Which of the following is an example of an attack using a rogue access point?
|
My new book, The Effective CISSP: Security and Risk Management, helps CISSP aspirants build a solid conceptual security model. It is not only a tutorial for information security but also a study guide for the CISSP exam and an informative reference for security professionals.
Show
Bob builds a rogue AP using a laptop running a Windows or UNIX operating system. Assuming that he used UNIX, he can enable the server to act as an AP using HostAP. In addition, Apache server can be used to host the phishing site locally on the rogue AP. Dnsmasq is installed and used as a local DNS and DHCP server. After building the rogue AP, a Chase bank phishing site can be set up on the Apache server. Thus, a poisoned DNS cache entry in Dnsmasq can be added by replacing the legitimate chase.com IP with the IP hosting the spoofed site: address=/chase.com/129.119.1.1 in the dnsmasq.conf file, where 129.119.1.1 is the IP address of the local server hosting the attack. Using Apache virtual hosting, the bad actor can host multiple phishing sites similar to the example shown in Figure 6.3.  Figure 6.3. Apache Virtual Host Configuration Read moreNavigate DownView chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597492980000069 Microsoft Vista: Wireless WorldIn Microsoft Vista for IT Security Professionals, 2007 Detecting and Protecting against Rogue Access PointsProtecting against rogue access points is an ongoing task for security engineers. You never know when an employee will plug a wireless device into the network and expose it to attackers. Following are some techniques you should take to detect and protect against rogue access points: ■Follow corporate policy and be aware ■Insist on mutual authentication ■Employ sniffers and WIDS ■Employ central management and detection ■Employ physical detection ■Employ wired detection Corporate Policy and User AwarenessEmployees that install access points often do not understand the security risks of their actions. To avoid this and enforce your security policy you must implement a wireless security policy that mandates that all employees obey proper security measures, and coordinate with your information technology (IT) department the installation of any network equipment. You must audit and communicate this policy to your employees on a regular basis. A security policy works only if employees are aware of it and obey it. Mutual AuthenticationMutual authentication of the user and the authenticator eliminates the ability of a corporate user authenticating with a rogue access point planted by an attacker to steal another user’s credentials. Sniffers and WIDSYou can use sniffer tools and a Wireless Intrusion Detection System (WIDS) to continually watch the air for any wireless signals and data passing through. Then you can match detected signals against a list of valid wireless devices to determine whether any rogue access points are present. Central Management and DetectionVendors such as Cisco Systems provide central management solutions for enterprise network clients to manage their wireless security. One feature of such solutions is the ability to detect rogue access points. Access points as well as wireless clients are turned into an army of scanners and auditors. This army then reports to the central management server any security findings within the signal area. For example, say a client with a wireless laptop is walking around campus using his wireless connection and he detects two other access points nearby. He reports these two access points to his wireless gateway router, and that information is then passed to the central management server. The central management server compares the detected access points against its access list to determine whether rogues have been found. If it determines that the detected access points are rogues, the server calculates the rogues’ position using the wireless network within the area and sends an alert to the security administrators that rogues have been detected. Physical DetectionSometimes all you have to do is to walk around the office, looking for unauthorized devices and access points plugged into wired ports at users’ desks. If you find an unauthorized access point plugged into a wired network, you should turn it off and inform the user of your corporate security policy against unauthorized network devices. Wired DetectionYou can scan your wired network with an application such as Nmap to detect what is plugged into it and where. Each network device has its own set of signatures, which define the way it acts and reacts to certain probes. These detected signatures are used to detect the types of devices plugged into your network. For example, say you have a network that is dedicated to user desktops against which you run your Nmap scanner, and you notice that five of the desktop Internet Protocol (IP) addresses are running HTTP (port 80) and Telnet (port 23) services. There is no reason a desktop should be running these services; hence, this immediately raises a red flag, and a reason for you to investigate. Tools & Traps…NmapNmap (Network Mapper) is a free, open source utility for network