- In this lesson, 8.6,
we're gonna focus in on wireless attacks.
Now, the objective of a wireless attack
is gonna be the disruption,
the manipulation, or the compromise
of wireless transmission or wireless devices.
Now, there are a variety
of wireless transmission architectures out there
including 802.15 WPAN, which you and I know as Bluetooth,
802.11 WAN, cellular, RFID, radio frequency ID
and NFC, Near Field Communication.
So let's look at four wireless attack categories.
And if you're looking at this thinking,
"Wow, I've already seen this,"
it's because we've talked
about these type of attacks already
but this time, we're thinking about them
in terms of a wireless attack.
So access, spoofing, sniffing, and denial of service.
A wireless access attack is an authentication exploit.
It enables unauthorized or unsolicited access
to an end user wireless device.
Spoofing is impersonating a wireless device
and that enables the attacker to act
as the trusted source and redirect or manipulate actions.
Sniffing is capturing wireless data packets
and that enables the attacker to eavesdrop, manipulate,
and/or reuse data packets.
And denial of service, as we've talked about before,
is overwhelming system resources
which enables the attacker to make services unavailable
for their intended use.
So access, spoofing, sniffing, and denial of service.
Now let's dive a little bit deeper into each one of them.
In an access attack, it's really an authentication exploit
and the goal of the attacker, is to have unauthorized
or unsolicited access to a wireless endpoint device.
Now, there are three types of attacks I want you to know.
Bluejacking, bluesnarfing, and NFC bump.
The first two bluejacking and bluesnarfing,
are really Bluetooth attacks.
Bluejacking is all about Bluetooth discovery.
It enables the attacker to send an unsolicited
or unwanted message to a Bluetooth device.
Very useful in social engineering.
Bluesnarfing, is about Bluetooth authentication
and that's discovering or connecting
to a Bluetooth device that either has weak
or non-existent authentication requirements.
And the third is NFC or Near Field Communication bump.
Now what's NFC?
A Near Field Communication is when you need
to be in very close proximity to make the connection.
You're probably most familiar with it if you use your credit
or debit card for tap and go at a point of sale terminal.
Near Field communication bump
enables an NFC enabled attacker to connect
to an NFC device by being in close enough range.
Next is spoofing, and we talked about spoofing.
We talked about spoofing
in fairly general terms about impersonation.
In this case, we're talking
about impersonating a wireless device, a connection,
or even a chip.
Now the outcome is it enables the attacker to act
as a trusted source and redirect or manipulate actions.
Now, there are two attacks I want you to be familiar with.
Evil Twin and RFID cloning.
Now, Evil Twin is when an access point
a rogue access point with the same SSID
as the access point that is legitimate is enabled.
So that enables the attacker to trick a user
into connecting to an attacker controlled network.
Now, it also may impersonate a captive portal
to capture credentials and/or any payment information.
So Evil Twin refers to, right, it's the evil
the bad twin of what's a legitimate access point.
But that access point has the same SSID,
so users will connect to it.
And then we have RFID cloning, which is really replicating
an RFID chip, a Radio Frequency ID chip.
And that enables the attacker to access a system,
engage in credit card fraud, remove inventory,
or whatever else that RFID card is being used for.
Next is sniffing.
In a sniffing attack,
what's happening is wireless data packets are being captured
and the outcome potentially
is that the attacker can eavesdrop,
manipulate, and/or reuse those data packets.
There are three attacks you wanna know.
A replay attack, an IV attack,
and an RFID eavesdropping attack.
Now, in a replay attack, the attacker is capturing
and reusing these data packets.
So they might be doing it
because they wanna reuse the authentication data
and credentials, or they might be replaying a packet
over and over again to cause a denial of service.
An IV attack is capturing the weak initialization vector
known as an IV.
And knowledge of the IV can be used
to decrypt encrypted packets.
And that RFID eavesdropping
which is intercepting communications between an RFID tag
and a reader can be used
for interception, manipulation, and reuse of data.
