Risk Despite this people still think that there are too many risks, so this month, we will see who can make a hacker with a wireless network outside. Parasite
the style of Venom, the alien costume of Spiderman, many of the wireless networks of today have to / s parasites living with them, that is, that or those neighbors who gladly save a few euros use based on your connection. Usually the least of the problems and also the most uncomfortable, like having a chronic ailment in our Internet connection. Running
crimes
In this country there are different research groups within crimes telematics bodies security. These bodies are responsible for pursuing the intrusions of black hat hackers, or defacements (graffiti web page) of crackers or denial of service (DOS = Denial Of Service) or "dose" of the crashers, or ... .. Its mission is to find evidence which may have been the source of the attack and it is looking for the attacker's IP address. If the hacker has used techniques based anonymous proxy network anonymous TOR (The Onion Routing), the IP addresses of exotic countries will impede the investigation easily follow safety equipment, but ... anonymity these techniques are often slow, the easiest way is to get off the park, enjoy the good weather and use the IP address of wireless router unprotected turn. When the Police and / or the Civil Guard come home from the neighbor and seal the computer will be explained. Can you imagine coming to your house to precintaros the computer for something that never done? Then from there a forensic analysis is performed offline with a tool such Encase and ... Maybe include, for silly things that should not or ... well, I'm going, keep going.
Information Access
When you're on your wireless network, the connection works as a hub, then all the communications issued, if they are in radio visibility of the signal may be captured by the attacker. Thus, they may be MSN Messenger conversations (which are not encrypted) file transfers are made by these little programs (photos, office documents, music, etc ...) and can even record your voice conversations over IP in mp3 files Ethereal programs (that records. au), orekaudio, the same Cain or vomit.
Picture: Recording a conversation on file with Ethereal. au Identity Theft
If you are in your wireless network and can capture all traffic is made between your computer and the Access Point, then, if you connect to Hotmail, or a bank or e-mail your company or any site with credentials, the attacker can steal your passwords with programs like Cain, that comes with the complete suite for the cracking of them if they go encrypted.
Image: Stealing Passwords with Cain ", overloaded."
Okay, I guess this information will help you want securing wireless networks and as we saw in the first part, last month, the use of WEP is not acceptable, so we continue to see the alternatives.
WPA (Wireless Protected Access)
The Fi Alliance, in the period while approving the 802.11i standard that would replace WEP definitely proposed the use of the following security technologies that were already described in the draft would be the definitive standard. José Manuel Alarcón wrote in PCW number 232 of June this year an extensive article on WPA, so here we go a bit more direct.
WPA encryption
encryption system used in WPA change on WEP (RC4 with 64 keys and 128 bits) using TKIP (Temporal Key Integrity Protocol). TKIP still uses RC4 protocol, but in this case minimizing exposure to attack by using the following modifications.
- The Initialization Vector (IV) is too short in WEP, 24 bits. TKIP is used in 48-bit IVs. This, a priori only lengthen the process, but would still be valid the same type of attack.
- Data Integrity. WEP could be modified bits in the data and change the CRC32, ie could change. It uses a new protocol "Michael" MIC (Messatge Integrity Protocol) encryption is TKIP.
- WEP uses the primary key to encrypt and authenticate. TKIP generates a master key of 256 bits when the client authenticates which is called the Pairwise Master Key (PMK). PMK using more AP MAC address, MAC address of the Client and two random numbers were created for one another by the AP and client generated keys derived. In total 6 keys TKIP uses derivatives:
or Data Encryption Key: 128 bits and used to encrypt messages. Date
or Integrity Key: 128 bits and used in the MIC protocol to ensure the integrity (no change) of the message.
or EAPOL-Key Encryption Key: EAPOL messages are used to authenticate the connection, and when performing authentication processes using special keys.
or EAPOL-Key Integrity Key: Also key is used for MIC party authentication messages.
or Multicast Encryption Key: 128 bits to encrypt multicast data.
or Multicast Integrity Key: 128 bits to ensure the integrity of multicast messages.
