PASSIVE & ACTIVE ATTACKS AGAINST WIRELESS LAN’S

Mohteshim Hussain, [email protected],

University of Hertfordshire, England, U.K.

Overview of WLAN and its vulnerabilities

Wireless LAN’s (WLAN) are LAN’s networked wirelessly paper is quite brief. The taxonomy of the attacks on a WLAN is
using the air interface as the medium of the network. The as follows. [IASTED, 2004].
wireless technology being used is nothing but radio
frequency waves. WLAN can run on three different physical
media, two based on the spread spectrum and one on Attacks on WLANs
diffused infrared. [Peterson & Davie, 2003- P.132].
The fact that wireless networks make use of the air interface Active Attacks Passive Attacks
Unauthorized Access Traffic Analysis
as the medium of the network ma kes them susceptible to Rogue Access Points Passive Eavesdropping
threats by attackers. Attacks are carried out with various Man in the Middle Attack (MITM)
attacker objectives [Sankar et. al. , 2005 - P.126]. E.g. an Session Highjacking
attacker just might want to check the network traffic, or Replay
might want to access resources on the network. Denial of Service
An attack is any action carried out to compromise the
Fig2. Taxonomy of Active and Passive attacks on WLAN
security of any information belonging to an organization.
[Stallings, 2003 – P. 4]. Furthermore Stallings classifies two
types of attacks; Active and Passive attacks. Passive attacks 1.Passive Attacks On WLAN
are those in which the attacker obtains information being There are two types of passive attacks an attacker can mount:
transmitted / received by the network, these types of attacks a. Traffic Analysis
are usually difficult to detect as there is no modification of b. Passive Eavesdropping
the contents by the attacker. Whereas active attacks involve
the attacker changing the information / content or even 1a. Traffic Analysis
sometimes generating fraudulent information into the The first step to any type of hacking is footprinting [McClure et.
network. These types of attacks are malicious in nature and al., 2003 – Chp. 1], and wireless footprinting is done by carrying
can result in severe losses for the victims [Stallings , 2003 – out traffic analysis. The attackers before mounting an active
P.11, Prasad, 2005 – P. 96]. attack have to obtain sufficient information about the network.
The following figure represents a general classification of This operation of traffic analysis gives the attacker some basic
attacks according to Stallings. information about the network, like, the network activity going
on, the protocols being used by the network and also the active
Security Attacks access points (AP’s) of the network.
The determination of the active AP’s is employed by a process
Active Attacks Passive Attacks
known as Wardriving [IASTED, 2004]. This is a process
Traffic Analysis
Masquerade Release of msg.contents
where the attacker physically moves around (usually in a car
Replay and hence the name wardriving is derived) to find out about
Modification of message the active AP’s of the network to be attacked. By finding out
Denial of Service about the active AP the attacker can use the AP as a starting
Fig1. Taxonomy of Active and Passive attacks point to mount his/her attack. This is done by detecting and
capturing the beacon frames sent out Periodically by the AP’s.
Wired Equivalent privacy (WEP) is a security algorithm [IASTED, 2004, Sankar et. al., 2005 - P.133].
employed by WLAN’s, the main goal of WEP is not to
secure the network but completely secure the data so that the 1b. Passive Eavesdropping
attackers do not have access to the information and if they This attack is very similar to the traffic analysis attack
do, it will be secured with the WEP algorithm. The notion of [IASTED, 2004], as this also discloses the information about
WEP is important as in many of the attacks on WLAN the network but at the same time the attacker can access and
which I am going to describe; the WEP algorithm’s read the message contents. If the Message is encrypted, this
vulnerability is exploited and broken. More material on will require the attacker to break the encryption and read the
attacks on WEP algorithms can be found in “Hacking message.
Exposed” [McClure et. al., 2003 – P.471]. The attacker can mainly gain two types of information by
Coming towards more specific attacks on wireless networks. mounting this sort of an attack; he/she can read the data
One of the conference papers of The International Association transmitted in the session and also get various information
Of Science And Technology For Development – IASTED about the packet characteristics. Therefore the impact of
titled “Wireless LAN Attacks And Protection Tools” gives a passive eavesdropping is the compromise of information and
very good taxonomy of active and passive attacks on privacy [Welch – June 2003].
WLAN’s, whereas the amount of information provided in this
2. Active Attacks on WLAN 2d. Session Hijacking
The several types of active attacks an attacker can mount This attack is also attacking the victim indirectly as the MITM
against WLAN are: attack. Session High jacking involves taking control of the
a. Unauthorized Access session. The attacker will take control of the session and the
b. Rogue Access Points victim will think that the session is no longer in operation
c. Man In the Midd le Attack (MITM) whatever the cause. Whereas the session will be live and in the
d. Session Hijacking hands of the attacker, which he/she can exploit for many
e. Replay purposes. Session hijacking is basically done by obtaining MAC
f. Denial of Service of the AP and the victim, after the victim is authenticated by the
AP the attacker impersonates as the AP by using its MAC and
2a.Unauthorized Access sends a MAC-Disassociate message to the victim. The victim
The attack is not aimed at a particular user, but by doing then closes the session but the real AP has the session open, and
this, the attacker gains unauthorized access to the whole the attacker then acts as the victim by using its MAC and gains
network. This attack in turn gives rise to more malicious control over the session. This attack happens in real time and
attacks such as MITM, ARP poisoning. also compromises the integrity aspect. Further information in
In some security architectures when the attacker accesses the [Welch – June 2003, IASTED, 2004].
wireless network, he/she also gets access to the wired
components of the network. Where as in other security 2e.Replay
architectures the wired components are contro lled by access A replay attack has the same objectives as the MITM and the
control, usually implemented using ACL’s (Access Control session hijacking, but this attack happens offline, rather than in
Lists). However the access control rights can be bypassed by real time. The attacker can capture data of a session and can use
spoofing the victim’s MAC address [IASTED, 2004]. it later to exploit the victim’s information [IASTED, 2004]. The
Spoofing is the same as Masquerading. The main motive of information can be the user’s session information, which could
the attack is to give the attacker the access to services or be the authentication information. Therefore by introducing
privileges he/she is not authorized to access [Prasad, 2005 – timeouts in a message, replay attacks could be avoided.
P.95].
2f.Denial of Service (DoS)
2b.Rogue AP’s This works well on WLAN and is one of the very famous
These can be thought of as sub divisions of the AP’s. Rogue attacks, to bring down the system. The main aim is to bring
AP’s are setup by the users for their convenience [IASTED, down the system so that it doesn’t respond to the users request.
2004, Sankar et. al., 2005 - P.154]. E.g. an AP is not in the This can be done by sending huge traffic at the AP, making it
range of the user’s current position; the user will setup a rogue unable to respond [IASTED, 2004].Hence this attack deals with
AP for the purpose of boosting the range and getting the AP’s the attacker trying to keep the user from accessing the
signal unto him.The rogue AP has no or minimal security, due information or the resources of the system. The DoS attacks in
to this it becomes a very massive back door for attackers. case of wireless technologies can be carried out just by
Even if the ro gue AP’s are secured using for example WEP, introducing interference in the form of noise, whereas flooding
an attacker can attack and exploit the WEP algorithm using packets performs a DoS attack on the network.
various methods [McClure et. al., 2003 – P.471].
An Attacker can setup a rogue AP to gain future access to Conclusion
the network or even to obtain user a/c information. Some The attacks which I have described above are quite brief and
AP’s serve as public gateways like hotspots, etc. An attacker further information can be obtained by following up the
can set up a fraudulent rogue AP for the respective AP and references. The attacks have countermeasures to them which are
then mirror the AP’s registration page to get hold of not covered in this paper. Cryptographic techniques are
people’s user name and password. Rogue AP’s play and sometimes employed to protect against some of the attacks.
essential part in mounting a MITM attack. [Sankar et. al., Although this particular taxonomy used in this paper is not a set
2005 - P.154]. standard, but it can be used as a starting point for a WLAN
network designer. He/she can analyse these and understand the
2.c Man In The Middle Attacks (MITM) risks involved and hence implement a wireless network which
These attacks have an indirect Perspective of attacking data can counter the active and passive attacks against the WLAN.
confidentiality. Although the organiza tions might have
employed security measures such as VPN or IPSec. These
countermeasures only protect from a direct data
confidentiality attack. This attack comprises the integrity of
messages as they can be read and/or modified by the
attacker. The attacker appears to the AP as the user and to
the user as the authentic AP, Hence this fools both the AP
and the user and all data is passed through the Attacker
[Welch – June 2003]. Masquerading/spoofing is the
technique employed by the attacker to fool the participants
of the connection. [IASTED, 2004].
 References

