Practical WLAN security

Eldeklint, Jon Gunnbäck, Johannes

Email: {jonel563,johgu901}@student.liu.se
Supervisor: David Byers, {[email protected]}
Project Report for Information Security Course
Linköpings universitetet, Sweden

Abstract 2.1 802.11 Standards

This report covers the basics security standards in The architecture of the wireless LANs is specified by
today’s wireless networks, how they work, existing flaws the 802.11 standard created by IEEE [1]. There are a few
and vulnerability’s. We will go trough the basic versions of the standard with differences in frequency
architecture of 802.11, the security it provides like WEP, and speed. Briefly these are a few of the current
WPA and WPA2. Further more we will go trough some standards
practical experiment exploiting the flaws described in the
article. The result of our practical experiments show upon 802.11 (1997): 2.4Ghz, 2Mbps
how easy it is to break encryptions and deploying Evil
twins, even with very little understanding of the security 802.11a (1999): 5Ghz, 54Mbps
structure.
802.11b (1999): 2.4Ghz, 11Mbps

1. Introduction 802.11g (2003): 2.4Ghz, 54Mbps

Where ever you go, either it’s an workplace, coffeeshop,
library or even a park there is a high chance today that Even when things like speed and frequency differ,
you’r able to connect to wireless networks. However, with most things are the same as the original 802.11 standard.
the rising accessibility of Wi-Fi, this also makes attacks They all are using the same medium access protocol,
more likely to occur, both from intentional and non- CSMA/CS and have features for increasing range by the
intentional attackers. Intentional as hacking into your cost of speed. They also support the two connection
network or non-intentional when you connect to the wrong modes of ad-hoc and infrastructure, but since this reports
accesspoint. Our goal with this paper is to show how easy it is about practical WLAN security we'll not go any
is to exploit vulnerabilities in the wireless networks of further in on that and just care about the infrastructure
today. mode.
We’ll describe the fundamental architecture of 802.11
networks and the security it provides. To give a higher 2.1.1 Architecture
understanding for some of the problems that exists with the In a wireless LAN in infrastructure mode the
security standards. With easily accessible software and mainstay is basic service set. The BSS is containing the
tools we’ll show two experiments that exploits these wireless stations that can be anything from laptops to
vulnerabilities. First in line is how weak the old security mobile phones. Those stations are connected to an
standard WEP is. The second experiment will be to deploy accesspoint.
an Evil Twin accesspoint to show that there is not only the
technology that is unreliable. 2.1.2 Frames
2. Background The 802.11 standard define a lot of different frame
types that wireless stations uses for communication,
In this chapter we’ll cover basic architecture in managing and controlling the link. All frames has apart
802.11 networks and the security standards it provides. from fields about sender and destination station a control
field that contains information about 802.11 protocol
version and other things like if some encryption is turned
on, etc. There are also fields for frame sequence numbers able to achieve this there are three main goals with WEP
and error checksum. that needs to be enforced:
Apart from the normal data frame 802.11 specifies Confidentiality which is intended to prevent a
three common control frames, the Request to Send possible attacker from eavesdropping. Encryption is
(RTS), the Clear to Send (CTS) and the applied to achieve this.
Acknowledgment (ACK) frame. The RTS/CTS starts the Access control to protect access to the wireless
transmission by requesting for channel time and receives network from the wrong users. A feature included in the
permission to send from the target with a time slot that 802.11 standard is to drop all packets not correctly
makes all other stations to hold off transmission for that encrypted with WEP.
time. More interesting than the control frames are some Data integrity to prevent tampering with transmitted
of the management frames: messages. WEP uses a integrity checksum for this.
Authentication: Authentication in 802.11 is for To fulfill the above goals, as mention before, WEP is
identifying a station to the access point and se if it's using checksums and encryption. WEP relies on a shared
accepted to connect. It also serves for making a secure secret key k shared between all parties in the
connect over WEP or so via a challenge-respond communication. Here follows a short description of how
sequence. the encryption algorithm works:
Deauthentication: A station sends a deauth frame to First a integrity checksum is calculated c(M) on the
another station if it wants to terminate the secure session. message M. The message and the checksum is put
Association request: enables a accesspoint to allocate together to form the plaintext P=<M,c(M)>. After the
resources for a new station. The frame contains plaintext is created it will be encrypted using RC4. A
information about the station and what SSID (Service set initialization vector (IV) v is chosen and together with
identifier) it wishes to connect to. the shared key k the RC4 algorithm will generate a long
Association response: the accesspoints response to an sequence of pseudorandom bytes i.e. the keystream
association request. If the accesspoint accepts the RC4(v,k). When both the plaintext and the keystream
connection the frame contains information about the has been created a exclusive-or is preformed to preduce
association like supported data rates and it's association the ciphertext C. This is denoted C=XOR(P,RC4(v,k)).
