Tag Archives: attack

WEP Cracking 101

Posted by Jon Janego on September 23, 2010 No comments

It’s occured to me, many folks understand that WEP is easy to break, but don’t know all the steps and just how easy it is.  Here I hope to lay down the basic steps in one coherent post.. demonstrating how to crack into a wireless network using WEP, with a client attached to it.

Like always… only do this against your own networks.  The legal grounds are a bit grey here, but the ethical grounds are clear – you shouldn’t pick your neighbor’s doorlock.  Being a security professional also comes with the responsibility to use your skills for good, not evil.

Step 0: get the software.

I assume you’re using linux…. these tools do work on OSX but they require a bit of tweaking i think, and i haven’t done it myself.  so i’ll just write up linux.  you can use a VM of linux but the wireless card support is a bit flakier unless you’re using a USB card.

basically you only will need two packages, kismet, and aircrack-ng

So:
apt-get install kismet
apt-get install aircrack-ng

Step 1: Find a WEP network

Kismet is an amazingly powerful scanning tool and I could write much more about it than we need here.  It takes advantage of the feature in wireless cards to use “monitor mode”, which basically does passive listening for network traffic, and analyzes the traffic into a nice list.  It can do all sorts of other neat stuff like gps logging, etc, but that’s not totally necessary here.

If you don’t know it, you’ll need the interface name for your wireless card.  Check it by typing:

iwconfig
Then, just launch kismet (type ‘kismet‘) and then it will prompt you what your WLAN card is.  It will try and put it into monitor mode and is usually successful, even with built-in wireless.  If not theres some troubleshooting to be done….

Assuming it works, it will give you a list of networks it sees.  It ‘hops’ channels by switching the frequency the card is listening on and collects traffic on that frequency.  If there’s a WEP network in sight, kismet will highlight it in red, and you will need to pay attention to four things:

  • Its BSSID – similar to the MAC address of the access point
  • The ESSID – the ‘friendly name’ of the network
  • The MAC address of a client that is attached to it.
  • The channel the AP is broadcasting on

Kismet has a column that shows the amount of traffic it sees for both the AP in general and the client.  You want to target one with a client attached that is passing data… they’re the easiest targets.

An alternate path to WLAN monitor mode:

If kismet has a hard time putting your card into monitor mode, try running ‘airomon-ng start <interfacename>’ and it should attempt to do so.  If that still doesn’t work…. investigate getting a new card.  The Alfa AWUS306Hf is an excellent USB choice.

Step 2: prepare to attack

If it’s not setup yet, enable monitor mode:

airomon-ng start <interfacename>.

Begin a dump session – this logs traffic, sort of like a lightweight Wireshark.  You want to filter it to only the transactions we’re interested in:

airodump-ng –channel <c> –bssid <xx:xx:xx:xx:xx> –write <fileprefixname> <interfacename>

where c: the broadcast channel of the network
xx: BSSID of the network
<interfacename> – self explanatory (i.e. wlan0mon)

Keep this running and launch a new window for the next steps.

Step 3: do an ARP replay attack

This essentially looks for an ARP request from the attached client, and replays it many many times, enough to create a data set large enough to mount a cryptographic attack against WEP.

aireplay-ng –arpreplay -h <xx:xx:xx:xx:xx:xx> -b <yy:yy:yy:yy:yy:yy:> <interfacename>

where xx: the MAC address of the client
yy: BSSID of the network
<interfacename> – self explanatory (i.e. wlan0mon)

Once this has started, check out the other window.  You should see the data packets starting to increase rapidly.  When you’re at about 40k there is enough to crack a 104-bit WEP key.  The more the better, but no harm in starting early…

Step 4: mount the cryptographic attack

From the same directory you launched the dump process just run this:

aicrcrack-ng <fileprefixname>.cap -0

This will launch a window that shows progress.  if it’s successful, you’ll see the key!  if it’s not… keep waiting for more traffic.  40k+ data packets increases your odds tremendously but if it’s a simple WEP key it requires less.  This tool will actually keep trying as the packet capture increases in size so you can keep it running.  Or quit it (ctrl-c) and wait till you have more.

