so i'm gonna explain a little bit about wireless as a great target for us
and i've covered a few of these already
but i want to get a little bit deeper
and then I'll show why administrators don't really protect it very well
beyond the lack of knowledge and understanding
Wireless is a great target for us
not just because it's getting widely deployed
and because the signal goes quite a ways
but also because that single travels weaken sniff and attack
and deny service from across the street from across the city
from wherever we can really get signal and transmit signal
lots of opportunity for us to do
this type of attack this sniffing this penetration testing this deny of service
any of these attacks can be accomplished from a fairly decent distance
so we're not going to get caught easily
we don't like going to jail
and certainly this is one way to avoid going to jail
and it may seem a little silly for me to say this
but in my experience there's a lot of administrators out there
that deploy wireless with the default settings
and that sounds crazy until you've seen a few million times
and then you realize the default password for an access point
is usually the password that's in place
the default SSID or the defaults channel or the default crypto
usually is the stuff that's still in place when it's deployed
mostly because administrators don't give it a lot of thought
very few administrators do wireless site surveys although they should
very few administrators focused beams and use directional antennas
that keep the signal inside the building
they should but they don't
which means the signals leak out to us as an attacker
and potentially we have the ability
to use these default settings to look up the default password
identified the Mac identify all the information
and actually attacked the network
in a very very simple straightforward and quick way
that allows us to bring our strength against weakness
our strength of knowledge of wireless
and understanding of the flaws in administration
the weakness is the administrators lack of understanding
and lack of a thorough security approach to wireless
as well there are some attacks that require a large amount of volume
to go over wireless for us to appropriately amount an attack
so we have to sniff gigabytes and gigabytes and gigabytes of data
in order to build up enough information to do a crack
like a brute force attack against the wireless network
well as more and more authentic data goes across the wireless network
that's so much more data that we can capture that we can examine
and that we can use in our brute force attack
so actually it works in reverse
the administrators put more and more stuff on the wireless
thinking that it's maybe more secure simply easier for an attacker
thats a benefit that's a bonus
we're just getting our attacks made that much easier
by bad administration or bad planning
so why don't administrators protect wireless networking very well
well most of them don't really know about wireless security at all
they don't have a lot of training they don't have a lot of skill in it
they don't go to four-week classes on wireless networking in general
let alone wireless security
so they may have a one hour two hours of training on it from a vendor
but that's really most of it
in fact many administrators don't even have that much
that's great for an ethical hacker
because that ignorance allows us to mount an attack
based on their knowledge gaps
and wireless security is also kind of a pain to implement
it at all certainly in a way that makes users
happy and and makes things easy so for example if
users have to enroll for certificates and have to actually connect to the
network and run scripts or do some kinda Group Policy work
in order to get their devices on the wireless network
well first of all that sets a fairly high bar for which clients can and
cannot connect to wireless
which is almost feeling the purpose of having wireless
second ball many users just don't have the technical wherewithal to do that
kind of work
so they're not going to so the administrators left in a tough spot
do I bounce the users they can't connect
which could cause political ramifications could cause usability
could cause lack I've capability manipulation
or does the administrator balance undecided usability
in either we can or remove the security on the wireless networks
interestingly enough if you taking this course you probably think well of course
the balance on the side I love
higher security and then if users don't have to deal with it they should get off
or they should ask
it's almost always the opposite typically speaking administrators will
weekend or eliminate wireless network security
when necessary I work with a client not very long ago
who literally stopped in the middle other wireless security configuration
project
and backed everything out to open wireless networking
because they didn't know how to make the clients work properly so rather than
shutting off the wireless or rather than configuring the clients they literally
just made the wireless network
open everyone can associate everyone can actually transmit/receive
all data that could be a problem but not for us
because we're ethical hackers and frankly we like that
and finally there's a lot of standards that go into
wireless network security WiFi security is actually quite a complex own thing
and the number of standards the complexity of the standards and how they
interact
makes it so that even administrator that has training and does
focus on this and does concentrate in this area
does have a bit of a challenging time getting this stuff
fully understood so that they can properly analyze it
deploy it and then operated and usually the operate is the difficult part
because many administrators can figure out headache had to plan it out and how
to deploy it
but when things break one of the first bit stay cozy security
if something doesn't work if if users can't access
in a wireless scenario many times the first thing that goes his security turn
that off let's see if it works now
you owe your television can't connect to renew monitor can connect or your
printer can't connect
will shut off wireless security and maybe
the intention is just to shut it off for a little while just to shut it off for
troubleshooting
but if it doesn't go back on that's a major problem
were if it goes off even for testing or troubleshooting
while the Ethical Hacker is running their tests and probing
well there we go we're into the network and we're probably never going to be
gotten back out of the network