id. Finally the IV and ciphertext is transmitted from sender
Reassociation request: if an station is on the move and A to receiver B, A→B : <v,C>. When the packet arrives
finds an other accesspoint with a better beacon signal, at the receiver it will be decrypted simply by reversing
the station will send a frame for reassociate with the new the encryption process. First regenerate the keystream
accesspoint. The new accesspoint is suppose to handle RC4(v,k) and XOR it against the cipher text
forwarding of eventual data frames buffered by the old P=XOR(C,RC4(v,k)). Finally the receiver will split P
accesspoint. into <M,c> and recalculate the checksum c(M) and
Reassociation response: like the normal association compare it the checksum in the message to validate that
responde frame this frame contains information if the its the right message received. [3].
connection is accepted. More information about the
association like it's id etc. is sent. 2.3 WPA (Wi-Fi Protection Access)
Disassociation: A station sends one of those frames to It was quite fast obvious that WEP had some major
another station if it wants to terminate the session. problems so IEEE started to work on a new security
Beacon: The accesspoints send in intervals standard named 802.11i but it had taken far to long time
information in beacon frames about that it exists and to wait for IEEE to complete the new standard before
relay information like SSID and timestamp securing the wireless networks. So instead of waiting for
Probe request: A station sends one probe request a new standard that would require new hardware because
when it wants to know more about another station, for of the switch of encryption algorithm, a fix that
example a client might send a probe to find accesspoints combined parts of the new standard with the old
in it's range. hardware had to be made. In 2002 the Wi-Fi Alliance
Probe response: As an answer to the request a station combined the TKIP (Temporal key integrity protocol) of
can send a probe response containing information about 802.11i with the RC4 cipher of WEP. To protect WPA
capability, supported data rates and more. [2] against the weaknesses in WEP a set of algorithms are
used in TKIP like the Message Integrity Code for
2.2 WEP (Wired Equivalent Privacy)
avoiding forged packages, but since the abbreviation
The Wired Equivalent Privacy protocol was MIC already is used, the algorithm is called Michael
introduced into the 802.11 network standard to provide instead. Michael uses a 64bit key and partitions packets
the same level of security as in a wired network. To be
into 32bit blocks, then shifting, applying XOR and The 802.11 standard use the MAC address of it's
additions to calculate a 64bit authentication tag. devices a lot for identification, these are however very
For protection against replay attacks there is a new easily spoofed.
discipline on packet sequences, the TKIP simply mixes If that wasn't enough there is an other problem,
the sequence number into the encryption key which 802.11 management frames are not protected even if it's
make a replayed packet get catched as an ICV (Integrity data frames are, this results in that it's possible to forge
Check Value) or MIC failure. management packets which can make some trouble if the
For avoiding the usual cryptanalysis attacks that can accesspoint gets flooded with association frames or
be made on WEP like FMS, chopchop etc. there is a stations receives false deassociation frames. This is used
function for mixing the 128bit WEP key per packet, that to make several other attacks possible.
takes the base key, transmitter MAC and the sequence
number of the packet. 3.2 WEP
The MIC countermeasures in TKIP consists of In chapter 2.2 we described the goals for WEP and
requiring a rekey after detecting a invalid MIC and limits how it was provided. This means that WEP is secure
rekeying to one per minute this since the Michael right? Wrong!
algorithm is too weak to stand alone. However false Here follows a short description of the fundamental
positives is calculated to only appear about once per flaws in WEP and show how all three main goals is
year. [19] [4] broken.
If we look pass the general weaknesses of the
2.4 WPA2/RSN (Robust Secure Network)
infrastructure in 802.11 networks that can affect WEP
The latest and currently most secure feature for we have a few weaknesses in the protocol itself. The
wireless network security today is WPA2. As in WPA most serious problem is the RC4 algorithm and the use
the WPA2 protocol also supports IEEE 802.1X/EAP of so called weak keys. The RC4 algorithm is
authentication or PSK (pre-shared keys) technology. The implemented in a non-standard way and uses a 24-bit
strongest difference between WPA2 and WPA is that public IV together with the secret key, and the IV is sent
WPA2 use AES-based algorithm CCMP(Counter Mode in the clear. This is enough data to perform
with Cipher Block Chaining Message Authentication cryptanalysis. Gain access to the secret key is all you
Code Protocol) instead of RC4 which provides longer need to be able to break all three goals in WEP. Even if
keys and is overall a lot stronger encryption algorithm. the attacker don't manage to recover the key its still
The drawback is that WPA2 is not compatible with possible to recover all different types of keystreams.
current hardware for WEP and WPA and need upgrades There exists 2^24 distinct keystreams, a message frame
to work. WPA2 works in two modes. Enterprise mode is up to 1500 bytes long which means that it only takes
which is designed for larger companies and enterprises. about 24GB of storage for all possible keystreams. One
It uses the IEEE 802.1x authentication framework and an way of getting hold of keystreams is for the attacker to
authentication server to provide access to the WLAN. send packets where they know parts of the plaintext in
