Cracking The WEP Key With Backtrack 5

As announced before we would be writing related to wifi attacks and security, This post is the second part of our series on wifi attacks and Security, In the first part we discussed about various terminologies related to wifi attacks and security and discussed couple of attacks. This post will also show you how one can easily crack WEP keys in no time.


Security Issues With WEP


WEP (Wired Equivalent Privacy) was proved full of flaws back in 2001, WEP protocol itself has some weakness which allows the attackers to crack them in no time. The biggest flaw probably in a WEP key is that it supports only 40bit encryption which means that there are 16million possibilities only.

For more information on WEP flaws, kindly read the WEP flaws section here.

Requirements :-

Here is what you would require to crack a WEP key:

1. Backtrack or any other Linux distro with aircrack-ng installed

2. A Wifi adapter capable of injecting packets , For this tutorial I will use Alfa AWUS036H which is a very popular card and it performs well with Backtrack

You can find compatible wifi card lists here.

Procedure :-

First Login to your Backtrack / Linux distro and plug in your Wifi adpter , Open a new konsole and type in the following commands

ifconfig wlan0 up

where wlan0 is the name of the wireless card ,it can be different .To see all wireless cards connected to your system simply type in " iwconfig ".


Putting your WiFi Adapter on Monitor Mode

To begin, you’ll need to first put your wireless adapter into monitor mode , Monitor mode is the mode whereby your card can listen to every packet in the air , You can put your card into monitor mode by typing in the following commands

airmon-ng start (your interface)

Example :- airmon-ng start wlan0

Now a new interface mon0 will be created , You can see the new interface is in monitor mode by entering "iwconfig mon0" as shown

Finding a suitable Target

After putting your card into monitor mode ,we need to find a network that is protected by WEP. You can discover the surrounding networks by entering the following command

airodump-ng mon0

Bssid shows the mac address of the AP, CH shows the channel in which AP is broadcasted and Essid shows the name broadcasted by the AP, Cipher shows the encryption type ,

Now look out for a wep protected network In my case i’ll take “linksys “ as my target for rest of the tutorial

Attacking The Target

Now to crack the WEP key you'll have to capture the targets data into a file, To do this we use airodump tool again, but with some additional switches to target a specific AP and channel. Most importantly, you should restrict monitoring to a single channel to speed up data collection, otherwise the wireless card has to alternate between all channels .You can restrict the capture by giving in the following commands

airodump-ng mon0 --bssid -c (channel ) -w (file name to save )

As my target is broadcasted in channel 6 and has a bssid "98:fc:11:c9:14:22" ,I give in the following commands and save the captured data as "RHAWEP"

airodump-ng mon0 --bssid 98:fc:11:c9:14:22 -c 6 -w RHAWEP

Using Aireplay to Speed up the cracking

Now you’ll have to capture at least 20,000 data packets to crack WEP .This can be done in two ways, The first one would be a (passive attack ) wait for a client to connect to the AP and then start capturing the data packets but this method is very slow, it can take days or even weeks to capture that many data packets

The second method would be an (active attack )this method is fast and only takes minutes to generate and inject that many packets .

In an active attack you'll have do a Fake authentication (connect) with the AP ,then you'll have to generate and inject packets. This can be done very easily by entering the following commands

aireplay-ng - 1 3 -a (bssid of the target ) (interface)

In my case i enter the following commands

aireplay-ng -1 3 -a 98:fc:11:c9:14:22 mon0


After doing a fake authentication ,now its time to generate and inject Arp packets . To this you'll have to open a new Konsole simultaneously and type in the following commands

aireplay-ng 3 -b (bssid of target) -h ( Mac address of mon0) (interface)

In my case i enter
aireplay-ng 3 -b 98:fc:11:c9:14:22 -h 00:c0:ca:50:f8:32 mon0

If this step was successful you'll see Lot of data packets in the airodump capture as shown

