Wireless Hacking #1

Welcome to the first of a series of articles dedicated to the art of hacking wifi Internet connections using Kali Linux and terminal commands.
You will know:

• What are the different flavors of wireless networks you’ll encounter and how difficult it is to hack each of them.

• What are hidden networks, and whether they offer a real challenge to a hacker.

• You’ll have a rough idea how each of the various ‘flavors’ of wireless networks is actually hacked.

Wireless Security Levels

Below is a simple list of points I use to explain various possible security implementations that a wireless network may have.

Suppose you are the owner of a music venue. There can be many possible scenarios as far as entry to the music venue is concerned:

• Open Entry

• Open Networks

• Connect to the wireless router (access point).

1 Open entry and unrestricted usage – Anyone can walk right in. They have unrestricted access to the dance floor, free beer, etc.

2 This is open network. This is only used in public places (restaurants, etc.) which offer free Internet access to its users (WiFi hotspots). It’s fairly uncommon to find such networks.

3 Open entries but restricted usage. Anyone can walk right in, but have to pay for drinks. For the router’s security purposes, this is also an open network. However, connecting to the wireless router (entering the music venue) doesn’t guarantee you unlimited access to the internet. There is another layer of authentication. These are seen in public places (airports, restaurants, fast food joints, shopping malls) where they let you connect to the wireless network without any password, but after that you have an additional layer between you and the internet. This layer usually restricts your ability to access the internet (either by bandwidth or by time). This layer can be used to charge you for the amount of data you use.

The point to note in the discussion above is that wireless hacking usually refers to cracking the router’s password. The additional layer which might be present between you and the internet after your login is something you’ll have to deal with separately, and is not covered under wireless hacking. So, from WiFi hacking perspective, both the networks above are the same, “open”, and do not require any hacking.

Password at door and unrestricted access.

The member of the music venue pays a certain amount every month, and get access to free drinks. They have to say the password at the shady looking entrance to the music venue. Unfortunately, it’s quite easy for anyone to overhear the password and get in. This is WEP protected network. For a person who has Kali Linux installed on his machine, hacking this kind of wireless network is a matter of minutes (download Kali Linux here. These are easy targets. However, nowadays it’s fairly uncommon to find WEP protected networks, because of the ease with which they can be hacked into. WPA and WPA-2 are more common.

Password at door but restricted access.

In the music venue example think about when only members can enter, but they still have to pay for their drinks. This is the case when the network has password and an additional layer to get access to the internet. This is common in three cases:

– Colleges often allocate student’s IDs (and)

– Passwords usage, which students can access

– Internet facilities offered by an institute/school

 

1 ISP requires login – Many ISP’s require users to login to their account to access the internet. Often logging in provides an interface which lets the users see their bandwidth usage, details of their network plan, etc.

2 Colleges/ Schools/ Offices – Many institutes provide users accounts which they use to access the institutes’ network.

Again, from the wireless hacking perspective, both the networks above are “WEP protected”, and are rather simple to hack into.

Well-Guarded Entry

As far as the bifurcation into whether or not another layer of authentication is present once you have the wireless network password is concerned, WEP and WPA cases are the same. The only difference is that the college wireless routers have WPA instead of WEP Thus, this doesn’t merit further discussion. However, there’s another subcategory in this that we will discuss.

1 Fingerprint and retinal scan for entry – The entry to this music venue is secure enough for most purposes. Getting past this level of security takes a lot of time and efforts. Theoretically, if you’re willing to do what it takes, you may still get it. But a heist of this magnitude will take a lot of planning, and even then, a lot depends on sheer luck. This is WPA secure network. The only way to crack this network with dictionary or bruteforce attack. Bruteforce attacks may take forever depending on the length of the password, and dictionary attacks too will take days/weeks depending on size of dictionary, and still may fail (if the password is not in the dictionary).

2 Fingerprint and retinal scan for entry, and a card which you can quickly swipe to avoid standing in a queue since the aforementioned scans take some time. By introducing this card, the music venue created an alternate path for entry. While this saves time for the legitimate users, the card can be stolen. While it’s not as easy as overhearing the password (WEP), or walking right in (open). This is WPA with WPS enabled. WPS has a vulnerability which allows a hacker to get a password in around 3 hours (can be more sometimes, up to 10-12 hours, but that figure is nothing compared to WPA). Just like WEP, WPS is now a well-known weak point and new routers have either disabled WEP or added some measures (like rate limiting) which make it really hard to, well, pickpocket the members.