exploration and security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on a network, what services (application name and version) those hosts are offering, what operating systems (and operating system versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. Nmap runs on most types of computers and both console and graphical versions are available. For more information, visit http://insecure.org/nmap. View chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B978159749139650011X Recognition StrategiesTimothy J. Shimeall, Jonathan M. Spring, in Introduction to Information Security, 2014 Wireless IDPSA wireless IDPS focuses on preventing abuse of the wireless access point and medium in the first place. According to the OSI model layers described in Chapter 11, a wireless IDPS only analyzes up to layer-2 data. Since this data is only useful in point-to-point communications, not end-to-end communications, a wireless IDPS must collect data from the wireless access points. This fact means that the sensor architecture needs to be distributed, unlike a NIDPS or NBA. Wireless IDPSs monitor the radio waves for abuse or attacks on the wireless access points. They can also detect attempts to establish rogue access points for subversive communication. A wireless IDPS has its own radio antennae that it uses to scan the radio waves and issue commands to devices to correct abuse. The types of events that a wireless IDPS can detect include the following [1, p. 5–8]: ■Unauthorized wireless local area networks (WLANs) and WLAN devices ■Poorly secured WLAN devices ■Unusual usage patterns ■The use of wireless network scanners ■DoS attacks and conditions (e.g., network interference) ■Impersonation and middle-person attacks Entities attacking a wireless device need to be physically close to the device, unlike most network attacks. Thus, the impact of these events is different than those detected by other IDSs. If an adversary can gain access via a wireless device, the adversary can often evade other defensive technologies, such as those described in Chapter 5. A wireless IDS is helpful in detecting attempts at such attacks. View chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597499699000122 Supporting an Attack with TechnologyRichard Ackroyd, in Social Engineering Penetration Testing, 2014 Wireless donglesAdding a wireless interface allows the flexibility to perform more attacks. First of all, it could be used to capture handshake packets, connect to corporate wireless, or host a rogue access point. Additionally, why not try just using it as a means of connecting back into the “dropbox” in the event that it loses its other modes of connectivity. In terms of hardware, the Alfa dongles are usually a safe bet, however, it is worth noting that the older version (such as the trusty Alfa AWUS036H) does not support Wireless-N. Just a reminder here, a Pi will probably not take too kindly to having to power itself and the Wireless dongle. Use a powered hub for all peripherals. It is more than likely that there will be a strong desire to have the Aircrack-ng suite installed on the Pi. It won’t be available from the repositories due to a conflict with iw, so it will need to be built from source. Luckily this isn’t very complicated. Start by checking that the latest versions of “build-essential” and “libssl-dev” are installed and then commence downloading the Aircrack-ng package. [email protected] ~ $ sudo apt-get install build-essential [email protected] ~ $ sudo apt-get install libssl-dev [email protected] ~ $ mkdir aircrack [email protected] ~ $ cd aircrack [email protected] ~ $ wget http://download.aircrack-ng.org/aircrack-ng-1.2-beta1.tar.gz [email protected] ~/aircrack $ tar -zxvf aircrack-ng-1.2-beta1.tar.gz Now it’s time to build the tools. Some of these steps make take a while! [email protected] ~/aircrack $ cd aircrack-ng-1.2-beta1/ [email protected] ~/aircrack/aircrack-ng-1.2-beta1 $ make [email protected] ~/aircrack/aircrack-ng-1.2-beta1 $ sudo make install [email protected] ~/aircrack/aircrack-ng-1.2-beta1 $ sudo apt-get install iw [email protected] ~ $ sudo airodump-ng-oui-update Now let’s plug in the dongle and launch Airodump and see if everything is working! [email protected] ~ $ sudo airmon-ng start wlan0 Interface Chipset Driver wlan0 Atheros AR9271 ath9k - [phy0] (monitor mode enabled on mon0) [email protected] ~ $ sudo airodump-ng -w /home/pi/wirelesscap mon0 CH 1 ][ Elapsed: 32 s ][ 2013-09-21 12:02 BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID 12:FE:F4:07:A1:E8 -61 60 0 0 6 54e. OPN BTWiFi-with-FON 02:FE:F4:07:A1:E8 -61 68 0 0 6 54e. OPN BTWiFi 6 A:C6:1 F:E8:84:2D −70 125 0 0 1 54e OPN BTWiFi-with-FON 10:C6:1 F:E8:84:2B −69 164 8 0 1 54e WPA2 CCMP PSK BTHub3-P3HP 6 A:C6:1 F:E8:84:2C −67 168 0 0 1 54e OPN BTWiFi BSSID STATION PWR Rate Lost Frames Probe 00:FE:F4:07:A1:E8 B8:8D:12:3A:75:00 -60 0 - 1 0 19 The choices here could be to stick with this kind of attack, attempting to capture and crack handshakes, or to try and set up a rogue AP. The preferred choice would be to deploy a wireless Pineapple alongside the “dropbox” for this attack vector. This could route the Internet traffic into the Pi and out of its 3G interface