WIRELESS
NETWORKS
Wireless
links are pretty fascinating because lately there are so many wireless choices.
IEEE802.16m offers speed of 1Gbps for stationary and 100Mbps for mobile
devices.
Wireless is
not encrypted by default.
Since it
travels through the air, it is super easy to intercept it: Wireless Wireshark,
aircrack, AirSnort, Auditor Security Collection, weplab, WEPCrack and many
other (free) programs
To the
rescue: Wireless Intrusion Detection System (WIDS).
Tradeoff is
speed vs security. Most wireless has relatively weak security that is really
fast, and change keys frequently.
WEP
(Wired Equivalent Privacy) protocol was Added to IEEE 802.11 in 1999, hacked in 2001. It uses 64-
or 128- or 256-bit RC4 encryption. Issues:
·
AP
and all its clients share the same key … !
·
strength
of the algorithm is linearly proportional to the key length
WEP is very
Insecure (i.e. useless); FBI cracked it in 3 minutes
WEP can be
brute-force broken in 1-2 hrs.
WPA
(Wi-FI Protected Access) Protocol Replaced WEP in 2003.
It implements most of IEEE802.11i. WPA uses data encryption. It uses TKIP
(Temporal Key Integrity Protocol), and TKIP provides 128-bit per-packet key
mixing with re-keying, and MIC
WPA
Enterprise provides RADIUS based authentication using TKIP IEEE 802.1x/ EAP.
WPA Personal
uses a pre-shared Shared Key (PSK) with 8 to 63 character passphrase. Good/long
passwords (still) cannot be easily broken?
WPA2
replaced WPA. WPA2 is specified in 802.11i amendment to IEEE 802.11 in 2004.
WPA2 = WPA +
mandatory AES–CCMP
Advanced
Encryption Standard (AES) is a symmetric block cipher, key length is 128bits,
block size is 128bits. Counter-Mode/CBC-MAC
Protocol (CCMP) – provides additional protection plus MIC
Just like
WPA, WPA2 supports EAP authentication using RADIUS servers and preshared key
(PSK)
WPA2
requires installing new hardware: either AES-WRAP (an early version of 802.11i)
or the newer and better AES-CCMP. Those hardware standards are not compatible.
WPA2 also
comes in personal and enterprise version, just like WPA.
Unlike WPA,
WPA2 is still considered secure. Although there are talks about WPA3, it has
not come out yet.
Here are some wireless terms
and overview:
https://www.cites.illinois.edu/wireless/speed.html
- Downlink
is the throughput from the base station to the user handset or computer.
- Uplink
is the throughput from the user handset or computer to the base station.
- Range
is the maximum range possible to receive data at 25% of the typical rate.
So what can
you hack into? Here are some wireless networks:
Wireless
link: Frequency: Speed: Range:
WiFi (IEEE
802.11 b) 2.4-2.485GHz ≤ 11Mbps LAN
this
frequency collides with cell phones and microwave owens
IEEE 802.11
a 5.1-5.8 GHz ≤ 54Mbps
IEEE 802.11
g 2.4-2.485 GHz “ “
“
IEEE 802.11
n, i
Bluetooth
(IEEE 802.15.1) 2.4GHz ≤
24Mbps max 100m
WiMax (IEEE
802.16) 2-66 GHz ≤ 30Mbps Long
Haul
(≤ 30 miles)
Mobile WiMax
(IEEE 802.16e-2005) 20MHz 128Mpbs downlink, 56Mbps uplink. Called “4G” by
Sprint Nextel.
IEEE802.16m 1Gbps
for stationary
100Mbps
for mobile
Cellular
phone network (GSM, COMA)
4G ≥
1 Gbps when stationary
≥
100 Mbps when mobile
3G ≥
2 Mbps when stationary
≥
284 Kbps in a moving vehicle
Satellites
Various Uses of Satellite Communications:
Traditional Telecommunications
Cellular
Television Signals
Marine Communications
Spacebourne Land Mobile
Satellite Messaging for Commercial Jets
Global Positioning Services