The second mode uses pre-shared keys and is designed the response.[6]
for homes or small offices that don't have authentication Another flaw in WEP that is easy exploitable is
servers available. Both modes work with the AES keystream reuse. RC4 is a stream chiper and the same
encryption algorithm.[5] key should never be used twice and this is enforced by
the changing IV:s. Weak keys is a key which when used
3. Vulnerabilities in wireless networks with a specific cipher, makes the cipher behave in some
Short cover of security flaws in wireless networks. undesirable way, in the case of RC4 weak keys is reuse
of the same key. Because the IV is restricted to 24 bits
3.1 802.11 there is almost guaranteed that the same IV will be
There is a few problems with the 802.11 standard by reused multiple times. For example an access point
default one of the most annoying and difficult to tackle is sending 1500 byte packets and achieving an average
the fact that since 2.4 Ghz is a open frequency a lot of 5Mbps bandwidth will have used up all distinctive IV:s
devices operates there. You can find everything from in less then half a day. If an attacker can get hold of two
DECT phones to microwave ovens on the 2.4 Ghz messages encrypted with the same IV
spectrum. Having those things around you wireless C1=XOR(P1,RC4(v,k) and C2=XOR(P2,RC4(v,k) he
network may jam the network, at least make it's can xor the two chipertexts to get XOR(C1,C2) =
availability suffer. XOR(P1,P2). There are known techniques to get P1 and
P2 given XOR(P1,P2).
 Furthermore WEP is using the CRC checksum waiting for new ones to connect. The false network
function to verify integrity. The idea with the checksum should be designed so the victim client don't realize that
is to prevent any tampering with the message in transit. she is at the wrong place, the evil twin could be
The CRC is preformed on the message and not on the connected to internet via 3G or even connected to the
ciphertext and the function itself is linear, this makes it real network. By doing this an attacker can do everything
possible to perform changes in the ciphertext without any other MITM-attack would give room for, like listen
changing the checksum.[7] There are a lot of possible for passwords, credit card numbers, change requested
ways of attacking WEP but the fundamental flaws that information, etc. all without the victim notices anything.
makes the three main goals of WEP broken is the weak [14][15]
keys and the linear checksum function. Further reading
is advised and recommended papers are the famous 3.6 More attacks on wireless networks
Fluhrer, Mantin ans Shamir attack[8] and a more up to Apart from the normal key cracking attacks on WEP
date and improved attack against WEP[9] and WPA protected networks it's also possible to do
inject packages in net encrypted by both, injecting in a
3.3 WPA
WEP network is pretty straight forward, get the key send
Sure, WPA corrects alot of the problems with WEP in the packages. In the WPA case it's a lot trickier, but in
but also provides some new vulnerabilities, a WPA theory it consists of obtaining the clear text of an small
protected network with a bad passphrase and a standard packet like an ARP, this can be done with some tool for
SSID will probably be even faster broken into than a cracking WEP packets like a chopchop attack. This is
WEP protected one. This since it's possible to capture the possible since the payload of an arp is pretty much
WPA 4-way handshake easily thanks to unprotected known. When the clear text is know, the Michael
management frames. The sharing of the key is then algorithm is reversed to acquire the MIC key, then since
attacked by dictionary attack. Since the WPA key hash of QoS techniques it's possible to inject forged packages
"PBKDF2(passphrase, ssid, 4096, 256)" is quite slow to with the MIC key 7-15 times in a short period of time
calculate since it iterates a SHA1 algorithm 4096 times depending of how quick the network rekeys. This is
[10], pre-calculated rainbow tables are instead used for however a one-way attack but ARP poisoning or make
speeding things up into insanity. It's not strange to be things call home should be possible. There is a tool
able to test about 20k hashes a second with rainbow called tkiptun-ng that does this attack but it only
tables [11]. Another weakness in WPA is that the supports a few wireless cards and is unstable. [18][20]
Michael MIC algorithm as an countermeasure for Another possible attack is that the management
forgeries it throws everybody out and shuts the AP down packets in 802.11 is unencrypted and very easy to forge,
if it finds two forged packets within a minute [12] this therefore it's theoretical very easy to mess with a
can be used to DoS the wireless network. wireless network via the management packets. The way
of doing so is pretty much; open a raw socket and send
3.4 WPA2/RSN your forged packages with a false transmitter MAC
As mention before WPA2 is the strongest security address to some poor receiver. It's as simple as, DoS the
feature for wireless networks to day. Does that mean that users? Send Disassociation packets. Give the AP a lot of
it’s unbreakable? The answer is unfortunately no. The work? Send Authentication/Association packets in large
weakness here lies with user’s tendency to use weak amounts. [2]
passwords that are easy to guess. There exist off the
shelf tools that can generate brute force and dictionary
4. Attacking wireless in practice
attacks against WPA2. Further more the WPA2 protocol In this chapter we’ll describe how we were able to
does not provide any protection against different DoS perform attacks on wireless networks.
attacks such as radio frequency jamming, de-
authentication, de-association etc.[13] 4.1 Preparation and tools