if so required. View chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780124201248000120 Network SecurityJason Andress, in The Basics of Information Security (Second Edition), 2014 WirelessAs we discussed earlier in the chapter, attackers accessing a wireless device can potentially bypass all our carefully planned security measures. Worse yet, if we do not take steps to ensure that unauthorized wireless devices, such as rogue access points, are not put in place on our network, we could be allowing a large hole in our network security and never know it. We can use several tools to detect wireless devices. One of the best-known tools for detecting such devices is called Kismet, which runs on Linux and can be found on the Kali distribution. Kismet is commonly used to detect wireless access points and can find them even when attempts have been made to make doing so difficult. A similar piece of software, called NetStumbler, exists for Windows, although it does not have as full a feature set as Kismet. In addition to detecting wireless devices, some tools can enable us to break through the different varieties of encryption that are in use on such networks. Many tools for such purposes exist, but a few of the more common ones for cracking WEP, WPA, and WPA2 include coWPAtty and Aircrack-NG. View chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780128007440000105 Wardriving with Kismet and BackTrackFrank Thornton, in Kismet Hacking, 2008 Publisher SummaryThis chapter provides an explanation and demonstration of wardriving while using Kismet with BackTrack, a live Linux distribution. Wardriving is just one example of why one might want to use Kismet from a live CD. Other possibilities are rogue access point (AP) detection or graphical mapping of networks. BackTrack can be acquired by downloading (direct or torrent) it, and then burning it to CD. The downloaded BackTrack file is an ISO, or CD image file. To use it, one will need to burn the ISO to a CD using any of the many available CD burning programs. BackTrack can be booted by inserting the CD and restarting computer. At the graphical boot menu, when the first option is selected, it boots into BackTrack using the KDE graphical desktop. By default, Kismet will save its log files to the location, where Kismet is started. However, when booting a live CD, these files are only stored in a temporary RAM disk and will be gone when one powers off the system. In this case, one has two options: either copy the files to a thumb drive (or other device) before powering off; or better yet, start Kismet from the thumb drive so the files are automatically saved there. If Kismet is used to wardrive, a Global Positioning System (GPS) receiver becomes a necessity. To configure Kismet to use GPS, one first needs a GPS receiver that supports NMEA. Second, one would need to start GPSD and point it to the path of GPS receiver. The chapter further explains how wardriving can be performed and how the data obtained from wardriving can be stored and managed. View chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597491174000101 WarDriving With Handheld Devices and Direction FindingChris Hurley, ... Brian Baker, in WarDriving and Wireless Penetration Testing, 2007 SummaryHandheld devices provide WarDrivers with a portable solution to identify wireless networks and capture packets. This can be very beneficial to a penetration tester when trying to collect packets without being detected. Additionally, handheld devices are perfect for direction finding and locating rogue access points or clients. Regardless of your preference, Windows or Linux, there is a handheld WarDriving solution that will meet your requirements. The Sharp Zaurus is a very capable Linux-based handheld device that is perfect for WarDriving. Although Sharp has ceased selling the Zaurus in the United States, the open source community still provides updated software packages. The lack of commercial availability has actually provided an advantage to U.S. customers interested in purchasing a Zaurus. Since there is no longer official support for the devices from Sharp, you can get one on eBay for a fraction of the original sales price, making the Zaurus a very affordable WarDriving solution. Support for Kismet is probably the best “selling point” for the Zaurus. With strong WiFi support included with both the factory ROM and the open source OpenZaurus ROM, configuring the Zaurus to use Kismet is easy. There is also a wide range of GPS support for the Zaurus, making it a snap to create maps of your WarDrives. View chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597491112500283 Finalizing the InstallationThomas Norman CPP, PSP, CSC, in Integrated Security Systems Design (Second Edition), 2014 Radio Frequency SecurityWhen a designer specifies a radio frequency (RF) infrastructure, there are two major security concerns. I call them the CNN factor and the Volkswagen Bus factor. No client wants video from its cameras showing up on CNN, and no client wants an 18-year-old sitting in an old Chevy Vega with a laptop computer attaching to the wireless network security system. Other concerns include the following6: •Probing/network discovery •Denial