Rochester Institute of Technology RIT Scholar Works Theses 2003 A Practical guide to understanding wireless networking concepts, security protocols, attack, and safer deployment schemes Jay Yip Follow this and additional works at: https://scholarworks.rit.edu/theses Recommended Citation Yip, Jay, "A Practical guide to understanding wireless networking concepts, security protocols, attack, and safer deployment schemes" (2003). Thesis. Rochester Institute of Technology. Accessed from This Thesis is brought to you for free and open access by RIT Scholar Works. It has been accepted for inclusion in Theses by an authorized administrator of RIT Scholar Works. For more information, please contact [email protected]. Rochester Institute of Technology B. Thomas Golisano College of Computing and Information Sciences Master of Science in Information Technology Thesis Approval Form Student Name: __.:::..:Ja::::.lyl..-Y.:.....:i~p _____________ Thesis Title: A Practical Guide To Understanding Wireless Networking Concepts, Sec.urity Protocols, Attack, and Safer Deployment Schemes Thesis Committee Name Signature Date Prof. Bruce Hartpence Bruce Hartpence Chair Bradley R. Newcomer Bradley R. Newcomer 5 -11 -OL( Committee Member Robert B. Cummings Robert B. Cummings 5-11-01: Committee Member Thesis Reproduction Permission Form Rochester Institute of Technology B. Thomas Golisano College of Computing and Information Sciences Master of Science in Information Technology A Practical Guide To Understanding Wireless Networking Concepts, Security Protocols, Attack, and Safer Deployment Schemes I, Jay Yip, hereby grant permission to the Wallace Library of the Rochester Institute of Technology to reproduce my thesis in whole or in part. Any reproduction must not be for commercial use or profit. Date: t;11~ )OLf Signature of Author: _J_a~y_Y_i-,--p_____ _ I A practical guide to understanding wireless networking concepts, security protocols, attack, and safer deployment schemes By Jay Yip Project submitted in partial fulfillment of the requirements for the degree of Master of Science in Information Technology Department of Information Technology B. Thomas Golisano College Of Computing and Information Sciences October 2003 Abstract/Introduction page4 Overview page4 Research page5 Why is wireless so important? page6 802.11b verses 802.1 1g page7 Popularity changes page7 Comparison chart of 802.11b verses 802.1 1g along with 802.11 a...page8 Introduction to WEP page9 WhatisWEP page9 How WEP encryption works pagel 0 How shared key authentication works pagel 2 How open key authentication works pagel 3 Enabling WEP pagel 4 WEP is flawed pagel 6 Why Wi-Fi is insecure pagel 6 History of 802. 1 1 security vulnerability timeline pagel 9 Different types of WEP attacks page20 How to find an access point page23 Equipment needed to find an access point page23 Windows XP page24 Netstumbler page25 ApSniff page27 Is Wardriving legal? page28 Wireless Traffic and WEP cracking tools page29 Ethereal page30 Kismet page31 Airsnort page32 WEP Crack page32 Dwepcrack page33 Comments found regarding WEP page34 In favor of WEP page34 In opposition of WEP page35 WEP2 (Second Generation WEP) page36 WEP2 verses WEP page36 Future of WEP2 page37 Alternatives to WEP/WEP2 page37 WPA (Wi-Fi Protected Access) page37 Advantages of upgrading to WPA page40 Migration from WEP to WPA page40 Issues over implementing WPA page41 802. 1 1 i page42 Authentication Protocols and Encryption Algorithms page43 802. 1 x page43 802. 1 x authentication with Wi-Fi page44 EAP (Extensible Authentication Protocol) page45 RADIUS (Remote Access Dial In User Service) server page46 AES (Advanced Encryption Standard) page47 Roaming Issues page48 Multiple Access Points with the same SSID page48 Multiple Access Points with an authentication sever page48 Author's recommendations page49 Implement a firewall page50 Implement WEP page50 Securely configure the access point page51 Implement Fake AP page51 Detect rogue access points page52 Implement a VPN page53 Tunneling and encapsulation basics page53 PPTP and L2TP Protocols page54 Implement a RADIUS authentication server page54 pot' Setup a 'honey page54 Conclusion page55 Abstract/Introduction With the explosion of wireless networks appearing in buildings, business and educational campuses, and even homes; security is a large concern in order to prevent attempted intrusions and malicious attacks from the retrieval of confidential data. Wireless Fidelity, Wi-Fi for short, does provide security in the form called Wired Equivalent Privacy otherwise simply known as WEP. However cases documenting WEP's security mechanism being breached in legitimate and illegitimate cases have been published and are readily available on the Internet. While wireless networks provide the freedom of mobility for users, this also allows potential hackers to eavesdrop on unsuspecting wireless users. Or worse, one could potentially hijack an access point and gain unauthorized access past the wireless network and then into the wired internal network. Thus an intruder who has hijacked an access point will be able to access critical data while hiding safely outside the building. Knowledge and understanding of wireless networks and of its security is a necessary step to be learnt if wireless networks are to be deployed securely especially in congested urban settings. Overview Network administrators implement WEP as a security means for users with wireless network capable devices that connect with access points; however WEP is flawed and can not be used as an absolute means of security. Available are applications that can sniff wireless traffic and view the contents of packets as they are being transmitted through the air. Also available are applications that can break WEP's security codes and mechanism which are readily available to be downloaded off the Internet. These applications work by capturing enough wireless packets and analyzing each one. Given enough time and resources, data can be revealed and WEP keys can be cracked. Even worse, the capturing of packets does not need to be within the same building. In fact it can be anywhere within the coverage range of the wireless network hence providing a great advantage for a potential intruder. Once a hacker has established connection to an Access Point and has cracked WEP, the hacker is virtually sitting inside a closed room in front of a victim's unoccupied computer. To make matters worse, once the penetration has been discovered; capturing the culprit is futile since they were never inside the building in the first place! By better understanding the aspects of wireless networking security, better security measures can take place. But before hand; it is best to understand what WEP is, how it works, why it fails, and what other measures can be implemented to decrease the chances of attacks. Research The scope of this thesis involves a brief discussion of available wireless protocols and what lies in the future with regards to securing computer networks whether they are wired or wireless. Research documenting what is WEP, how it works, and why it is flawed in terms of security will be discussed. This thesis will also document ways of finding wireless networks using a personal laptop computer or PDA (Personal Digital Assistant) armed with a wireless card and knowledge of the Windows and Linux operating system. Also a list of available programs available off the Internet will be briefly discussed and screen shots will be provided showing what each program is capable of doing in terms of potentially allowing an intruder to gain unlawful access from and into a wireless network. Information pertaining to the steps needed in order to crack WEP will be documented without creating a set of cookbook instructions. All the relevant information researched off the Internet will be comprised into a guide needed for someone to understand what the current forms of security exist for wireless networks during the time of this writing. Second generation WEP (WEP2) will be discussed and compared with first generation WEP as the hopes for this second generation version will provide a more robust version to first generation WEP. Alternative forms of security to WEP will be presented although none of them have been yet implemented into the market during the time of writing this thesis. Other alternative forms of existing and under development authentication and encryption schemes will be discussed, although their original purpose may not have been designed for Wi-Fi the concepts can be applied towards it. Based upon all gathered research, this thesis will include personal recommendations of setting up a wireless network in hopes to provide a more difficult setting for intruders to gain of unlawful access based upon the current security mechanisms and schemes available during the time of writing. Why is wireless so important? Planning for the future is an important step, which not only applies to computing technology but along with all other aspects of life. Although wireless is considered somewhat of a novelty during the time of this writing, in future time the role of wireless is bound to play a much larger role in the world of computing networks and beyond. According to Dr. Bernard Aboba of the Microsoft Corporation, he predicts wireless systems by the end of the first decade in the 20th century will consist of the following1: A viable desktop NIC replacement Wireless ISPs will happen Community nets will happen Adhoc networking will extend coverage dramatically Dual 802.1 1/WAN NICs will be commonplace Although they are only predictions, the probability of them actually occurring seems very likely to happen given the boom in computer technology from the early 1990's into the early 2000's. In the mean time during the time of this writing, some network administrators may oppose wireless or some may simply not want to deploy it. Based upon the above predictions, all network administrators should be prepared to either embrace wireless or at least accept it because wireless networking is currently only at its infancy and the future seems to indicate that wireless is not going to go away anytime soon.