Wait till it reaches 20000 packets , best would be to wait till it reaches around 80,000 to 90,000 packets .Its simple more the packets less the time to crack .Once you’ve captured enough number of packets, close all the process's by clicking the into mark which is there on the terminal

Cracking WEP key using Aircrack

Now its time crack the WEP key from the captured data, Enter the following commands in a new konsole to crack the WEP key

aircrack-ng (name of the file )

In my case i enter
aircrack-ng RHAWEP-0.1-cap

With in a few minutes Aircrak will crack the WEP key as shown

Once the crack is successful you will be left with the KEY! Remove the colons from the output and you’ll have your WEP Key.

Hope You Enjoyed this tutorial ,For further Doubts and clarifications please pass your comments

About The Author

This article is writen by John Jeffery, He is the owner of Hackholic where he writes security related stuffs, If you are interested in writting a guest post on RHA, Kindly read the guidelines here.

Read more

by Malik korrich ~ mardi 4 octobre 2011 0 commentaires

Wifi Attacks And Security Part 1

Friends as I have already announced before that we would be writing on Wifi attacks very soon, The series consists of three parts( May be more depending upon your feedback) and will be covered by John Jeffrey. In the first Part John explains about the very basics of Wifi Attacks and security. Before moving on to the advanced stuff such as WEP and WPA Cracking, You need to have the basic idea of how a wifi connection works.

Wifi stands for Wireless Fidelity, Its a device that performs the functions of a router but also includes the functions of a wireless access point and a network switch.
They are commonly used to allow access to the Internet or a computer networks without the need for a cabled connection. Wifi is commonly used in airports , Offices etc


How Wifi Works?


The working of Wifi is pretty simple to understand. The components of wireless network includes a communication device such as a laptop or a cell pone etc, a router and internet connection
The communication device which has a wireless compatibility ( laptops )converts the data in the form of radio waves and transmits it to the router, through an antenna. The router receives the signal and decodes it. The router sends the information to the Internet using a physical, wired Ethernet connection.

The reverse communication follows the same ( i.e) the router receiving information from the Internet, translating it into a radio signals and sending it to the computer's wireless adapter.

Whats the Danger?

Security is an important part of a home wireless network. If you set your router to create an open hotspot, anyone who has a wireless card will be able to use your signal. And he/she will be able to use your internet connection .

To protect and keep our internet private we can use one the following encryptions

WEP

Wired Equivalent Privacy (WEP) is a weak security algorithm for wireless networks. Its intention was to provide data confidentiality comparable to that of a traditional wired network. WEP, recognizable by the key of 10 or 26 hexadecimal digits, Its widely in use and is often the first security choice presented to users by router configuration tools.
Although its name implies that it is as secure as a wired connection, WEP has been demonstrated to have numerous flaws and has been deprecated in favor of newer standards such as WPA2.

WPA And WPA 2

WPA (Wi-Fi Protected Access) and WPA2 (Wi-Fi Protected Access II ) are two security protocols for wireless networks from the Wi-Fi Alliance that was developed to provide a migration from WEP.
The Alliance defined these in response to serious weaknesses researchers had found in the previous system, WEP

But these encryptions can also be broken , The following demo shows us how easy it is to crack WEP , WPA keys

Demonstration

In this following demonstration Brain Young shows us how easy it is to crack WEP , WPA keys




How to Secure Your Wireless Network

1. Never use WEP as your encryption type, always use WPA Or WPA 2 as your encryption type

2.Use strong passwords , which can not be cracked easily by using a dictionary attack or brute force attack

3. Always Use a Vpn when your using pubic Wifi hotspots

Hope this Information Helps You , For further doubts and clarifications please pass your comments

You Might Also Like:

• Wireless Network Security Basics

About The Author

This article is writen by John Jeffery, He is the owner of Hackholic where he writes security related stuffs, If you are interested in writting a guest post on RHA, Kindly read the guidelines here

Read more

by Malik korrich ~ dimanche 25 septembre 2011 0 commentaires

Wireless Network Security Basics

Wireless Networks are those in which the interconnection between devices is established without using wires. The nodes communicate using radio waves. The wireless adapter in a computer translates data in radio signals and transmit it. The wireless router receives the radio signals, decode it and sends the data to internet. Of course this process also works in reverse manner.
A wireless network is usually called as Wifi or WLan. The main advantages of Wireless Networks are that users are not bound to areas to plug into a Wall jack to connect to network and also it reduces the cost of cable used in Wired Networks.