Step 5: connect!

If all went well you have broken the WEP key via the PTW attack method.  Now you can connect to the network.  Close down the dump sessions, etc etc and bring down your WLAN card – ifconfig wlan0 down

Then you’ve just gotta connect:
ifconfig <interface> up - bring up the wlan card

iwconfig <interface>mode managed key [WEP key]

iwconfig <interface> essid “[ESSID]” (Specify ESSID for the WLAN)

dhclient [interface] (to receive an IP address, netmask, DNS server and default gateway from the Access Point)

If all goes well you’ll get an IP and then you’re good to go, test by pinging or whatever else.

But if it didn’t work, they may have MAC filtering in place…

So change the MAC address of your wireless card to the same one that you just cracked with!  This is a bit messy and could freak out the DHCP server of the access point, but it’s worth a shot.

Bring the card down first:

ifconfig wlan0 down

Then change the MAC:

ifconfig wlan0 hw ether xx:xx:xx:xx:xx:xx

Bring it back up again and repeat.  You should be good to go.

This is a simplified walkthrough of a process that is documented many other places.  It should give you a taste of kismet, and the basics of the aircrack-ng suite, which has many many other great features.  I encourage you to read all about it over on their website.

Additionally, their site also contains a much more in-depth WEP crack tutorial.

Again, this is not ground-breaking, but it is always good to share the fundamentals in case someone hasn’t seen it before.  Good luck!

Pivot Mercilessly!

Posted by Jon Janego on March 17, 2010 No comments

I just returned from a great trip to SANS 2010, in Orlando, where I was taking SEC 560 – Penetration Testing.  Our instructor, Ed Skoudis (an amazing guy, by the way), repeatedly hammered into our brains the mantra “Pivot Mercilessly!”

This concept is something that a penetration tester or vulnerability assessor needs to always keep in mind – look for the easy toehold into a system, and then see where you can go from there.  “Pivot” throughout the environment using the weak link as a starting point.

I was performing an assessment recently on a Solaris system that demonstrated this concept very effectively.  One of the boxes was vulnerable to a relatively old telnet vulnerability , which we exploited with pleasure – granting us root access to the machine.  From there, we examined the trust relationships inside the network and noticed that this box had “r service” trust relationships set up with many other machines in the network.  So, we used rsh to connect to numerous other boxes, all with root level access, and from those boxes to others… quickly we had the entire system PWNED.

All of this was made possible by a single box with one weak spot.  This is likely the case with most systems out there – maybe you’ll have one or two boxes vulnerable to exploits, especially in a well-managed corporate network.  From there, it’s up to you to pivot your way through the rest of the system!

Information Leakage via Delicious

Posted by Jon Janego on July 10, 2009 3 comments

By now, the concept of “google hacking” is pretty commonly understood.  People may not be preventing it very well, but it’s moved beyond a new thing.

For the uninitiated, though, here’s a brief summary: using Google (or any other search engine – but really, is there any other?) to find vulnerable web apps, personal information, mp3s in public directories, etc etc.  It’s great fun, and a pretty fundamental initial step of profiling an attack target.

Johnny Long was one of the main evangelists of this method and has a great database of search terms.  It’s no longer actively maintained, but you can still find plenty of good information with this as a starting point!

So Google hacking is great, but it only gets you to the public internet.  What if I wanted to profile the inside of a company, from the outside?  And passively – without hitting their servers myself?  Wouldn’t it be great if I could look for public information shared by company insiders?

Delicious seems almost perfectly designed to do this kind of activity.  For the unfamiliar, delicious is an online bookmarking site, designed around the idea that sharing bookmarks is a great way to learn about new sites.  Which is an alright idea…  but don’t people also bookmark a lot of private information?  I sure do!

Making matters worse, delicious encourages users to get started by uploading their browser bookmarks.  Essentially uploading gobs of potentially personal data to a public site.  This is a classic case of information leakage.  A dedicated attacker can use this public information to get all sorts of juicy tidbits about a company.

