Hacking Wireless Networks For Dummies
.pdf
60 |
Part I: Building the Foundation for Testing Wireless Networks |
Other people are building antennas from everything from Pringles cans to PVC pipe. Peter has a tomato juice “cantenna” (see Figure 4-14). You can build your own or buy one starting at $39.95. Cantenna (www.cantenna.com) and Hugh Pepper (http://home.comcast.net/~hughpep) offer cantennae for sale. These are mainly directional designs, more commonly know as yagistyle antennas. They focus the 2.4 GHz wave, usually through a condenser (the can), to an element (a piece of copper) specifically placed in the antenna. This is why they are also called wave guides. The depicted antenna provides 16 dBi gain.
Figure 4-14:
Wave guide cantenna.
Directional antennae are good for aiming at buildings across the street or pointing to the top of a very tall building, but they are not really good for wardriving. For wardriving, you want to get yourself an omnidirectional antenna like the one shown in Figure 4-15. Peter bought this 5 dBi antenna, which has a magnetic base that can be attached to a car or cart, on eBay for $5.95(!). At that price, you should buy several and give them as gifts.
Chapter 4: Amassing Your War Chest |
61 |
Directional vs. omnidirectional antennas
We have actually had a great deal of success using directional antennas — as opposed to using omni antennas — for wardriving. If the directional antenna (or cantenna in this case) is aimed forward toward the front of the car, signals in front of you are often acquired much earlier than they are when using the omni antenna. The cantenna can then be moved left or right, peaking the signal and pointing out the exact origin or location of the wireless access point or errant signal being tracked.
With an omni, the signal strength gets stronger only as you get closer, but you can never be sure from which direction the signal is coming without actually traveling in several directions to track the signal strength. A directional antenna provides direction as well as signal strength when trying to locate a specific target. An omni can show a larger number of signals at one time than a directional antenna, but with lower signal strength than the directional antenna provides.
Figure 4-15:
Omnidirectional antenna.
62 |
Part I: Building the Foundation for Testing Wireless Networks |
For more information on antennae, we encourage you to check out Wireless Networks For Dummies (Wiley). That book outlines in depth the different types of antennae. You’ll even find links for building your own wave guide antenna like that shown in Figure 4-16. That book provides information on RF mathematics so you can interpret what dBi means.
Using GPS
While driving in an unfamiliar place, Peter’s family often asks, Where are we? Until he got his global positioning system (GPS), he couldn’t always answer the question with great precision. As an answer, “somewhere between the Colorado border and El Paso” doesn’t cut it, especially when you get close to restricted government areas. Now, with GPS, he can tell you the exact latitude and longitude. That GPS device can help with your wireless hacking efforts as well.
Using your GPS system with your wardriving software can give you more information. Remember, the hacker’s primary law is more information is better. When you have to cover a large area in a short amount of time, the GPS is essential. Otherwise, you may not find the access point again.
To use GPS with wardriving software, you get the GPS unit to output GPS coordinates to the computer’s serial port. When you find a wireless access point, Kismet and NetStumbler log the exact coordinates (down to a few feet) of the effective range.
Make sure you get a serial or USB cable to connect to your workstation when you buy your GPS device. If you are going to use the serial cable, ensure that you have a serial port; otherwise you’ll need a serial-to-USB adapter. The standard protocol for GPS is NMEA (National Marine Electronics Association), which dumps your coordinates every 2 seconds to a serial port via a special cable at 9600,8,N,1. If you use a Garmin GPS, you can use the Garmin format. The Garmin eTrex Venture is nice for its size and cost (about $150). The Garmin reports every second, compared to every 2 seconds for the NMEA standard. However, Kismet supports only the NMEA format.
GPS units start at $100 and can run into the thousands. Peter purchased Microsoft Maps & Streets 2005 with GPS for about $129. The GPS (shown in Figure 4-16) labeled Microsoft is actually manufactured by Pharos, a wellknown GPS vendor.
If you buy the Microsoft MapPoint software, you can take your output from NetStumbler and dump it right into StumbVerter (www.michiganwireless. org/tools/Stumbverter), which plots it on a map for you. You can then take your output, massage it, and import it into your Maps & Streets GPS device. We show you how to do this in Chapter 10. Table 4-1 lists some common mapping applications and their support for wardriving.