- always use the same WEP key. TKIP is generated in a process of rekeying periodically to generate new temporary key.
- WEP is no protection Reinjection packages. That is, a packet can be captured and reinjected into the network, allowing for increased traffic. TKIP can not do this because it is used IV as the protection counter. Summarizing
TKIP TKIP
operation can be summarized as follows. When the client authenticates generates a master key (PMK) of 256 bits. From it, using the MAC address of the client, the AP and two random numbers generated by the client and the AP, 6 temporary keys are determined. These keys are used to encrypt and secure the data transmitted and also differentiates between data messages and authentication control. Each time a customer re-authenticate a new PMK is generated and periodically change the keys derived. Furthermore there is control of "replay" of packages using the IV which has increased from 24 to 48 bits. So here would be a stronghold of the WEP protocol, but also how to encrypt and decrypt has changed a bit.
Encryption Process
Step 1: With the IV, the destination address and the Data Encryption Key is generated using a blending algorithm Encryption Key Package (Per Packer Encryption Key).
Step 2: Using the destination address, source address, packet priority, the data to send and Data Integrity Key is calculated using Michael MIC algorithm.
Step 3: Calculate the ICV (Integrity Check Value from the CRC-32).
Step 4: With the IV and the packet encryption key is generated, with the keystream RC4 PRNG encryption is the same size as the data, the MIC and ICV.
Step 5: XOR is performed between the RC4 Keystream and data, MIC and ICV to produce the encrypted message.
Step 6: IV is added to the package.
The main difference is the use of a different key per packet, which is derived from a temporary key (which changes periodically) which in turn is derived from the Master Key, which changes with each authentication process.
Decryption Process
Step 1: IV and is extracted together with the Destination Address and the Data Encryption Key is generated packet encryption key.
Step 2: With the package encryption key and the IV is generated RC4
Keystream Step 3: XOR is made between the RC4 Keystream and the encrypted message to obtain the decrypted message.
Step 4: ICV is calculated and compared with it was in the package to accept or discard the packet.
Step 5: In the Destination Address, the Source Address, Data and Data Integrity Michael Key used to calculate the MIC.
Step 6: It compares the received MIC and the MIC calculated. If not equal the packet is discarded.
The decryption process, as you can see, is symmetrical encryption.
WPA authentication
Wireless To authenticate connections we have 2 distinct environments, home environment and business environment.
WPA-PSK
In a domestic environment we usually have only one access point (AP) and a number of clients. We do not use external servers so we will not deploy a complex infrastructure (or does she?). In this environment we use a solution based on shared key (Pre-Shared Key) to configure the clients and the Access Point.
Image: WPA on the AP
Choosing the Shared Key (PSK) should be as long and random as possible (not like we have in the capture of the screen). The PSK must be configured on the clients and used to authenticate connections and generate the master key. An attacker can, from an authentication package a client application brute force algorithm to obtain the PSK that will allow the user to authenticate, but not worth it to get the information that is transmitted to another customer and another client data will be encrypted by the temporary key and therefore would have to find the keys time to ascertain the per-packet key and decrypt the traffic. These temporary keys can be ascertained after the event and find out the traffic has been transmitted. If we use a random 63-character key time break by brute force makes such attacks infeasible. If instead the password is short, an attacker that captures the authentication package (handsake or greeting) could launch a dictionary attack or force the program AirCrack fruit.
Image: dictionary attack on WPA-PSK Aircrak
Client Configuration WPA-PSK
To configure WPA-PSK client on MS Windows XP is sufficient to configure the properties of a new wireless network by selecting WPA-PSK as an authenticated system, TKIP as encryption and shared key set for each customer:
Image: WPA PSK Customer
EAP (Extensible Authentication Protocol) EAP
born as an evolution of PPP (Point to Point Protocol) allowing us to negotiate the authentication between the client, also known Supplicant and Authentication Server. Unlike PPP, EAP is first established the connection, then negotiates the authentication method (EAP Method) between the Supplicant and the Authentication Server and finally granted access or denied the connection. This allows clients to be authenticated in different ways by the same server whenever and brother both agree on the authentication method. EAP allows different authentication methods but the most common are:
- EAP - MD5 - CHAP: In this method we use a challenge response with the encrypted password in MD5 CHAP mechanism. This mechanism is not often used in connection insecure (public network) and reserves and dedicated lines only for compatibility with older versions because CHAP has been violated.
