Chapter 28 - Securing Wireless Networks Flashcards
1
Q
True or False. If a wireless connection is left unsecured, any wireless device in range of the sender could intercept it.
A
True. This is why all wireless traffic (even LAN) should be encrypted.
2
Q
What is a Group Key?
A
- An encryption key that is used when an AP wants to send data to all devices associated with it at once.
- All clients associated with the AP keep this key so they can decrypt the traffic sent using the group key.
3
Q
What is MIC?
A
- Message Integrity Check
- A security tool used to protect against data tampering. It does this by applying a new field to the header of the frame (MIC field) which resembles the raw data itsself. The receiver then uses the same protocol that the sender used for encryption to decrypt the message. If this field matches the raw data then the data must not have been tampered with.
- If the MICs are different, the frame is discarded.
4
Q
What are the two original wireless authentication methods?
A
- Open Authentication
- WEP (Wired Equivalence Privacy)
5
Q
What is Open Authentication?
A
- A disused, weak wireless Authentication method
- No auth credentials are required. When a client attempts to connect to an AP it will send an 802.11 authentication request but there are no auth details in the request. This just proves that the wireless device is 802.11 compatible. As long as it is, the AP accepts the authentication request.
- Normally used in places like shopping centres where anyone can join but you must accept terms and enter some details to authenticate following association.
6
Q
What is WEP?
A
- A disused, weak wireless Authentication method. Although also includes encryption.
- Wired Equivalent Privacy
- Uses the RC4 cipher algorithm to make wireless data private and hidden from eavesdroppers. The key used to encrypt and decrypt is comprised of a series of bits and is called a WEP key.
- Also known as a shared-key security method meaning that the encryption key must be shared with the sender and receiver ahead of time so that any client can attempt association.
- Also used for authentication. The AP sends a random challenge phrase to the client that is attempting to associate. The client then encrypts the phrase with a WEP key and returns it. If the client’s and AP’s WEP encryption keys match then the client can associate. This confirms that the group key matches on the AP and client.
- WEP keys can be either 40 or 104 bits long, represented by a string of 10 or 26 hex digits. The initial bits are combined with a 24 bit IV (Initialisation Vector) to make it 64 or 128 bits.
7
Q
What is EAP?
A
- Extensible Authentication Protocol
- Used for authenticaiton, although not an authentication method in itsself. Defines functions that EAP based authentication methods can use to authenticate users.
- Integrates with 802.1x
8
Q
What is 802.1x?
A
- Otherwise known as PNAC (Port-based Network Access Control)
- Integrates with EAP. a device can be allowed to associate with an AP via open authentication but EAP and 802.1x will not allow the device to transmit data over the network without authenticating with an external server (e.g. RADIUS). The only data that is allowed to be transmitted is EAP authentication data.
9
Q
What are the 3 parties that exist in an 802.1x exchange?
A
- Supplicant - The client device that is requesting access
- Authenticator - The network device that provides access to the network (e.g. WLC)
- Authentication Server - The device that takes the supplicant’s credentials and permits or denies network access based on the server’s database and policies (e.g. RADIUS)
10
Q
What are the different EAP methods?
A
- LEAP - Lightweight EAP
- EAP-FAST - EAP Flexible Authentication by Secure Tunneling
- PEAP - Protected EAP
- EAP-TLS - EAP Transport Layer Security
11
Q
What is LEAP?
A
- An EAP Authentication method
- Lightweight EAP
- Developed by Cisco as an early attempt to resolve the security issues with WEP by using dynamic WEP keys that changed over time.
- Uses username and password authentication
- The client and authentication server both exchange challenge messages that are encrypted at each end and returned to the originator providing mutual authentication. As long as the message can be decrypted, the client and server have successfully authenticated.
- Although wireless devices still support LEAP, it should not be used as it is insecure due to the method used to encrypt the challenge messages.
12
Q
What is EAP-FAST?
A
- An EAP Authentication method
- EAP Flexible Authentication by Secure Tunnelling
- Developed by Cisco to improve upon the insecure LEAP
- Authentication credential are protected by passing a PAC (Protected Access Credential) from the authentication server to the supplicant. This is generated by the authentication server and is used for mutual authentication.
- The 3 phases of the EAP-FAST process are:
- Phase 0 - The PAC is generated or provisioned and installed on the client
- Phase 1 - After supplicant and authentication server have successfully authenticated each other, they negotiate a TLS tunnel
between each other
- Phase 2 - The supplicant will then be authenticated through the TLS tunnel for extra security - Phase 1 and 2 are known as an outer and inner two stage authentication method
- A RADIUS server is required. In order to be able to generate PACs, it must also act as an EAP-FAST server.
- One PAC per user
13
Q
What is PEAP?
A
- An EAP Authentication Method
- Protected EAP
- Similar process to EAP-FAST, however, rather than using a PAC generated by the authentication server, it uses a digital certificate to authenticate itsself with the supplicant on the outer phase of authentication. If the supplicant is happy with the identity of the authentication server, the two will build a TLS tunnel (like EAP-FAST) to be used for the inner phase of authentication.
- The certificate identifies the owner of it and is signed (validated) by a third party Certificate Authority (CA) which is trusted by both the authentication server and the supplicant.
- The supplicant doesn’t have its own certificate to validate so it uses one of the two following methods to authenticate itsself within the TLS tunnel:
- MSCHAPv2 - Microsoft Challenge-Handshake Authentication Protocol V2
- GTC - Generic Token Card - A hardware device that generates a one time password for the supplicate or a manually
generated password.
14
Q
What is EAP-TLS?
A
- An EAP Authentication Method
- EAP - Transport Layer Security
- Requires a certificate to be installed on the authentication server and every client
- Builds a TLS tunnel following the certificate exchange.
- Considered to be the most secure wireless authentication method available
- You don’t need to manually install a certificate on every client. You can use a PKI (Public Key Infrastructure) to supply and revoke certificates when necessary. This normally involves setting up a CA or building a trust relationship with a third party CA.
- Only applicable to devices that can accept and use digital certificates. For example, Medical Devices with underlying operating systems that cannnot interface with a CA or use certificates would not be able to use EAP-TLS for wireless security.
15
Q
What are the recommended alternatives to WEP as privacy and integrity methods?
A
- TKIP - Temporal Key Integrity Protocol
- CCMP - Counter/CBC MAC Protocol
- GCMP - Galois/Counter Mode Protocol