Hidden entry

Any of the above music venues could have a secret entrance. This is somewhat similar to what is called “Security Through Obscurity” How we you get in if you don’t know where the music venue’s entrance is? Well, while you don’t know where the music venue entrance is, you know where the music venue is. You have two options:

1 You go to the roof of a nearby building, take your binoculars out, and try to find out how people enter the building. In wireless terms, you wait till a client connects to the network. This may take a lot of time, but it’s relatively safer from a forensic viewpoint (by not doing anything, just watching patiently, you ensure that you don’t leave any clues behind which may later be used to catch you).

2 You cut off the electric/water supply to the building, or maybe somehow trigger the fire alarm. One way or the other, force the members to get out of the music venue. Once they find out that everything is fine, they’ll swarm back in. You will know where the gate is. In wireless terms, you can de-authenticate the clients (you’ll be doing this often, whether you’re hacking a WEP network, or getting a WPA handshake [again, more on this later]). Off course, this method results in you leaving behind some traces, but at least you don’t have to wait for hours.

The analogue of hidden entry music venues are hidden networks. As long as the network has clients, it’s quite easy to find out the name of the network (SSID to be precise, setting the network to hidden basically stops the access point from revealing it’s SSID). However, when a client connects to the network, beacon frames (date packets) with SSID (in clear-text, i.e. unencrypted) are transmitted, which you can capture and get the SSID of the network.

So, hidden networks don’t really offer much protection to a network, and a WEP protected hidden network just means that instead of 10 mins it will take 15 mins to get the password. For a WPA network, making the SSID hidden doesn’t really do a lot since WPA networks are practically uncrackable and a person who has the time and processing power to get past WPA encryption won’t be stopped by the hidden SSID.

Summary

There can be additional authentication steps (logins) or other barriers between you and internet even after you get access to the router. However, this is an entirely separate problem and not too relevant to the discussion of wireless hacking. Still it’s something you must be aware of:

◦ Wireless hotspots or open networks don’t have any encryption. They can be accessed by anyone. Also, the data transmitted by you is not encrypted and can be read by anyone in the vicinity. Anything which you send to the destination server in plain-text (say, to google), will be transmitted from your machine to the wireless router in plain-text. Anyone in the vicinity can easily read it using Wireshark or any other similar tool (check Wireshark) Of course, sensitive data is rarely sent in plain-text, so don’t sit around wireless hotspots hoping to get someone’s FB login credentials. However, lack of encryption in open networks should be considered seriously. As far as wireless hacking is concerned, not a lot to do here (other than sniffing at unencrypted data in the air).

◦ WEP – This is where most of the stuff happens. Countless vulnerabilities, countless attacks, countless research papers listing the issues, countless tools to get the passwords. It doesn’t take too much effort to learn how to hack these. If you are familiar with Linux, then it takes practically no efforts at all. Just some terminal commands, and you’re done (with wifite you don’t even have to bother with that).

◦ WPA – Dictionary attacks and bruteforce are the methods to get in. Will cover all this in future articles on Wifi Hacking. Of course when I say WPA, I refer to both WPA and WPA-2.

◦ WPA with WPS – Tough guy with a weak spot. Hit him where it hurts and the ‘it takes forever to get in’ becomes a matter of hours. Not as easy as WEP, but still do-able. Unfortunately, you might encounter a guy who has a weak spot but has started learning his lessons and guards that spot properly (WPS but with rate-limiting or some other security measure).

I hope you now have a general idea about the various flavors of wireless security. I have a few advanced guides in mind too, which will touch the cryptographic specifics about these ‘flavors’, the vulnerabilities, and their exploits. As far as the practical hacking process is concerned, there are plenty of tutorials here on this website and elsewhere on the internet regarding that, so I am not covering that again. I hope that this time when you read a guide you are aware of what’s going on, and don’t end up trying an attack that works on WEP targets on a WPA network. The last two points would be covered in detail in the coming articles.

Resources

Introduction to Wi-Fi Wireless Networking

Kali Linux Forums on GROUND ZERO – http://zeroerfjaacldxzf.onion/index.php (Onion Site)
Example of WPA2 wifi hacking with Kali Linux