Self-defense for hackers. Monitoring attacks on the airwaves

The first part of this article discusses attacks targeting access points; while the second part, attacks targeting clients. Imagine a situation: a hacker failed to penetrate into your infrastructure from the Internet, couldn’t develop any attacks internally at the network level, and was unable to capture Active Directory. But this doesn’t mean that you can relax and rest on laurels: if attackers are located within the wireless network coverage zone, they can deliver a physical attack. Wireless networks are the first barrier encountered by an external intruder who hasn’t yet implemented other techniques, but got up close to your office. Don’t underestimate this attack surface: it’s much more promising for a motivated external attacker than a well-protected perimeter on the Internet.

In information security, wireless network protection is usually limited to recommendations on secure Wi-Fi configurations; while wireless attacks are believed to be quite silent. Certain wireless IDS solutions exist, but most of them remain academic experiments. The situation is quite paradoxical; there are two perimeters: one in the digital space protected by all sorts of WAFs, SOCs, and other IDS/IPS; and the other one in the real world — wireless networks whose coverage zones in most cases reach beyond the controlled area and aren’t properly protected.

Listening to the airwaves enables you to sense ‘subtle’ energies and detect all relevant Wi-Fi attacks. All you need is an ordinary Wi-Fi network card and the monitor mode recording every wireless packet on the air. When you finish reading this article, you will be able to create a wireless antivirus (wireless IDS).

Just imagine the shock experienced by an attacker who fails to penetrate your perimeter through wireless networks and gets caught while trying to deliver an attack.

Deauthentication

Let’s start with the most common and simple attack known to all hackers: deauthentication. The attack is delivered against WPA PSK networks (most widespread ones nowadays) and involves simultaneous disconnection of the access point and clients from each other. To achieve this, the attacker sends special packets in both directions on behalf of both the access point and clients. As a result, the client, who, in fact, didn’t intend to disconnect from the access point, resends the password hash (i.e. handshake) in the second EAPOL message.

For a hacker, a handshake is of utmost interest because it makes it possible to deliver a wordlist-based password guessing attack at a great speed (millions of hashes per second).

Deauthentication attacks aren’t absolutely silent: clients are annoyed when such an attack occurs. Wireless network users lose their connections. However, not all of them realize that this was an attack, especially taking that disconnection can last for an extremely short time. Most probably, complaints about problems with Wi-Fi (if any) would be submitted to the operations department rather than to the security department. However, by monitoring the airwaves, you can easily detect such attacks because deauthentication packets are sent from both parties at once:

Imagine a situation: a hacker walks into a nearby cafe and performs deauthentication to intercept hashes and subsequently guess user passwords on their basis.

And the script immediately detects such activity.

The signal strength makes it possible to estimate the distance between you and the hacker: – 30dBm means that the bastard is actually sitting in front of you.

PMKID capture

To cover a larger area, corporate wireless networks often use multiple access points with the same name. This ensures that moving employees are seamlessly switching from one access point to another. During authentication to such access points, the first EAPOL M1 message often contains a hash (PMKID) that is very similar to a handshake.

Importantly, the hash is sent by the access point, which makes it possible to capture it and guess the password without interaction with clients.

This attack is very popular among hackers and pentesters because it’s delivered quickly and silently and doesn’t incur adverse consequences. However, one of its features makes it possible to detect such attacks.

When a client attempts to authenticate to a WPA PSK access point, the client device always sends an EAPOL M2 packet after receiving M1.

This is normal behavior. But for a hacker, an attempt to capture PMKID this way will result in unwanted capture of half-handshake (EAPOL M2). Some hacking utilities (e.g. Aircrack-ng) cannot show PMKID (EAPOL M1) when a handshake (EAPOL M2) is captured. Therefore, specialized hacking tools (e.g. hcxdumptool or bettercap) behave differently from a typical client: to capture PMKID, they don’t send M2 after connecting to a WPA PSK access point.

This enables you to catch the elusive hacker:

Imagine a situation: while you are monitoring the airwaves; a hacker passes by your office windows and automatically performs authentication to all wireless devices within sight.

And, of course, you can detect it.

You see strange behavior of a client who doesn’t send a handshake (M2), which indicates that the goal of this ‘client’ is to gather PMKID (i.e. receive M1).

Brute-forcing access points

If the two above-described attacks (handshake capture and PMKID capture) don’t bring any success to the attacker, then the bastard can go further.

