
connecting to a system under our control.
We can also take advantage of user convenience features
such as Wi‑Fi Protected Setup, or WPS.
As with infrastructure attacks, client‑based attacks
are many and varied, and again,
there are opportunities to take advantage of user convenience
features. When a user connects to a wireless access point,
the operating system remembers it so that it can connect to it again if it comes
within range. If we create a fake access point that looks just like the
legitimate access point and move within range of the user, we can force that
device to connect to a system under our control.
We can also target clients to crack WEP and WPA without even
needing to interrogate the access point.
Throughout this course,
I'll make some assumptions about what you know. You should have
a basic working knowledge of Kali Linux and be comfortable
working at the Linux command line.
You should also have a good understanding of networking and be able to
configure wired and wireless network interfaces. As this course is about
wireless security, I'll assume that you have a basic understanding of the
wireless protocol and the packet headers.
So we'll focus on wireless frames at the data link layer of the OSI model.
Finally, you should be familiar with basic radio concepts,
such as frequency, decibels, data rate, and range.
Let's now take a look at how we can build a wireless test environment so that
we can try out some of the techniques we've talked about.