Chapter 3. Bypassing WLAN Authentication

Note

"A false sense of security is worse than being unsure."

Anonymous

A false sense of security is worse than being insecure, as you may not be prepared to face the eventuality of being hacked.

WLANs have weak authentication schemas, which can be easily broken and bypassed. In this chapter, we will look at the various authentication schemas used in WLANs and learn how to beat them.

In this chapter, we will look at the following:

• Uncovering hidden SSIDs

• Beating MAC filters

• Bypassing Open Authentication

• Bypassing Shared Key Authentication

Hidden SSIDs

In the default configuration mode, all access points send out their SSIDs in the Beacon frames. This allows clients in the vicinity to discover them easily. Hidden SSIDs is a configuration where the access point does not broadcast its SSID in the Beacon frames. Thus, only clients which know the SSID of the access point can connect to it.

Unfortunately, this measure does not provide robust security, but most network administrators think it does. We will now look at how to uncover hidden SSIDs.

Time for action – uncovering hidden SSIDs

Follow these instructions to get started:

1. Using Wireshark, if we monitor the Beacon frames of the Wireless Lab network, we are able to see the SSID in plain text. You should see Beacon frames as shown in the following screenshot:

   

2. Configure your access point to set the Wireless Lab network as a hidden SSID. The actual configuration option to do this may differ across access points. In my case, I need to check the Invisible option in the Visibility Status option as shown next:

   

3. Now if you look at the Wireshark trace, you will find that the SSID Wireless Lab has disappeared from the Beacon frames. This is what hidden SSIDs are all about:

   

4. In order to bypass them, first we will use the passive technique of waiting for a legitimate client to connect the access point. This will generate Probe Request and Probe Response packets which will contain the SSID of the network, thus revealing its presence:

   

5. Alternatively, you can use aireplay-ng to send Deauthentication...

MAC filters

MAC filters are an age old technique used for authentication and authorization and have their roots in the wired world. Unfortunately, they fail miserably in the wireless world.

The basic idea is to authenticate based on the MAC address of the client. This list of allowed MAC addresses will be maintained by the network administrator and will be fed into the access point. We will know look at how easy it is to bypass MAC filters.

Time for action – beating MAC filters

Let the games begin:

1. Let us first configure our access point to use MAC filtering and then add the client MAC address of the victim laptop. The settings pages on my router look as follows:

   

2. Once MAC filtering is enabled only the allowed MAC address will be able to successfully authenticate with the access point. If we try to connect to the access point from a machine with a non-whitelisted MAC address, the connection will fail as shown next:

   

3. Behind the scenes, the access point is sending Authentication failure messages to the client. The packet trace would resemble the following:

   

4. In order to beat MAC filters, we can use airodump-ng to find the MAC addresses of clients connected to the access point. We can do this by issuing the commands airodump-ng -c 11 -a --bssid 00:21:91:D2:8E:25 mon0. By specifying the bssid, we will only monitor the access point which is of interest to us. The -c 11 sets the channel to 11 where the access point is. The -a ensures that...

Open Authentication

The term Open Authentication is almost a misnomer, as it actually provides no authentication at all. When an access point is configured to use Open Authentication, it will successfully authenticate all clients which connect to it.

We will now do an exercise to authenticate and connect to an access point using Open Authentication.

Time for action – bypassing Open Authentication

Let us now look at how to bypass Open Authentication:

1. We will first set our lab access point Wireless Lab to use Open Authentication. On my access point this is simply done by setting Security Mode to None:

   

2. We then connect to this access point using the command iwconfig wlan0 essid "Wireless Lab" and verify that the connection has succeeded and that we are connected to the access point:

   

3. Note that we did not have to supply any username / password / passphrase to get through Open Authentication.

What just happened?

This is probably the simplest hack so far. As you saw, it was not trivial to break Open Authentication and connect to the access point.

Shared Key Authentication

Shared Key Authentication uses a shared secret such as the WEP key to authenticate the client. The exact exchange of information is illustrated next (taken from http://www.netgear.com):

The wireless client sends an authentication request to the access point, which responds back with a challenge. The client now needs to encrypt this challenge with the shared key and send it back to the access point, which decrypts this to check if it can recover the original challenge text. If it succeeds, the client successfully authenticates, else it sends an authentication failed message.

The security problem here is that an attacker passively listening to this entire communication by sniffing the air has access to both the plain text challenge and the encrypted challenge. He can apply the XOR operation to retrieve the keystream. This keystream can be used to encrypt any future challenge sent by the access point without needing to know the actual key.

In this exercise, we will learn...

Time for action – bypassing Shared Authentication

Bypassing Shared Authentication is a bit more challenging than previous exercises, so follow the steps carefully.

1. Let us first set up Shared Authentication for our Wireless Lab network. I have done this on my access point by setting the Security Mode as WEP and Authentication as Shared Key:

   

2. Let us now connect a legitimate client to this network using the shared key we have set in step 1.

3. In order to bypass Shared Key Authentication, we will first start sniffing packets between the access point and its clients. However, we would also like to log the entire shared authentication exchange. To do this we use airodump-ng using the command airodump-ng mon0 -c 11 --bssid 00:21:91:D2:8E:25 -w keystream. The -w option which is new here, requests airodump-ng to store the packets in a file whose name is prefixed with the word "keystream". On a side note, it might be a good idea to store different sessions of packet captures in different files. This allows...

Summary

In this chapter, we have learnt the following about WLAN authentication:

• Hidden SSIDs is a security through obscurity feature, which is relatively simple to beat.

• MAC address filters do not provide any security as MAC addresses can be sniffed from the air from the wireless packets. This is possible because the MAC addresses are unencrypted in the packet.

• Open Authentication provides no real authentication at all.

• Shared Key Authentication is bit tricky to beat but with the help of the right tools we can derive the store the keystream, using which it is possible to answer all future challenges sent by the access point. The result is that we can authenticate without needing to know the actual key.

  In the next chapter, we will look at different WLAN encryption mechanisms—WEP, WPA, and WPA2, and look at the insecurities which plague them.