Wireless Insecurities

I undertook a small wardrive recently from a popular retail park in Manchester, England to a landmark hotel located within the city centre. The route was chosen as it encompasses a small area of mainly residential buildings, a large retail park, several areas used mainly for industry and a number of offices. Using a 12DBi directional antenna, a Garmin eTrex GPS, a copy of Kismet running on Backtrack4 and a bewildered driver I set about recording wireless traffic along the choosen route. After I had completed the wardrive, I analyzed the wireless data to try to gain an understanding of the current state of wireless insecurities by writing a python script that parsed the XML files produced by Kismet. Using the information I gathered I then began to visually analyze several statistics for a comparative study.

I located a total of 310 unique base station AP MAC addresses, and a total of 342 unique ESSID or networks. All of my analysis was performed on networks which were successfully identified as operating within "Infrastructure" mode and were not Ad-Hoc or Client Probe requests. The chart above shows the percentage of encryption types identified, of 342 networks I identified that 43 were operating without any form of encryption. A number of those 43 networks could be accountable as wireless hot-spots or public access networks. I identified 124 networks which were using the widely known insecure WEP encryption type. These 124 networks could easily be compromised within a few momments given todays current wireless attack threatscape. The other 175 networks were using the more secure WPA encryption technologies however only 65 of those had adopted the more secure WPA2 (AES-CCM) encryption types, with the remaining 110 supporting WPA1 (TKIP). 141 of the WPA networks were seen to support the use of a PSK (Pre-Shared Key) which could be captured by an attacker to perform off-line brute force attacks, however even with memory time trade-off (rainbow tables) and high-speed GPU, it is unclear how many of those networks have an insecure PSK passphrase - without cracking them all! This means that an attacker could break into 49% of wireless networks trivially and the other 51% would depend on additional authentication mechanisms and the attackers computing power available. That is still almost half of the identified networks which pose an easy target for a skilled assailiant.

Additionally I looked at the distribution of wireless networks to channels and a graph showing the distribution can be seen to the left. The results were unsuprising, channels 1, 6 and 11 were amongst the most densely populated wireless network channels with very few networks having changed from what is likely the Access Point or manufacturers default setting on the AP. Changing this setting can often have an increased wireless performance especially if a large number of networks are operating within your area on the same channel. Channel 12 appeared completely unused during my assessment!

The next security related aspect I investigated was how many of the networks were employing security through obscurity techniques by masquerading their ESSID and performing network cloaking. The results can be seen in the table below right with a fairly large number of networks deploying ESSID cloaking, although this security feature can be described as "moot" as attackers are able to quickly deduce network names through passively gathering wireless network information. It is always advised that less is best when handling information which maybe available to an attacker and this particular security through obscurity may help prevent attackers casually identifying networks that may become a target for them. Several of the networks seen identified themselves within the ESSID as being associated with "DATACENTRE01" which just goes to show that security through obscurity is often not a bad idea when it comes to choosing a network name that an attacker might be less enticed to target!

The last statistic I assessed was due to the shift in the demographic of attacks against wireless infrastructure moving towards the clients that utilize it. Recent advancements in airbase-ng, Karmetasploit and similar attack tools has seen a wider number of attacks targetting the clients which seek out networks known to them and could be potentially exploited using browser attacks and spoofing of known ESSIDs. These attacks often have the capability of recovering enough of the WPA handshake to launch offline brute force attacks or to obtain information used to crack WEP network information. The results of the analysis can be seen to the left with a total of 454 client probe requests being identified, compared with 342 networks available for an attacker to target. It is always advised that wireless interfaces are disabled when not in use to prevent them probing for known network locations and becoming targets for this type of attack and as more wireless networks move to more secure authentication and encryption mechanisms attacks against clients are only set to increase given their ease of nature and avoidance of IDS and IPS mechanisms that maybe in place on larger wireless estates.

For the curious the route taken is shown below and starts at the Trafford Centre, Manchester and ended at the Hilton Hotel on Deansgate within the city centre.