And lastly, we get to a denial of service attack.
We know that a denial of service attack
is overwhelming system resources
and the ultimate goal is to make those resources unavailable
for their intended use.
So in the wireless environment, there are two attacks
you wanna know, jamming and disassociation.
Jamming is overwhelming
the wireless frequency with illegitimate traffic,
traffic that shouldn't be there.
And the frequency then becomes unavailable
for legitimate traffic.
Disassociation is spoofing a disassociate message
which forces a device to disassociate
and then attempts to reassociate.
Disassociation message is when an access point says,
"No, I need to knock you off."
Basically, "I need you not to be associated with me."
Then of course the your system will say,
"Okay but I wanna try again and we'll try to associate."
So the device is continually knocked offline, right?
Tries to, you know, get up there,
it's knocked offline, tries to connect, knocked offline.
It's also known as a deauthentication attack.
And very often it's used as a precursor to an evil twin.
And so you get knocked off,
you get a packet that knocks you off, right?
Your legitimate access point and then the evil twin comes up
and aha, that's the one that you reassociate with.
That was a lot of information.
And now we're gonna do a three-second challenge.
Are you ready?
Five challenge questions, three seconds each.
Let's do it.
An unauthorized Bluetooth connections.
What kind of attack is that?
One, two, three.
That's gonna be bluesnarfing.
Forced deauthentication kind of attack.
One, two, three.
That's disassociation.
Unauthorized access to an NFC device
or transmission, number three.
One, two, three.
That is a an FC bump or bumping.
Number four, overwhelming frequencies.
One, two, three.
What's happening there?
That's jamming.
And lastly, a rogue wireless access point
that has the same SSID
as a legitimate wireless access point.
What is that called?
Initials, ET.
That's gonna be an evil twin.
All right, let's do a security-in-action
and put that knowledge to use.
This is about wireless disruption.
You generally connect
to the corporate LAN wirelessly.
Midday today, you were disconnected and you were presented
with a screen you've never seen before
asking you to enter your network credentials.
You were then successfully reconnected
to the wireless local area network or the wireless LAN.
All seems fine now.
Any further action necessary?
So this weird little thing.
You got knocked off,
you got the screen saying you gotta put in
your network credentials.
You did, you got connected, everything's been working fine.
Hmm, any further action necessary
or can we just ignore the situation?
Well, I want you to put me on pause
and think about what you might do.
What's your action?
Then come on back and we'll talk about it together.
Well, yes, this really should be investigated, right?
It's a weird situation.
You got disconnected.
Okay, well maybe that happens
but then you got the screen you've never seen before
asking you to put your credentials?
And we definitely wanna look into it.
And it's very symptomatic
of an evil twin attack where you get disconnected,
maybe you get asked for credentials or not,
and then you automatically get reconnected
and everything seems fine.
So we had disassociation.
This probably is connection to a rogue access point.
And then the other thing that happened
is when they were asking for your credentials, it's use
of a fraudulent captive portal to capture those credentials.
And then we have reassociation, right?
So you got disassociated, associated.
You got connected to a rogue access point,
you were then asked your credentials
and then you were reassociated.
Again, all of those things are symptomatic
of an evil twin type of attack.
So users should always be instructed
to report any unusual activity.
Especially, really especially when related to credentials.
And as help desk folks, we need to be in the position
of not just being dismissive.
We shouldn't say, "Well, is everything okay now?"
And they say, "Yeah."
And you're like, "Okay, well then,
you know, just go ahead and do your work.
Don't worry about it."
Whenever we see anything unusual happening,
it always warrants an investigation.
And doing that, my friends, is security-in-action.
There's your word cloud.
Quite a few things there.
Make sure you understand all these attacks.
You can speak to them,
you can describe them, you're confident in them.
If you're not, go back and look through the lesson again
and when you are, head on over to our next lesson.
I'll be waiting for you there.