of service (DoS) attacks •Surveillance •Impersonation (man-in-the-middle) •Client-to-client intrusion •Client-to-network intrusion •Rogue APs (access points) and ad hoc networks CountermeasuresThe following measures help secure RF infrastructures: •Probing/network discovery: Encrypt the SSID connection. There is little that a network designer can do to prevent probing and network discovery other than to turn off the SSID message. However, that does not prevent a determined hacker. I suggest using 802.11a or another less used frequency for backhaul traffic. The network cannot be probed if the hacker does not possess equipment that can see the network. Encrypting the SSID helps to prevent entry. •DoS attacks: DoS attacks can take several forms, but all of them are carried out with the intent to deny access to the appropriate user. A common DoS method is RF jamming. •RF jamming: RF jamming involves flooding the airwaves with 802.11 frequency energy. There is little that can be done about this. I recommend using either 802.11a or another less used frequency for backhaul (there is less equipment in use and, therefore, less chance of jamming). •Deauthentication attacks: In a deauthentication attack, the attacker floods the airwaves with spoofed MAC addresses. Eventually, the system loses track of what devices it is connected to and will try to search for another AP. There are several effective means to prevent this type of attack, including detection of MAC address spoofing. Other countermeasures can log the attempts and approximate the physical location of the attacker based on signal strength in proximity to his or her nearest wireless node. •Surveillance: Encrypt all data on the RF system using a strong encryption algorithm. This helps prevent your video from being illegally exported to other systems. I recommend the use of IPSec for this purpose. •Impersonation: Often, solving the surveillance problem also solves the impersonation problem. Another type of impersonation attack is the man-in-the-middle attack. This type of attack allows the hacker to add, delete, and modify data. An intrusion detection system can be effective in preventing man-in-the-middle attacks. •Client-to-client intrusion: Many designers make their servers nearly impervious to outside attacks but fail to protect client devices. Diligent maintenance of network authorizations can prevent this type of attack. I strongly recommend against allowing business user clients onto the security system wireless backbone, even if a VLAN is used. •Client-to-network intrusion: Multilayer security as described previously is effective in preventing this type of attack. •Rogue APs and ad hoc networks: Diligent network management can prevent a client from setting up a rogue access point. View chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780128000229000188 FortiGate Hardware OverviewKenneth Tam, ... Josh More, in UTM Security with Fortinet, 2013 Fortinet Product PortfolioBesides Fortinet’s offering of their FortiGate UTM solutions and their related central management capabilities, there are several other products Fortinet offers. We’ll highlight the purpose and key points on each of their product offerings. High-level overview of Fortinet’s service and other non-UTM product offerings: FortiGuardFortiGuard is Fortinet’s threat research and response service for the FortiGate UTM platforms and for most of the other offerings. The services offered here are primarily subscription based, providing signature updates for anti-virus, intrusion prevention, and application controls. In addition, direct access to real-time anti-spam reputation databases and web filtering URL categorization databases for the FortiGate UTM solution. The FortiGuard service is maintained and updated by security researchers around the world. Upon discovery of new threats, research and development of the related service signatures are synchronized with over two dozen global data centers where updates are distributed hourly to hundreds of thousands Fortinet UTM devices. Besides actively tracking global threats, developing, and maintaining security services for their UTM offerings, Fortinet security researchers also actively find exploits. To see both current and historical discovered vulnerabilities, see the FortiGuard web site [3]. For further details on FortiGuard, please reference Chapter 6. FortiCarrierThe FortiCarrier solution is an extension of the FortiGate solution. It leverages the same features as in the current FortiGate FortiOS but adds features used in service provider infrastructures such as GTP firewall, secure MMS (MulitMedia Messaging Services), and IMS SIP signaling firewall capabilities. As of FortiOS 4.0 MR3, all of the SIP related features in FortiCarrier was ported over leaving GTP and MMS features as the main differences for the FortiCarrier product line. The FortiCarrier platforms are limited to the FortiCarrier 3810A, 3950B, and the 5000 series system products with the FortiCarrier 5001A-DW and 5001B blades. For further details on the FortiCarrier products visit: http://www.fortinet.com/products/forticarrier/. FortiBridgeFortiBridge is a stand alone product used in conjunction with the