Wireless Attacks

Question 1

Dissociation Attack

Answer 1

Dissociation Attack

• Removes client from wireless network
• Attacker sends dissociation frame with spoofed MAC address of victim to AP
• AP disconnects victim from wireless network

Question 2

WPS Attacks

Answer 2

WPS Attacks

• Wifi Protected Setup - config wireless device with PIN or buttons
• Brute force attack - keep trying PINS until one works
• Reaver is tool that can guess PIN in 10 hours
• With PIN can discover passphrase in WPA and WPA2
• Should disable WPS

Question 3

Rogue AP

Answer 3

Rogue AP

• Sniffer to capture wired traffic and broadcast wirelessly
• Attacker could use rogue AP to access wired network

Question 4

Evil Twin

Answer 4

Evil Twin

• Rogue AP with same SSID as legit AP
• Users connect to, attacker could present bogus login page
• Attacker could traffic

Question 5

IV Attack

Answer 5

IV Attack

• Initialization Vector attack
• IV = number plus pre-shared key
• Try to discover pre-shared key from IV
• Attacker injects packets, AP responds with more packets, each with an IV
• WEP uses small 24-bit IV; good chance it will send same IV, so can figure out key
• WEP can be broken in < 1 minute

Question 6

Bluejacking

Answer 6

Bluejacking

• Send unsolicited messages to nearby Bluetooth devices
• Harmless
• Message can confuse users

Question 7

Bluesnarfing

-Tools

Answer 7

Bluesnarfing

• Unauthorized access to, or theft of info from Bluetooth device
• Can access email, contacts, calendars, texts
• Attack tools: hcitool, obexftp

Question 8

Bluebugging

Answer 8

Bluebugging

• Like Bluesnarfing
• Attacker installs backdoor
• Attacker can have user’s phone call attacker, so can eavesdrop
• Also listen to phone calls, enable call forwarding, send messages

Question 9

Replay Attack

• What is vulnerable?
• What is not vulnerable?

Answer 9

Replay Attack

• Attacker captures data between two parties, modifies, attempts to impersonate one party by replaying data
• WPA2 uses CCMP and AES so not vulnerable
• WPA using TKIP is vulnerable - should not be used

Question 10

Which is short range? NFC or Bluetooth?

Answer 10

Which is short range? NFC or Bluetooth?

-NFC