3.5 Evil Twins Performing the practical experiments required some

hardware, a couple of laptops, a wireless accesspoint and
The so called "Evil Twin" attack towards a wireless a wireless NIC that supported packet injection. The
network is launched by installing another false hardware is neither rare nor expensive were the wireless
accesspoint. The false accesspoint will have the same NIC was hardest to acquire. Hard, as in 5minutes at ebay
SSID as the victim and is supposed to have superior and 10£ and replacing the internal NIC of the laptop with
signal strength so the victim will connect with the false the new one. The choice of accesspoint fell on the
AP instead of the real one. The attacker can make this Linksys WRT54g not cause we really needed all things
easier for her by disassociate clients instead of just it's capable of, but it was the one easiest available. Aside
from the hardware some software was also needed, the Step 4) The last step is to run aircrack-ng, this can be
laptop used for the attacks had to run linux for be able to done both offline when enough IV:s has been captured
run the correct drivers and software. We used a normal and saved to a file or online at the same time we gather
debian lenny installation running the latest cvs versions IV:s.
of the (in)famous MadWifi-ng wireless drivers which are The result of our attack can be seen in fig1. This was
capable to do almost anything when it comes to 802.11 an online attack and as we can see it only toke 42 sec to
networks. Together with the MadWifi-ng drivers we ran get the key.[14]
an old, but working version of the wireless detector tool
Kismet for finding out BSSIDs for the targets. To launch
the actual attacks we used the latest version of the
aircrack-ng suite who offers tools for attacking wireless
networks in a large number of ways and it was essential
in all our attacks. For making the attack against WPA
with a rainbow table we used the tool called CoWPAtty
and a downloaded table matching our targets ESSID. To
make the Evil Twin attack a bit more amusing we ran a
tool called sslstrip who maps https links to http ones,
together with the softAP tool called airbase-ng from the
aircrack suite. We decided to not attack the MIC in WPA
mostly because the tools we have don't work with the
MadWifi-ng drivers yet. Other tools we used were things
like iptables and dns- and dhcp servers. Figure 1. Result of Aircrack-ng, getting the WEP
4.2 Breaking WEP key