FortiGate UTM platforms to provide a bypass method when the UTM solution goes offline. The FortiBridge bypass capabilities provide a automatic bridging of traffic by routing traffic around an inline FortiGate UTM in an event of a power outage or a system fault. There are three version of this product: FortiBridge-2002: Provides two segment bypass protection with 8 × 10/100/1000 copper interfaces. FortiBridge-2002F: Provides two segment bypass protection with 4 × GbE SFP (fiber or copper) and 4 × GbE fiber interfaces. FortiBridge-2002X: Provides two segment bypass protection with 4 × 10 GbE SFP+ and 4 × 10 GbE LC Fiber interfaces. Given this is an external bypass solution; it only works with a FortiGate UTM solution deployed in a transparent (layer 2) mode. This could be a cheaper alternative network redundancy solution then purchasing another FortiGate device for a high availability configuration. The only downsides to this solution are the transparent mode requirement (typical with any bypass solution on the market) and when the FortiGate UTM solution goes offline then there are no security enforcement in place. Since the FortiGate is offline and the external bypass solution is in bypass mode therefore bypassing security inspections usually performed by the FortiGate solution. For further details on the FortiBridge products visit: http://www.fortinet.com/products/fortibridge/. FortiAPFortiAP is an 802.11x wireless access point (AP) offering. As of this writing there are three commercial grade FortiAP models offered by Fortinet, FortiAP-210B, FortiAP-220B, and FortiAP-222B. All three models support 802.11a/b/g/n standards and operate on both 2.4 GHz b/g/n and 5 GHz a/n spectrums. The 210B has single radio whereas the other two have two radios. The 222B can be used outdoors unlike the other two models which are indoor only. Each radio supports multiple wireless clients with ability to span across multiple wireless network segments each with its own SSID and with different access rights. Having multiple radios in a single FortiAP provides options for dedicating certain wireless frequency spectrums to specific uses. A radio could also be dedicated for wireless rogue AP (Access-Point) detection. Rogue detection provides another layer of defense by detecting unauthorized access points being used in your network environment. In addition, on-wire rogue AP detection is possible by leveraging the dedicated wireless radio detected rogue AP MAC address and correlating the FortiGate wireless controller MAC entries from potential wireless user client using the rogue AP on the network. If a rogue AP is detected on your physically connected network (on-wire), the FortiGate has the ability to suppress and block network activities coming from the discovered rogue AP. These APs are used in conjunction with the FortiGate UTM solution acting as a wireless controller for the AP and providing fast roaming capabilities between FortiAPs. The wireless controller function is included in almost all FortiGate models (check datasheet to confirm support). With the FortiGate providing the wireless controller functionality, it adds additional benefit for a secure wireless infrastructure by leveraging all the FortiGate offered UTM features. For further details on the FortiGate built-in wireless controller feature will be covered in Chapter 7 of this book. FortiTokenFortiToken provides a two-factor authentication solution for use with the FortiGate platforms administrative access, IPSec VPN, SSL VPN, and Identity Policy Authentications. It provides another layer of security with a one-time password (OTP) capability used in conjunction with an existing single-factor authentication, such a static password. The seeding of the OTP is managed by our FortiGuard Center as a cloud-based repository. The FortiToken can also be used as a stand alone external authentication method used in conjunction with the FortiAuthenticator product (see description on this product below). Further details on this product will be covered in Chapter 5. FortiAuthenticatorFortiAuthenticator is a user-based identity management solution, used for user authentication, two-factor authentication with FortiToken, and identity verification network access. The user authentication credentials use a build-in standardized RADIUS or LDAP server configuration. It may also be integrated with third-party authentication servers such as Microsoft Active Directory by using LDAP. For further details on the FortiAuthenticator product visit: http://www.fortinet.com/products/fortiauthenticator/. FortiMailFortiMail is a comprehensive messaging security solution. It provides Anti-Virus, Anti-Spam, Data Loss Prevention, and Identity-Based Encryption for email. The product can operate in Gateway (MTA), Transparent and also offer a full email server mode capability. As of this writing there are four appliance models (FortiMail 200D, 400C, 2000B, 3000C), a chassis blade (5002B) version, and a Virtual Machine (VM) version. For further details on the FortiMail product visit: http://www.fortinet.com/products/fortimail/ FortiWebFortiWeb is a WAF (Web Application Firewall) that is used to protect, load balance, and accelerate content