[Autogenerated] after discovery of webs weaknesses started to grow.
The wifi alliance set about developing a new and more robust protocol,
Wifi protected access or W P A WPA was released in 2003 and was intended as
an intermediate measure to address vulnerabilities in WEP.
In anticipation of the availability of the more secure WPA to W P A is more
secure than WEP because it uses a 256 bit key for encryption rather than the
64 bit and 100 and 28 bit keys used by web.
W P A also uses the temporal key integrity protocol skip,
which dynamically generates a new key for each packet.
In addition,
WP A uses message integrity check rather than cyclic
redundancy check for verifying data integrity.
However, Teak IP which like WEP uses the RC four.
Cipher stream was designed to be implemented onto WEP
enabled systems via firmware updates.
This resulted in W P A.
Still relying on easily exploitable elements of the web protocol.
W P A two, which was released in 2004,
is the second generation of W P A and significantly improved security with
the introduction of the advanced encryption system A yes.
To replace the more vulnerable Teak IP in W P A to the counter mode with
cipher block chaining message authentication code protocol or CCMP
replaces ticket and is the first wifi encryption protocol not to be based
on our C four cc M P is also used in place of message integrity check for
data integrity verification.
However, like its predecessor,
W P A to also suffers from vulnerabilities associated with WEP
unless WEP is disabled on the access point,
WPA two also requires the most processing power of the encryption schemes.
In 2018,
the wifi alliance announced the release of W P A three which has
a number of security improvements over W P.
A.
To most notably the replacement of A S with simultaneous
authentication of equals encryption.
But it's not yet seeing widespread use the W P A.
Four way handshake begins with an initial probe request and response
that associates the client and the access point.
To be able to authenticate both the client and the access
point need to know the same secret known as the pair wise
master key or P M K for W P A and W P A.
To personal.
The P M K is the pass phrase for WP A enterprise.
It's slightly more complex and is beyond the scope of this course,
the access point and the client also know their own and each other's
MAC address is because they've already started communicating.
However, to introduce the challenge element,
each must generate a pseudo random number known as a nonce.
The access points, nuances,
the authenticated or annoyance and the clients is the supplicant
nonce or the four way handshake begins with the access point
sending the annoyance to the client.
The client now has all the information needed to create an
encryption key called the pair wise transient key or P.
T.
K.
The client responds to the access point with its own essence and
because it's already derived the PDK it can protect the essence
with the message integrity code or ____.
Now it has the essence.
The access point can generate the P.
T.
K.
And used the Mc to make sure it wasn't tampered with in transit.
The PDK is used for uni cast encryption which allows communication
between the access point and a single client.
However, there's also a need for one to many communications.
So the access point also creates a group temporal key or G T K.
Independent of the authentication of four way handshake process
which it make protects and sends to the client.
The client can now install both the P.
T.
K if it hasn't already and the G T K.
And then out of courtesy response to the access point with an
acknowledgement to confirm it is received and installed the keys and
is ready to send and receive encrypted data.
I know what you're thinking that looks pretty secure.
How can we break that?
Well let's review what we need to authenticate to an access point first
we need our own MAC address and that of the access point as well as the
authenticator and supplicant nonsense.
Finally we need the P M.
K.
Which for our W P.
A.
To personal network is the access points pass phrase.
However, the P.
M.
K.
Is the one thing we don't know because all of the other elements can
be obtained if we can capture a four way handshake.
But what use is that if we don't know the P.
M.
K.
Well if an attacker can sniff the mac addresses and the
_____ they can start guessing the P.
M.
K.
To see if it results in a successful authentication.
There's no form of lockout with W.
P.
A.
So the attacker can try as many P.
M.
K.
Guesses as they like.
So if the attacker uses a list of guesses and
automates the authentication process, they could quite quickly find the PM.
Kay.
That gives access to the wireless network.
Let's give it a go.
We'll start by reconfiguring the access point.
tiers WP.
A.
Rather than web.
We navigate to wireless and then wireless security and select the W.
P.
A slash WP.
A two radio button and set a suitably challenging password.
We'll start the attack by launching a road dump.
As we've done previously specifying the B.
S.
I.
D.
The channel and the prefix for the capture file name.
We then wait until a client authenticates the access
point and open a new terminal.
We can now run air replay with the dash zero option to launch A.
D authentication attack.
This will bump the legitimate client off the network
and force them to re authenticate.
When this happens.
We'll capture the four way handshake with aero dump and use it to
start the dictionary attack as a pen tester.
You'll want to develop your own password lists for attacks
like this and other dictionary based attacks,
making them more specific to your targets.
However,
Cali has a number of built in password lists located
in the user share word list folder.
These are good general purpose password lists that you can use
as the basis for your own customized lists.
One of the most popular dictionaries is Rock You,
which will use with aircraft to try and crack the W P A P M K.
We run air crack with the dash W option to specify the
location and name of the password list,
dash B to specify the mac address of the access point and the name of the file
generated by a road dump containing the four way handshake.
This attack will only work if the P M.
K.
Happens to be in the password list and the speed with which it's
found is dependent upon where in the list it lies