Chapter 4: Amassing Your War Chest |
63 |
Figure 4-16:
USB GPS device.
Table 4-1 |
|
Mapping Software |
|
Developer and |
GPS Interface |
Import “Pushpins”? |
NetStumbler |
Software |
Support? |
|
Support |
DeLorme Street |
Yes |
Yes |
WiMap |
Atlas USA |
|
|
|
|
|
|
|
DeLorme |
Yes |
Yes |
PERL script |
TopoUSA |
|
|
|
|
|
|
|
DeLorme |
Yes |
Yes |
PERL script |
XMap |
|
|
|
Microsoft |
Yes |
Yes |
StumbVerter |
MapPoint |
|
|
|
|
|
|
|
Microsoft |
Yes |
Yes |
PERL script |
Streets |
|
|
|
and Trips |
|
|
|
Signal Jamming
You can buy a transmitter and jam a signal, but jamming happens accidentally as well. Real crackers may jam your signals to deny service to your legitimate clients. The following can affect your signal:
64 |
Part I: Building the Foundation for Testing Wireless Networks |
A brief history of jamming
Deliberate radio jamming goes back to the beginning of the last century. A betting person would probably wager that radio jamming was first done by the military somewhere. That
betting person would lose. The first recorded instance of jamming occurred during the America’s Cup yacht races. Someone was trying to get a competitive leg up, not a military edge.
Cordless phones can cause narrowband interference, which may mean you need to eliminate the source.
Bluetooth devices and microwave ovens can cause all-band interference, which may mean you need to change the technology or eliminate the source.
Lightning can charge the air, which may mean you need to ground and protect your equipment.
So, random interference can result in denial of service, but someone can do it intentionally as well by using one of two types of RF jamming devices:
RF generators are rather expensive devices. You can get RF generators from companies like HP (www.hp.com) and Anritsu (www.anritsu.com).
Power signal generators (PSGs) are not as pricey. They are used to test antennae, cables, and connectors. You can get PSGs from YDI (www.ydi.com) and Tektronix (www.tek.com).
A variety of jammers are complete, standalone systems consisting of appropriate antennae, energy sources, and modulation electronics, such as techniques generators. But what causes interference is the effective radiated power (ERP). You can use the jammer to disrupt the operation of electromagnetic systems in either receiving or transmitting modes to reduce or deny the use of portions of the electromagnetic spectrum.
You may want to test your wireless network to discover how susceptible it is to signal jamming from outside your organization. If you plan to run missioncritical applications over wireless networks, then you need to know whether others can cause unplanned network outages.
Part II
Getting Rolling
with Common
Wi-Fi Hacks
In this part . . .
It’s time to roll! With Part I under your belt, you’re ready to move into the testing phase of your wireless-hacking
efforts. This part starts out with a discussion of human insecurities — that is, things your users do that make your wireless networks vulnerable. Then we get into physical security vulnerabilities, common wireless client weaknesses, and default settings that can leave your systems begging to be attacked. We finish off with an introduction to wardriving — that’s where the true fun begins. Stick around. It only gets better from here.
Chapter 5
Human (In)Security
In This Chapter
The effect of human vulnerabilities on wireless networks
Undertaking social engineering tests
Looking for unauthorized APs
Understanding default wireless settings
Avoiding weak passwords
Implementing practical countermeasures to your non-technical threats and vulnerabilities
When people think about the various vulnerabilities of wireless networks, they often concentrate only on the technical vulnerabilities associated with things like WEP, radio signal leakage, and the potential for DoS (denial of service) attacks. However, higher-level wireless-network vul-
nerabilities are often overlooked — namely, human insecurities. We’re not talking about people with low self-esteem, but insecurities involving users who are ignorant of wireless risks or careless with wireless networks.
What kinds of problems can this cause? For starters, employees, and even trusted outsiders such as contractors and auditors, can bring in their wireless APs and plug them right into your network. Some may even set up their wireless clients to run in peer-to-peer — or ad hoc — mode with each other, which can pose even more risks to your network.