to and from web server(s). As a WAF, it provides protection for web applications and related database content by mitigating common threats like cross-site scripting, buffer overflows, denial of service, SQL injection, and cookie poisoning. It addresses the OWASP Top 10 web application vulnerabilities. FortiWeb also provides server load balancing, content-based routing, data compression, and SSL encryption accelerations. The product is ICSA Labs certified and also provides a built-in vulnerability scanner module that helps with PCI DSS compliance requirement 6.6. As of this writing there are three appliance models (FortiWeb 400C, 1000C, 3000C) and also a Virtual Machine (VM) version. For further details on the FortiWeb product visit: http://www.fortinet.com/products/fortiweb/. FortiScanFortiScan is a vulnerability management solution which provides a central network-level and OS-level vulnerability scanning of devices throughout the network. In addition, it provides patch & remediation management, asset management, and compliance reporting capabilities that are compliant with regulatory and best practices for FDCC, NIST SCAP, SOX, GBLA, HIPAA, PCI/DSS, FSIMA, and ISO 17799. For further details on the FortiScan product visit: http://www.fortinet.com/products/fortiscan/. FortiDBFortiDB is a database security and compliance product which provides a central management view of policy compliance and vulnerability management for databases. It supports majority of the commercial databases such as Oracle, MS SQL Server, Sybase, and DB2. As of this writing the product comes in three models (FortiDB-400B, 1000C, and 2000B) and also in a Virtual Machine (VM) version. The main difference between the FortiDB models are the licensing structure each model supports which are based on number of database instances used for the product. For further details on the FortiDB product visit: http://www.fortinet.com/products/fortidb/. FortiBalancerFortiBalancer is an application delivery controller. It provides Layer 2 through Layer 7 load-balancing capabilities. In addition, it provides a built-in caching supporting HTTP 1.1, in-line HTTP compression, TCP connection multiplexing, TCP accelerations, IPv6 support, and SSL offloading/acceleration. The product can be deployed in proxy and transparent mode configuration. As of this writing there are three versions of the FortiBalancer (FortiBalancer-400, 1000, and 2000). For further details on the FortiBalancer products visit: http://www.fortinet.com/products/fortibalancer/. FortiClientFortiClient is a software-based endpoint security client providing various security features for enterprise and mobile devices. As of this writing there are four versions of the client offering various features for several different OS platform and mobile devices. The versions of FortiClient and supported features are: FortiClient (standard)—Provides IPSec & SSL VPN, two-factor authentication support, Wan Optimization, and Application detection & enforcement along with Policy compliance enforcement when used with FortiGate UTM devices. FortiClient Premium—Provides all of the above features and adds Anti-Virus, Anti-Spam, Application-based firewall, and Web Filtering. FortiClient Lite—Is a free edition that only provides Anti-virus/spyware functionality. All versions of the FortiClient are supported on most Windows versions in 32 bit or 64 bit. At this time, only the standard FortiClient is support on OSX. Fortinet also offers a stand alone SSL VPN client for tunnel mode usage to a FortiGate solution. This stand alone SSL VPN client can be installed separately with no additional cost. Although, access to this client is available at Fortinet support website with a valid FortiCare support contract login. This endpoint SSL VPN client can support Linux and Mac OS besides Windows OS. For further details on the FortiClient products visit: http://www.fortinet.com/products/endpoint/ or http://www.forticlient.com. View chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597497473000028 Looking Ahead: Cisco Wireless SecurityEric Knipp, ... Edgar DanielyanTechnical Editor, in Managing Cisco Network Security (Second Edition), 2002 Network Hijacking and ModificationNumerous techniques are available for an attacker to “hijack” a wireless network or session. And unlike some attacks, network and security administrators may be unable to tell the difference between the hijacker and a legitimate passenger. Defining HijackingMany tools are available to the network hijacker. These tools are based upon basic implementation issues within almost every network device available today. As TCP/IP packets go through switches, routers, and APs, each device looks at the destination IP address and compares it with the IP addresses it knows to be local. If the address is not in the table, the device hands the packet off to its default gateway. This table is used to coordinate the IP address with what MAC addresses are local to the device. In many situations, this list is a dynamic list that is built up from traffic that is passing through the device and through Address Resolution Protocol (ARP) notifications from new devices joining the network. There is no