Let’s do some examples.  This all works great in theory, but, like Google, there is a LOT of data to sort through.  Say I’m a bad guy interested in insider information about a company.  I can start looking for the basics – say… “intranet”.  Delicious makes this easier by encouraging users to tag their posts for easy categorization:

http://delicious.com/tag/intranet

So that gives me everything that users have tagged with ‘intranet’.   Lots of sites about intranet design, usability, etc.  But also sites tagged by users to manage their own bookmarks!  So I’ll start digging into an individual company… how about AMD?

http://delicious.com/search?p=amd&u=&chk=&context=recent&tag=intranet

intranet_amd

The first result doesn’t look interesting, but the second and third, well those sound like intranet sites!  This is confirmed by trying to follow them through and the DNS not resolving.  Nice!  Now let’s see what else this presumed AMD employee has bookmarked…

links_1

Wow, lots of development related links!  Interesting.  And what’s that link on page 2 about “AMD Manager Toolkit” ??  This fellow looks like he’s a technical manager at AMD!

Dig a little deeper, and it looks like we have another intranet site – mentioning the (presumably internal) code name of a project.  Interesting!  Go further into the links, and you see even further links to internal project Wiki pages.

links_2

Surfing around to a few of the non-intranet sites gives me an even better profile of this person.  They work with unit testing.  They use UML, C++, and Ruby, and read a lot about circuit design.  They live in India.  They’re learning guitar, and are interested in martial arts.

This may seem like innocent information to an outsider, but if I was doing this for espionage purposes, I just learned a lot about the internal operations of a project – and this is with 10 minutes of work on one webpage.  What else could I find if I dug through the internet further?

Web 2.0 is a lot of fun, and can be really useful.  But what’s often overlooked are the implications of sharing all this information.  Unless you make it a point to protect your privacy, that privacy probably doesn’t exist.  And for businesses, this can be a major potential risk.

Delicious certainly doesn’t help stop this – according to the FAQ, you cannot make your links private by default, but instead must manually edit them to make them private.  And also, the TOS leaves responsibility entirely in the hands of the users.  Very laissez-faire!

Should companies ban employees from using sites like delicious?  Probably not.  But I think that this demonstrates that employees need to be more educated on what they are exposing themselves and their employer to when using social networking sites.

Symbian S60 SMS Exploit ‘Curse of Silence’

Posted by Ben Hagen on January 3, 2009 No comments

A lot of very interesting research was presented at this year’s Chaos Computer Club meeting. One very interesting piece of research involved the mobile Symbian S60 operating system and a DOS vulnerability involving a maliciously (or unfortunately long legitimately) crafted SMS message. The original advisory released by Tobias Engel can be found here.

Executing the exploit is trivial and can be performed directly on most SMS capable mobile phones or SMS gateway services. The attacker simply creates an SMS message prefaced with an email address greater than or equal to 32 characters in length followed by a space (ex. “123456789@123456789.1234567890123 DOSed!”). After receiving the malicious message, the target’s phone’s SMS service will either die silently (preventing new messages from being received) or fail to receive new SMS messages after a certain number of malicious messages have been received. This is effectively an SMS DOS.

The problem would appear to be in the way that the S60 OS parses the prefaced email address of the received SMS message. There is a little used SMS standard (3GPP TS 23.040 section 3.8) for sending SMS messages to email targets and this parsing is likely related to the displaying of these messages. Typically when an error like this kills a service it could become a vector for a buffer overflow attack, but because of the hard message length limit on SMS messages, this is most likely not possible.

Symbian is a mobile operating system used mostly by Nokia phones (although some other manufacturers use Symbian; including Sony, and Motorola). According to the advisory any Symbian phone running the below software versions is vulnerable:

  • S60 2nd Edition, Feature Pack 2 (S60 2.6)
  • S60 2nd Edition, Feature Pack 3 (S60 2.8)
  • S60 3rd Edition, initial release (S60 3.0)
  • S60 3rd Edition, Feature Pack 1 (S60 3.1)

You can identify what phones have vulnerable versions by referencing the S60 product page.

The f-secure mobile security product is advertising protection for this exploit. Other than upgrading the operating system of a device (a process which must be vendor/provider supported) or disabling the SMS feature of your calling plan,  a software solution appears to be the only way to mitigate this problem device.