Generally speaking, the access point brute-forcing attack isn’t common among hackers, but in the article Brute-force on-the-fly. Attacking wireless networks in a simple and effective way I demonstrated that it can be successfully delivered. Furthermore, an attack involving brute-forcing of access point’s password is implemented very simply: after all, this is a legitimate function of any client device, which means that it can be delivered on the go from an Android phone without raising any suspicions.

A successful attempt to authenticate to a WPA PSK wireless network differs from an unsuccessful one by an EAPOL M3 response from the access point.

Therefore, all you have to do is listen to the airwaves and monitor authentication attempts (EAPOL M2) and successful authentications (EAPOL M3):

The hacker doesn’t have to run any special software; instead, they can simply try several passwords while attempting to connect to your access point from a regular phone.

Surveillance cameras are unable to detect such an attack, but you can see it.

You see that the attacker made four attempts to guess the password for your access point. However, the hacker may not necessarily attack an official access point in a ‘blunt’ way. Instead, the bastard can try password spraying: attacking all audible access points while walking along the perimeter of your company in the hope of finding an alternative entry point (e.g. through a corporate wireless printer). For this attack, just one or two weakest passwords could suffice.

Such attacks are almost undetectable since only one or two authentication attempts are made on each device. But analysis of the overall picture easily reveals the attack: in addition to brute-forcing in depth, the script also monitors brute-forcing in width attempts.

A bona fide client won’t try passwords to several access points at once, which means that this is a hacker testing the strength of your wireless network.

WPS

Although the Wi-Fi Protected Setup (WPS) technology is considered outdated, it’s still widely employed in ‘unofficial’ access points used in secondary (e.g. service or test) wireless networks at the company’s physical perimeter. After all, this is the primary task of any intruder: find something obsolete and neglected by security personnel (i.e. something vulnerable).

WPS is a technology used for simplified connection to WPA networks. It’s implemented by entering an 8-digit code. If the code is correct, the access point sends to the client a regular WPA PSK key enabling the client to connect. However, the golden rule of information security is: comfortable and handy solutions are rarely secure. In addition, WPS is marred by vulnerabilities.

Attacks targeting WPS are quite diverse. Furthermore, three such attacks out of four can be delivered in just a few seconds, thus, making it possible to attack vulnerable access points on the go.

The WPS technology is sophisticated enough and involves eight handshakes: eight EAPOL packets (four on each side).

Unlike WPA PSK, secret keys are securely transferred using the Diffie–Hellman (DH) algorithm. As a result, you cannot guess attacker’s real intentions. But the EAPOL protocol discloses plenty of information about the status of a PIN-based connection. As a result, you can find out (to a certain extent!) what’s going on. The script below makes it possible to understand the situation with WPS on the airwaves:

Imagine a situation: a hacker sitting in a cafe across from your office notices that one of the target access points has WPS version 1 enabled, which means that it’s not blocked, and the entire PIN code space can be enumerated. Such an attack takes several hours, but the hacker isn’t in a hurry.

And you can see hacker’s true intentions: the bastard is brute-forcing an access point.

It can be seen in the above screenshot that the wps.py script clearly detects two milestones on the airwaves: (1) hacker successfully guesses the first half of the PIN code; and (2) hacker successfully guesses its second half (which means that your wireless network has been completely compromised).

In the meantime, another hacker in the hope to find a ‘low-hanging fruit’ walks along the building and delivers fast WPS attacks (Pixie Dust, Vendor Specific PIN, and Null PIN) against all access points within the range.

But the above script can detect such abnormal WPS activity involving simultaneous authentications to multiple access points.

If a device with the same MAC address performs one or two checks on all access points within its range, this clearly indicates an intrusion attempt. Generally speaking, the very fact that somebody is using the unpopular and obsolete WPS should raise your suspicions.

Now let’s proceed to RoqueAP attacks that target clients (i.e. users and user devices) and are delivered from the access point side.

Evil Twin

Hackers like this attack because it targets the weakest link of any perimeter: a human being. Accordingly, such attacks will always be relevant. Novice hackers can try them from the very beginning; while experienced ones, only if all above-described attempts to hack a wireless network fail.

It’s pretty easy to detect an ‘evil twin’ access point. You just monitor all WPA PSK networks, and if an open network with the same name suddenly appears nearby, this indicates, with a high degree of probability, an Evil Twin attack.