authentication or verification that the request received by the device is valid. So a malicious user is able to send messages to routing devices and APs stating that their MAC address is associated with a known IP address. From then on, all traffic that goes through that router destined for the hijacked IP address will be handed off to the hacker s machine. If the attacker spoofs as the default gateway or a specific host on the network, all machines trying to get to the network or the spoofed machine will connect to the attacker s machine instead of where they had intended. If the attacker is clever, he will only use this to identify passwords and other necessary information and route the rest of the traffic to the intended recipient. This way the end user has no idea that this “man-in-the-middle” has intercepted her communications and compromised her passwords and information. Another clever attack that is possible is through the use of rogue APs. If the attacker is able to put together an AP with enough strength, the end users may not be able to tell which AP is the real one to use. In fact, most will not even know that another is available. Using this, the attacker is able to receive authentication requests and information from the end workstation regarding the secret key and where they are attempting to connect. These rogue APs can also be used to attempt to break into more tighdy configured wireless APs. Utilizing tools such as AirSnort and WEPCrack requires a large amount of data to be able to decrypt the secret key. A hacker sitting in a car in front of your house or office is easily identified, and will generally not have enough time to finish acquiring enough information to break the key. However, if they install a tiny, easily hidden machine, this machine could sit there long enough to break the key and possibly act as an external AP into the wireless network it has hacked. Sample Hijacking ToolsAttackers who wish to spoof more than their MAC addresses have several tools available. Most of the tools available are for use under a UNIX environment and can be found through a simple search for “ARP Spoof” at http://packetstormse-curity.com. With these tools, the hacker can easily trick all machines on your wireless network into thinking that the hacker s machine is another machine. Through simple sniffing on the network, an attacker can determine which machines are in high use by the workstations on the network. If they then spoof themselves as one of these machines, they could possibly intercept much of the legitimate traffic on the network. AirSnort and WEPCrack are freely available. And while it would take additional resources to build a rogue AP, these tools will run from any Linux machine. Hijacking Case ScenarioNow that we have identified the network to be attacked, and spoofed our MAC address to become a valid member of the network, we can gain further information that is not available through simple sniffing. If the network being attacked is using SSH to access their hosts, just stealing a password might be easier than attempting to break into the host using any exploit that might be available. By just ARP spoofing their connection with the AP to be that of the host they are wishing to steal the passwords from, all wireless users who are attempting to SSH into the host will then connect to the rogue machine. When they attempt to sign on with their password, the attacker is then able to, first, receive their password, and second, pass on the connection to the real end destination. If the attacker does not do the second step, it will increase the likelihood that their attack will be noticed because users will begin to complain that they are unable to connect to the host. Protection against Network Hijacking and ModificationYou can use several different tools to protect your network from IP spoofing with invalid ARP requests. These tools, such as Arp Watch, will notify an administrator when ARP requests are seen, allowing the administrator to take appropriate action to determine if indeed someone is attempting to hack into the network. Another option is to statically define the MAC/IP address definitions. This will prevent the attacker from being able to redefine this information. However, due to the management overhead in statically defining all network adaptors’ MAC address on every router and AP, this solution is rarely implemented. In fact, many APs do not offer any options to define the ARP table, and it would depend upon the switch or firewall you are using to separate your wireless network from your wired network. There is no way to identify or prevent any attackers from using passive attacks, such as from AirSnort or WEPCrack, to determine the secret key used in an encrypted wireless network. The best protection available is to change the secret key on a regular basis and add additional authentication mechanisms such as RADIUS or dynamic firewalls to restrict access to your wired network once a user has connected to the wireless network. However, if you have not properly secured every wireless workstation, an attacker need only go after one of the other wireless clients to be able to access the resources available to it. |
