Wireless Based Vulnerabilities

Question 1

Evil Twin (Wireless Vulnerability)

Answer 1

• rogue acces point that appears to be legitimate, but is set up to eavesdrop on wireless communications
• Karma Attack - type of evil twin attack, karma attacks radio machines automatically, devices listen for SSID requests and respond as if they were the legit access point

Question 2

Deauthentication attack (Wireless Vulnerability)

Answer 2

• type of denial of service attack that targets communication between a use and a WAP, disconnects target device to recapture authentication

Question 3

Fragmentation Attack (Wireless Vulnerability)

Answer 3

• network exploited by use of datagram fragmentation mechanisms, small amount of keying material is obtained from the packet then attempts to send ARP or LLC packets with known content to the AP
• if packets are echoed back by AP, larger amount of keying information can be obtained from returned packet

Question 4

Credential Harvesting (Wireless Vulnerability)

Answer 4

• focuses on collecting usernames and passwords, usually performed by use of fake captive portal ESPortalV2

Question 5

WPS Implementation Attacks (Wireless Vulnerability)

Answer 5

• WPS uses push button and 8 digit WPS pin for config, easily brute forced because PIN is authenticated by breaking it in two

Question 6

Bluetooth Attacks (Wireless Vulnerability)

Answer 6

• Bluejacking - sending unsolicited messages over BT to BT enabled devices
• bluesnarfing - theft of information from wireless devie through BT

Question 7

RFID Cloning (Wireless Vulnerability)

Answer 7

• capturing RF signal from bagde for copy and reuse

Question 8

Jamming (Wireless Vulnerability)

Answer 8

*wireless DOS attack that prevents devices from communicating with each other by occupying the frequency

Question 9

Repeating (Wireless Vulnerability)

Answer 9

*used to capture existing wireless signal and rebroadcast it to extend range, can be an attack vector if not properly configured

Question 10

Fake Cell Phone Towers (Wireless Vulnerability)

Answer 10

• used to capture the IMSI (Subscriber ID) number, can be used to create MITM