The first experiment we tried out was breaking WEP. 4.3 Deploying an Evil Twin
With a bit of pre-work we where able to break it within a
minute. As mention before we used aircrack-ng to The next experiment was to deploy an Evil Twin. For
intercept and inject packets. Besides the tools and this we used airbase-ng. To make this work there is not
hardware there are a few things you need to know to be really much that need to be done. Airbase-ng is setup so
able to break WEP this way, the BSSID for the AP we it will respond to any prob request with a proper prob
are going to attack, MAC-address for the PC running the response, all you need to know is if the AP you are
attack, the AP channel and the wireless interface. The pretending to be is using WEP or WPA and recover the
MAC-address for your wireless interface is already key. Another thing you can do to make the client more
known, and to get the BSSID of the AP and what likely to associate with your own AP instead of the real
channel it is using can easily be obtained by the help of one is to dissociate the real AP. This can be done with
kismet. Kismet scans for all closely networks and list airplay-ng. With the Evil Twin a man-in-the-middle
information about them including the BSSID and attack is preformed, capturing any data sent from the
channel used. To be able to crack the WEP key we need client. [17].
to gather a lot of IV:s (initialization vectors). Under 4.4 Breaking WPA
normal circumstances networks don't generate these IV:s
very quickly, and it can take some time before you have To break WPA we used a so called dictionary attack
gathered enough to break the WEP-key. Luckily we can and the tool we choose to use was coWPAtty. To make
speed up this process by using injections. Here follows a this work you first need to capture the WPA four-way
total of 4 steps we preformed to break the WEP-key. handshake before running coWPAtty. The handshake is
Step 1) For the packet injection to work the source captured the same way as in WEP but with a few flag
MAC-address must already be associated or else the AP changes. Normally this can take quite some time to wait
will ignore the sent packet. So the first thing we do is to for a client to connect to the AP. To speed it up we use
make a fake authentication with the AP using airplay-ng. airplay to de-authenticate the clients from the AP,
Step 2) Here we will start listening for ARP requests, forcing them to re associate with it. After getting the
forge them and inject them back into the network forcing handshake we ran coWPAtty against a pre-computed
the AP to broadcast them again with new IV:s. hash. The result can be seen in fig2.
Step 3) At the same time we start injecting packets we
use airdump-ng to capture all IV:s sent from the AP and
saves them to a file.
 injecting WPA protected networks using TKIP is out
public, bad things can happen [18].
6. References
[1] Institute of Electrical and Electronic Engineers: 802.11
Standard
http://standards.ieee.org/getieee802/802.11.html
[2009-04-03]
[2] J. Geier, “Understanding 802.11 frame types”
http://www.wi-
fiplanet.com/tutorials/article.php/1447501
[2009-04-04]
[3] N. Borisov, I. Goldberg, D. Wagner, “Intercepting
mobile communication: The Insecurity of 802.11”,
http://www.isaac.cs.berkeley.edu/isaac/mobicom.pdf,
[2009-04-11]
Figure 2. Breaking WPA with coWPAtty [4] Wikipedia “Wi-Fi Protected Access”,
http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access,
Instead of a pre-computed hash you could use a
[2009-04-11]
dictionary file and it would give the same result but take
longer because you would need to hash the password and [5] D. Byers, IDA at Linköpings Universitet
SSID before comparing.[12] http://www.ida.liu.se/~TDDD17/lectures/slides/tddd17_
lec03_net.pdf
5. Conclusions [2009-04-11]