Two networks with the same name featuring different authentication types cannot exist together because client devices remember connection data based on the network name.

This script monitors all access points, both open and WPA, calculates their uptime, and determines their vendors based on the OUI database. Imagine a situation: a nearby hacker deploys an ‘evil twin’ wireless network.

And you immediately detect it.

Note a fairly low uptime: in corporate access points, it’s normally measured in days and months; while a rogue access point could be deployed a couple of minutes ago. In addition, hackers can combine this attack with logical jamming of legitimate access points (by sending deauthentication packets to disconnect clients). And you already know how to detect this attack.

WPA Enterprise — GTC downgrade

If your company uses a WPA Enterprise wireless network (where each client authenticates with their own login and password), then a hacker will definitely try such an attack.

WPA Enterprise wireless networks use a designated authentication server and can receive client’s credential in multiple ways. Some of these ways are very insecure: the client can be forced to submit the password in plain text or as a hash. Even if you use highly secure WPA Enterprise TLS, there is no guarantee that all user devices are configured correctly and aren’t susceptible to authentication downgrade attacks. After all, the targets of this attack are clients.

‘Normal’ WPA Enterprise access points will request clients to transmit their credentials in the most secure way, but specialized rogue access points use the reverse order of authentication methods (i.e. from insecure to secure ones) to downgrade authentication. This feature makes it possible to detect such attacks:

This script monitors only WPA Enterprise wireless networks by connecting to each of them and analyzing the authentication methods offered by their access points.

Imagine a situation: a hacker is hanging around not far from the reception and waiting for employees to arrive.

At first glance, this is an ordinary person with a phone in their hand. In the meanwhile, you are monitoring the airwaves for the presence of WPA Enterprise networks. And if another network with the same name is suddenly detected, then this is the first alarm bell. If an access point cannot be seen when you begin monitoring, but appears after some time, this indicates that it’s probably mobile (i.e. a phone or laptop), which isn’t typical for a legitimate WPA Enterprise access point, but very typical for a hacker.

You can also see that the MAC address of this device indicates a different vendor unrelated to legitimate access points (in this particular case, it’s an AlfaTech wireless network card very popular among hackers). In addition, you see a low (several hours) uptime, which is incommensurably less compared to legitimate access points (several months).

By the way, the signal level indicates that the hacker isn’t that far from you.

KARMA

Detection of the KARMA technique puts an end to all hacker’s endeavors. Interestingly, this attack is easier to detect compared to all above-described ones.

The KARMA attack isn’t as widespread as other wireless attacks. More information about it can be found in the article KARMAgeddon. Attacking client devices with Karma. In its pure form, this attack is implemented very rarely and only by most resolute hackers. However, KARMA is often used to attract clients in combination with other attacks (e.g. such popular hacking utilities as EAPHammer, hcxdumptool, Wifiphisher, and others implementing the RoqueAP vector).

Importantly, the KARMA technique is included in most of these utilities by default. Therefore, the chance to catch a hacker increases even when other attacks are delivered against your Wi-Fi.

It’s quite easy to detect a KARMA attack. All you have to do is send a Probe request with a randomly generated network name: in theory, no one should respond to such requests except for specially deployed rogue access points:

Imagine a situation: the hacker starts a program to attract clients and capture their WPA PSK passwords (i.e. delivers a half-handshake attack)…

…or runs hcxdumptool without parameters to capture PMKID…

…or waits for clients to connect to an open access point…

…or deploys an access point for WPA Enterprise attacks…

….or simply performs an Evil Twin attack.

And in each case, you instantly detect the attacker.

You can see a Probe response to a random network name, as well as the signal strength of the responding rogue device. A legitimate access point won’t respond to such a request.

The above attacks have one common feature: all of them use the KARMA technique to attract clients. And most hackers aren’t even aware of this…

Conclusions

The “Self-defense for hackers” trilogy comes to an end. Now you know that many attacks can be detected by ordinary users who don’t have privileged access to the corporate infrastructure and just monitor certain events. You’ve learned that many attacks believed to be silent aren’t truly covert and leave distinctive traces.

The source code for all tools presented in this series of articles is available in my GitHub repository. The above-discussed attack detection techniques can be combined with existing defense mechanisms to make your corporate network even more secure.

Regardless of attacker’s experience and skills, chances are high that the bastard makes a blunder and gets caught. And if your infrastructure implements advanced monitoring, the hacker simply has no chance!

Good luck!