The main disadvantage apart from network performance is lack of security. The wireless networks can be
easily compromised if they are not properly configured.

Basic Terminology 

Service Set Identifier (SSID) :It is an alphanumeric string that differentiates the wireless networks .It can be
maximum of 32bit. There can be more than one network in a certain range or on a same channel, SSID
differentiates one from another. Simply it is the name of a network.

Wireless Access Point(WAP)

It is the point from where wireless network signals are generated. WAP is a device that receives radio signals from computers in network and send them to router.

Basic Service Set Identifier(BSSID) 

It is the MAC address of WAP or wireless router. It is a unique 48 bit key.

Beacons : 

These are wireless packets which are broadcasted to maintain the connectivity between WAP and the computers in network. The WAP broadcasts beacons from time to time to check connectivity with computers.

What is Wireless Equivalent Privacy (WEP)?

WEP is an encryption scheme used to encrypt the WiFi data streams. WEP encryption uses a 64bit or 128bit key.
A WEP uses the combination of an encryption key and Initialization Vector (IV). IV is any 24bit random number and is attached to encryption key to make it difficult to crack.64bit WEP encryption uses a 40bit key and 24 bit IV. Similary 128bit WEP encryption uses a 104 bit key and 24bit IV.

The advantages of WEP

1. Authenticating Clients

The users/clients connection to the wireless network need to enter the correct WEP key to gain access to network.

2. Privacy

It protects the wireless data by encrypting them and allowing decryption by users who have correct WEP key.

The WEP key can be easily cracked by an attacker because size of IV that is 24bit is very short.The vulnerability in WEP is that an IV which is randomly generated is repeated after certain number of packets as it is short (24bit) and less number of combinations are possible.

Due to this insecurity, Wi-Fi Protected Access(WPA) and WPA2 security protocols were released. They provide more security by generating complex and dynamic keys which are hard to crack. The method of creating IVs and encryption keys was improved. WEP,WPA,WPA2 are secure in increasing order.

Basic Security Measures for Wireless Networks :

1. MAC filtering- The MAC address is theoretically a unique 48bit address by which a network device is
recognised. The administrator might let the only the particular clients to connect to network by checking  whether their MAC address is present in the list of registered MAC addresses or not. 

The drawback of this security mechanism is that administrator need to keep changing the list of MAC address according to new clients connecting and clients which have not been in use for a long time. This security mechanism can be bypassed by attacker by spoofing his MAC with already a registered one.

2.Hiding SSID

Do not simply broadcast the SSID. It lures the attackers or War Drivers to break into the networks. Wireless devices can only connect to WAP if the SSID is known.

3. Using encryption Keys 

Using an encryption scheme like WEP,WPA or WPA2 is must for Wireless  administrators. A WEP doesn't matter how long it is, can be cracked in minutes. So WPA or WPA2 is recommended.

4. Intrusion Detection Systems(IDS)

Completely securing a wireless is hard. But is easy to moniter what is going on in a network. IDS monitors traffic and alerts the administrator when something unusual is happening or traffic matches any predefined pattern of attack. Many open source products like AisSnare, Snort-Wireless,WIDZ etc are available for the same purpose.


About The Author

Aneesh M Makker is the owner of www.explorehacking.com, He has written several guest post on this blog, If you are interested in writing guest post kindly read the guidelines here 

Read more

by Malik korrich ~ samedi 15 janvier 2011 0 commentaires