Adding to the mess, wireless systems are often implemented with the default settings by unknowing users. Hackers love this. Most of these users aren’t malicious, they’re just uninformed. But setting up unapproved wireless devices without considering the first bit of security is the last thing you need. And users, or even wireless network administrators, often unknowingly choose weak passwords, making systems even more vulnerable.
Another good way for hackers to break in to your systems is through the use of social engineering. This is when someone poses as a legitimate person (employee, consultant, or government official) and exploits the trusting nature of humans for ill-gotten gains.
Human fallibility is arguably the greatest threat to your systems, and these types of non-technical weaknesses are often the root cause of most
68 Part II: Getting Rolling with Common Wi-Fi Hacks
Melts in your mouth, not in your hands
Some networks are said to have candy security. This occurs when the wireless network has a hard, crunchy outside for protection (WEP, secure authentication, and so on) but falls short
on security due to its soft, chewy inside (your people and weak processes). Make sure you avoid this problem.
wireless-network risks. This chapter explores these weaknesses and shows you how best to eliminate them.
What Can Happen
New wireless vulnerabilities come and go, and securing against unknown threats and vulnerabilities is very difficult. However, one thing’s for sure: When the human element is introduced into information systems (and when is it not?), vulnerabilities start popping up everywhere and often remain indefinitely.
The big picture must not be forgotten. In fact, securing the technical piece is pretty easy — it’s securing the human element that takes more time and effort. Remember that both types of security must be accounted for. Otherwise, you’re running a partially secured wireless network that can provide only limited information security.
What sorts of things can happen when human vulnerabilities are ignored? Well, for starters, things like this:
Managers and network administrators deploy wireless network connectivity just because it’s the latest and greatest technology or to appease their users who think it’d be neat to have all without considering the security issues or consequences involved with their actions.
Social engineers work their way into your building or computer room.
Users install APs for the sake of convenience and end up bypassing security controls, extending your network, and letting in unauthorized users without your knowledge.
Hackers or malicious insiders exploit physical security weaknesses, leading to theft, reconfiguration of APs, cracking of WEP keys, and more.
Network administrators and security managers deploy wireless networks with security requirements that are too stringent, which leads to users ignoring policies and bypassing controls any chance they get.
The possibilities are limitless.
Chapter 5: Human (In)Security |
69 |
Ignoring the Issues
We’re heading toward a wireless world in which we’ll have as much wireless traffic as wired traffic, if not more. The demand for “anywhere all-the-time” wireless network access, from the boardroom to the coffee shop, is continually growing. The bad thing is that many wireless networks are being deployed without concern for the big picture. The long-term consequences of insecurely implementing wireless systems are being ignored from the get-go.
One of the best things IT professionals can do is to consider security at the ground level before installing any type of system. If wireless networks are put in place with security in mind, it’s much easier to make security changes long-term.
Most users, many business executives, and even some administrators ignore warnings that 802.11-based wireless networks are inherently insecure. By now, anyone watching television, reading the paper, or even reading their wireless network user’s guide should know that simply connecting a wireless AP to the network without enabling any of the basic security features can have a negative impact on information privacy and security. However, as we often see, the desire for unlimited wireless connectivity usually outweighs any potential risks.
In the ongoing battle of security versus convenience and usability, what’s secure is often not convenient or very usable for the user, and what’s convenient, feature-rich, and user-friendly is often not secure. This mindset is what leads to many wireless network exploits.
Hotspots are now all the rage. Everyone wants connectivity and ease of use, and security is often pushed aside. What most users don’t realize is just how insecure their computers and data are when they connect to an unsecured wireless network. Many people just connect to whatever AP is available, especially if they’re out of the office, without thinking about the consequences. Making matters worse, newer, more “user-friendly” operating systems such as Windows XP make wireless network connection even more dangerous because the computer automatically connects to the first wireless network it sees — yours, theirs, or someone else’s.
Common excuses for setting up unauthorized wireless networks are “I didn’t know wireless security was such a problem,” or “management just won’t buy into the costs associated with securing our wireless network.” However, the constant deluge of new information exposes the truth: 802.11-based systems can be made very secure with minimal money, time, and effort.
Not all users make the wireless security mistakes we speak of. However, the general tendency is to get things up and running as quickly as possible, overlooking what really needs to be done to secure 802.11-based networks.