We have found out in this practical study on wireless [6] S. Vibhuti, “IEEE 802.11 WEP(Weird Equivalent
network security that there are a lot of security flaws and Privacy) Concepts and Vulnerability”
they are very well documented, finding information both http://www.cs.sjsu.edu/faculty/stamp/CS265/projects/S
for the theoretical part and the experiments were easy. pr05/papers/WEP.pdf
During the preparation for the practical experiments [2009-04-11]
[7] A. Stubblefield, J. Ioannidis, A. Rubin, “Using the
we noticed that almost everything except the Evil Twin
Fluhrer, Mantin, and Shamir Attack to Break WEP”
attack was described in easy step-by-step guides on http://www.isoc.org/isoc/conferences/ndss/02/papers/stu
several web pages, the level of knowledge needed to bbl.pdf
launch several of the attacks is scary low. We think that [2009-04-11]
this is both good and bad, good in the sense that with [8] M. Beck, E. Tews, “Practical attacks against WEP and
well documented security flaws people should notice the WPA” http://dl.aircrack-
need of better security, unfortunately it seems that a lot ng.org/breakingwepandwpa.pdf
of people either don't know or care about this, as you [2009-04-11]
still can find networks unprotected or with weak [9] Wi-Fi Aliance, “Deploying a Wi-Fi Protected acess
protection. Then there are the problems with the open (WPA) and WPA2 in the Enterprise ” http://www.wi-
networks whom are vulnerable to many attacks, we think fi.org/files/kc/WPA-WPA2_Implementation_2-27-
that this is a problem that is hard to fix when those 05v2.pdf
problems exist in probably all wireless network since the [2009-04-11]
air is hard to control. However, there has been some [10] J. van Rantwijk “WPA key calculation”
articles of the insecurity of wireless networks in the http://www.xs4all.nl/~rjoris/wpapsk.html
[2009-04-04]
news over past few years. With a quick scan at
[11] A. Stone, “The Michael Vulnerability” http://www.wi-
neighborhood it seems that such articles has given result,
fiplanet.com/columns/article.php/1556321
we found almost only WPA and WPA2 encrypted [2009-04-04]
networks. If the users have chosen good passwords is [12] Wirelessdefens.org,
another thing. In this project we have realized that to http://www.wirelessdefence.org/Contents/Aircrack-
keep you wireless network well secured today you really ng_WinAircrack.htm
should use WPA2 with AES CCMP and a good long [2009-04-24]
password together with a strange ESSID to make sure [13] G. Lehembre, “Wi-Fi Security, WEP, WPA and
wordlist, rainbow table and normal brute force attacks WPA2”
aren't easy. WPA with a good strong password is http://www.hsc.fr/ressources/articles/hakin9_wifi/hakin
properly enough in most cases but since tools for packet 9_wifi_EN.pdf
 [2009-04-11]
[14] DarkAudax, “Simple WEP crack”
http://209.85.129.132/search?q=cache:71C_KfQN1VQ
J:www.aircrack-
ng.org/doku.php%3Fid%3Dsimple_wep_crack+aircrac
k-
ng+wep&cd=1&hl=sv&ct=clnk&gl=se&client=firefox-
a
[2009-04-24]
[15] FR3DC3RV, “Evil Twin”
http://fr3dc3rv.blogspot.com/2007/04/evil-twin.html
[2009-04-15]
[16] The shmoo group, “Rogue Squadron: Evil Twins,
802.11intel, Radical RADIUS, and Wireless
Weaponry for Windows”
http://airsnarf.shmoo.com/rogue_squadron.pdf
[2009-04-15]

[17] DarkAudax, “Airbase-ng” http://www.aircrack-

ng.org/doku.php?id=airbase-
ng&DokuWiki=d466c5a226b334d0a5e3d1950434cdd3
[2009-04-24]

[18] G. Fleishman, “Battered, but not broken: understanding

the WPA crack”
http://arstechnica.com/security/news/2008/11/wpa-
cracked.ars
[2009-04-28]
[19] N. Cam-Winget, R. Housley, D. Wagner, and J.
Walker, "Security Flaws in 802.11 Data Link
Protocols"
http://www.ida.liu.se/~TDDD17/literature/p35-
cam_winget.pdf
[2009-05-01]
[20] darkaudax, “Tkiptun-ng” http://www.aircrack-
ng.org/doku.php?id=tkiptun-ng
[2009-05-02]