WiFi Security

Summary

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

Basics

WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

RC4 Algorithm

The Rivest Cipher 4 Algorithm is a 1987 by RSA Laboratories developed random generator or also called a key stream generator or stream cipher. RC4 works logically by XORing the key to the data. RC4 is used in WEP and early WPA for both, decryption and encryption data.

Versions

WEP

WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.

Known Weaknesses of WEP

• WEP has no Mechanism to prevent to manipulate data packets.
• WEP can not prevent Replay Attacks
• WEP uses the RC4 Algorithm, this causes weak keys. With brute force it is possible to decrypt the key in minutes or hours on a standard Computer.
• WEP uses the same IV every time, this allows to decrypt data without knowing the current key.
• WEP allows attackers to modify messages or data without knowing the encryption key.
• with WEP it is easy to manipulate Authentication messages.

WPA

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2.

WPA offers two modes of security

• Personal WPA or WPA-PSK (Pre-Shared Key):

Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air.

• Enterprise-WPA or Commercial (802.1X):

Used in commercial or enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a pre-shared key, you will need a RADIUS server to authenticate yourself. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods.

WPA2

4 Way Handshake

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

1. The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
2. The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
3. The AP sends the group temporal key (GTK) to the client.
4. The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination. The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed.

WPA2 like WPA supports two modes of security. Like in WPA there are.

• WPA2-Personal or WPA2-PSK (Pre-Shared-Key)

Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations.

• WPA2-Enterprise (802.1X)

This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution.

WPA3

Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)

The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise. In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

Frame Aggregation and Fragmentation

WiFi Frame Structure (Source: https://www.fragattacks.com/)

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data. The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

Attacks

Disassociation and Denial of Service Attacks

One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: Evil Portal with Wifi Pineapple Nano

KRACK

Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

FragAttacks

Example for a Mixed Key Attack

Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

Dragonblood

Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.

Tools

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.

Aircrack-ng

is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: WiFi Sniffing

Driftnet

leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.

WiFi Pineapple Nano

The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity. Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience. More information and attack scenarios can be found here: Evil Portal with Wifi Pineapple Nano, Pineapple Setup

References

• https://www.krackattacks.com/
• https://www.fragattacks.com/
• https://wpa3.mathyvanhoef.com/
• https://ieeexplore.ieee.org/document/523485
• https://github.com/deiv/driftnet
• https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra