[Autogenerated] shared key authentication is a verification
process used to gain access to a wireless network that uses the
wide equivalent privacy or web protocol.
web was introduced in 1997 and was cracked by 2001.
So it's pretty much an obsolete protocol but you may still encounter
it in the environments that don't like change.
Such as manufacturing and industrial networks.
Microsoft started to disallow connection to WEP
encrypted wireless networks in 2019.
So the Windows 10 client in our lab setup won't be
able to connect to a web network.
Have therefore introduced a new Linux based client to the Wi-Fi lab.
The WEP encryption scheme is pretty straightforward.
It involves a plain text message being encoded with a pseudo random key based
on a secret known only by the client and the access point.
The details aren't particularly important but to understand the attack,
it's worth looking specifically at the challenge and response aspect.
When a client wants to connect to a weapon,
cryptid network, it first sends an authentication request.
The access point responds with a plain text challenge which the client x.
source with a key stream that contains a secret known
only by the client and the access point.
The cipher taxes then sent back to the access point which confirms that
the plain text challenge has been correctly encrypted.
If it has then the client must know the key and so
it's permitted access to the network.
However there's a problem with this scheme.
An attacker within range of the wireless network can sniff the entire
authentication exchange between the client and the access point.
And in particular they can capture the plaintext challenge
as well as the insight offered response.
The attacker can now derive the key stream by
exploring these two pieces of information.
It's worth noting that the key stream is not the
wireless network password or key.
Instead it's a pseudo random number made above a number of variables
including the secret Armed with the captured key stream.
The attacker can now make an authentication request to the access
point which sends a plain text challenge that the attacker exhaust
with the key stream to create an encrypted version of the challenge
and sends it back to the access point.
The access point confirms that the challenge has been correctly encrypted
with a shared secret and grants access to the network.
So we've seen the theory.
Now let's put it into practice by sniffing a web authentication exchange
between a client and an access point and using the captured key stream to
authenticate our device to the access point.
Let's start by configuring the access point to use WEP by selecting wireless
and then wireless security we changed from no security to weap change the
authentication type two shared key and enter a suitably complex key in a
terminal We launch error dump as we did before.
But this time we use the dash W option to specify that we
want to save the captured packets to a file.
The value following the dash W option key stream is used to prefix the file name
and soon enough a client associates with the access point.
We can now stop arrow dump which has created a number of files including a
capture file readable by Wireshark a CSV version of the capture,
a log file and kismet compatible equivalent.
The file we are interested in however,
is the one ending with X or which is the key stream file we need
to use to authenticate with the access point.
Let's fire up Wireshark when we launch the attack,
we'll spoof a mac address so we'll use a filter based on this MAC address to
focus only on packets related to our authentication exchange.
Next we launch air replay with the dash one option to send a fake
authentication request followed by zero to specify no delay.
We then use dashi to provide the name of the target access point
and dash Y for the name of the key stream file.
Finally we used a to specify the mac address of the access point and
dash h to specify our own MAC address which will spoof.
But almost immediately we see that the authentication request was sent.
The challenge was received and responded to and confirmation is received
that we've successfully authenticated to the access point.
This is then followed by a successful association.
Well that was easy.
Let's check in with Wireshark to see what has happened in this first packet.
We see the authentication request which confirms that we're using a shared
key and that the request was successful in this packet.
We see the challenge sent by the access point.
And in this next packet we see the response which is the challenge X
Sword with the key stream we captured earlier.
The authentication request is completed with an authentication success message.
Finally,
an association request responses made successfully and were connected to the Web
protected access point despite not knowing the shared key.
Next up,
we'll look at cracking WEP keys rather than simply bypassing
authentication and will tackle a much more challenging encryption
protocol in the form of wifi protected access.