- EAP-TLS: use as client credential a user certificate. So, anyone who wants to authenticate your password must not have but a digital certificate.
- Protected EAP (PEAP): With this method, prior to the EAP negotiation between the client or supplicant and the authentication server establishes a secure TLS channel, similar to that used in HTTPS, so it is necessary that our server has a certificate authentication server. Once established that channel will proceed to the EAP session, which may be:
or PEAP-MSCHAP v2: As in the previous method first establishes a TLS channel between the Supplicant and the Authentication Server and then start a session challenge MS CHAPv2 response to authenticate the client.
or PEAP-TLS: Again this is a method that uses TLS secure channel before sending the credentials of the supplicant. In this case, the credential that the client will present a digital certificate. In this method we must use a server certificate to establish TLS channel EAP pre-session and then a digital certificate for the client to authenticate.
These are methods that can be used to authenticate our connections to each of us to choose we must establish appropriate mechanisms, so if we use EAP-TLS to install a digital certificate on each of the petitioners to authenticate, if we use PEAP-MSCHAPv2 have to have a digital certificate on the authentication server and you use PEAP-TLS will require digital certificates for all participants of the communication.
RADIUS server (Remote Authentication Dial-In User Service)
RADIUS is a protocol authentication has become an industry standard to validate users through different methods. Transactions in each of the communications between the client and server are encrypted using a shared key. This shared key is never sent over the network and each request for authentication between a RADIUS client and RADIUS server must be encrypted with this shared key.
When we want to establish a Wireless client authentication to a RADIUS client network will be the Access Point and RADIUS server containing the database of clients that can connect. To this end, the Access Point we set:
- The IP address
RADIUS server - RADIUS server port, usually 1812.
- The Shared Key.
Image: RADIUS Server Settings in the AP
The RADIUS server will set the shared key for each customer that can make a RADIUS request. In the next month will finish installing the infrastructure and see how to configure Microsoft Internet Authentication Server server (MS IAS), which is the Microsoft RADIUS server. 802.1x
To use the Wireless connection PAD system is necessary to use a protocol to encapsulate traffic from the wireless connection to the authentication server. In a community will have an authentication server, which will set policy on what may or may not connect supplication to the organization, and that will be within a protected area of \u200b\u200bour network. Wireless Access Point will have direct connection to the authentication server and which require a process of authentication for a particular supplicant. 802.1x born as a way to allow any element of the network (switches, APs, ....) Demand an authentication process for a connection that has just taken place. 802.1x uses EAPOL (EAP Over LAN) because what is going to make is an encapsulation EAP protocol on the private network to reach the Authentication Server. Thus, as shown in the chart, the process is as follows:
Step 1: A client is associated with the AP using the 802.11 protocol
Step 2: The supplicant starts the 802.1X authentication process because the AP does not grant access to the network and choose the EAP-Method.
Step 3: Authenticator to the Supplicant identity requires
Step 4: Identity delivers Supplicant to Authenticator which will broadcast the Authentication Server. As you can see, the Authentication Server is a RADIUS server to request credentials for that identity to Autentcador.
Step 5: Credentials requests Authenticator the supplicant. Pado
6: Supplicant Authenticator delivers credentials to be relayed to the authentication server (RADIUS server)
Step 7: RADIUS server validates the credentials and accepts the connection.
Step 6: The Authenticator accept delivery after the EAPOL-Key connection is not just a sequence of bits to use as a master key in the process of encryption algorithm TKIP. Thus, whenever we have an authentication process or re-authentication generates a new Master Key.
Image: EAPOL Authentication
0 comments:
Post a Comment