1. IASTED (2004)
International Association of Science and Technology for Development
URL: www.iasted.com
Document link: http://www.iasted.com/conferences/2004/banff/WNET-Hunt3b.pdf

2. McClure, S. Scambray, J. and Kurtz, G. (2003)

Hacking Exposed: Network Security secrets and solutions (4 th Edition)
McGraw Hill: NY, U.S.A.

3. Peterson, Larry L. and Davie, Bruce S (2003).

Computer Networks: A Systems Approach (3rd Edition)
Morgan Kaufmann Publishers: CA, U.S.A.

4. Prasad, A.R. and Prasad, N.R. (2005)

802.11 WLANs and IP Networking: security, QoS, and mobility
Artech House Universal Personal Communication: Boston, London

5. Sankar, K. Sundaralingam, S. Nalinsky, A. and Miller, D. (2005)

Cisco wireless LAN security:Expert guidance for securing your 802.11 networks
Cisco Press: U.S.A.

6. Stallings, W. (2003)
Cryptography and Network Security: Principles and practices (3rd Edition)
Prentice Hall: New Jersey, U.S.A.

7. Welch, D. and Lathrop, S. (2003)

Wireless Security Threat Taxonomy
Proceedings of the 2003 IEEE workshop on information assurance United States Military
Academy West Point, NY, June 2003