3.4 - Wireless Security

Question 1

Wireless networks

Answer 1

• Require additional security controls, since anyone nearby can listen in
• Authenticate (username + passwords, multifactor authentication, 802.1x, smart cards etc)
• Encrypt all data (everyone has an encryption key) to send and receive data
• Verify the integrity of all communication (original received is original), sometimes called an MIC (message integrity check)

Question 2

MIC

Answer 2

• Message integrity check

- verify that that data receives matches the data sent

Question 3

WPA2

Answer 3

• Wi-Fi Protected Access II
• Certification began in 2004
• Uses Counter Mode with Cipher Block Chaining Message Authentication Code Protocol or Counter (CBC-MAC Protocol)
• Challenges: although not insecure, it is susceptible to brute force attacks
• listen to the four-way handshake (some methods can derive the PSK hash without the handshake)
• once attacker have hash they can begin brute force to try to get the pre-share key
• remember GPU processors are fast and cloud based password cracking make brute force easier
• Once you have the PSK (pre - shared key) you have access to everyone’s wireless key (there’s no forward secrecy)

Question 4

WPA3

Answer 4

• Wi-Fi Protected Access III
• Introduced in 2018
• uses a different block cipher mode (GCMP - Galois/Counter Mode Protocol)
• stronger encryption than WPA2
• avoids the hashing problem of WPA3 (includes a mutual authentication, creates a shared session key without sending that key across the network)
• no more handshaking or hashes being sent
• has perfect forward secrecy

Question 5

CCMP

Answer 5

• Counter Mode with Cipher Block Chaining Message Authentication Code Protocol or Counter CBC-MAC Protocol
• Is used by WPA2 (wi-fi protected access II)

Question 6

CCMP Security Services

Answer 6

• Data Confidentiality with AES

- Message Integrity Check (MIC) with CBC- MAC

Question 7

GCMP

Answer 7

• Used in WPA III (Wifi protected access III)
• stronger encryption than WPA2
• Data confidentiality still uses AES, but the MIC (message integrity check) uses the GMAC (Galois Message Authentication Code) instead of the CBC-MAC

Question 8

PSK

Answer 8

• Pre- shared key

Question 9

Perfect Forward Secrecy

Answer 9

• Session keys change often and everyone has a different session key

Question 10

SAE

Answer 10

• Simultaneous Authentication of Equals
• Derived from Diffie-Hellman key exchange with an authentication component
• Everyone uses a different session key, even with the same PSK
• An IEEE - standard (802.11 standard) - the dragonfly handshake

Question 11

Wireless Authentication

Answer 11

• Can be mobile users, or temporary users

- Generally 2 ways to authenticate: PSK or 802.1x

Question 12

PSK

Answer 12

• Pre-shared key / shared password

Question 13

802.1X

Answer 13

• Provides centralized authentication
• used in corporations, ask to connect to a centralized network and then you must authenticate
• vs PSK

Question 14

Open System

Answer 14

• no password required

Question 15

WPA3- Personal

Answer 15

• WPA3- PSK
  0 wPA3 with a preshared key
• everyone uses the same key
• unique wpa3 session key is derived from the PSK using SAE

Question 16

WPA3- Enterprise

Answer 16

• Common in corporate environments

Question 17

Captive portal

Answer 17

• Method of providing authentication using a separate screen on your browswer (re-direct to a log in page)
• many also support MFA
• After you log in then you have access to wireless portal
• Often have to either log out or there is a timeout for the session

Question 18

WPS

Answer 18

• WiFi Protected Setup
• Originally called WiFi Simple Config
• A type of authentication
• Allows “easy” set up of a mobile device
• A passphrase can be complicated to a novice
• Can use a PIN on mobile device or might have to push button on access device or bring wireless device close to the access point using NFC
• This means you don’t have remembered a shared key or using 802.1x
• Most common way to authenticate: use PIN (but there are security flaws to this, it might be best to disable)
• While intended to make things easier, it made things less secure
• best practice - disable it on wireless network

Question 19

WPS Hack

Answer 19

• Dec 2011
• PIN = 8 digit number, but it’s really only 7 and a check sum
• But even worse, the WPS processes only the first 4 digits and then the 3 digits
• This drastically reduces the combo possibly to a total of 11K possibilities
• easy to brute force
• newer WPS will have brute force protections, but older versions don’t

Question 20

Authentication Types

Answer 20

• Username / Password (sometimes combined with other factors)
• common on both wired / wireless networks

Question 21

EAP

Answer 21

• Extensible Authentication Protocol
• Authentication framework
• Often used with 802.1x, prevents access to the network until authentication succeeds.
• Many different ways to authenticated based on RFC standards (Manufacturers can build their own EAP methods)

Question 22

802.1X

Answer 22

• Aka Port-based Network Access Control (NAC)
• you don’t get access to network until you authenticate
• Used in conjunction with an access DB (ex: RADIUS, LDAP, etc)
• Ex: 3 parts to IEEE 802.1X and EAP
• Supplicant = client, Authenticator (the device that provides access), Authentication Server (Validates the clients credentials)

Question 23

EAP-FAST

Answer 23

• EAP Flexible Authentication via Secure Tunneling
• ways the authentication server and the supplicant can receive secure data via a PAC (a shared protected access password, aka a shared secret)
• Supplicant receives the PAC, and Supplicant and AS (Authentication Server) mutually authenticate and negotiate a TLS tunnel.
• Sets up a TLS tunnel (very similar to how browsers are encrypted)
• Often need a RADIUS server (provides an authentication DB)

Question 24

PEAP

Answer 24

• Protect Extensible Authentication Protocol
• Protect EAP (created by Cisco, Microsoft, and RSA)
• Also encapsulates EAP in a TLS tunnel, AS uses a digital certificate instead of a PAC
• Client doesn’t use a separate digital certificate
• Probably combining MSCHAP v2 (Microsofts Handshake)
• User can also authenticate with a GTC generic token card

Question 25

EAP-TLS

Answer 25

- EAP Transport Layer Security, strong security, wide adoption, support from most of the industry - Requires digital certificates on the AS and all other devices - Relatively complex implementation, need a PKI, must deploy/manage certificates, not all devices can support use of TLS