Passive Wireless Discovery

General Information Gatheringslide 5

• Includes:
  • Social engineering
  • Phishing
  • Improperly recycled equipment
  • Search engine scanning
  • Dumpster diving

Social Engineeringslide 6

• Relies on tricking someone to access a system
• Common characteristic
  • Some technical skills are needed to break into the system
• Relies on the friendliness, frustration, or helpfulness of a company employee
  • To reveal information necessary to access a system
• Best defense against social engineering: written policy

Phishingslides 7–12

• Electronic version of social engineering
• Involves sending an e-mail or displaying a Web announcement
  • Falsely claims to be from a legitimate enterprise
  • Attempt to trick the user into surrendering information
• Difficult to distinguish between legitimate and fraudulent messages and Web sites

• Variations on phishing attacks
  • Spear phishing targets only specific users
  • Pharming automatically redirects user to the fake site
  • Google phishing involves phishers setting up their own search engines to direct traffic to illegitimate sites
• Ways to recognize phishing messages
  • Deceptive Web links
  • E-mails that look like Web sites
  • Fake sender’s address

• Ways to recognize phishing messages
  • Generic greeting
  • Poor grammar, formatting, or misspellings
  • Pop-up boxes and attachments
  • Unsafe Web sites
  • Urgent request

Improperly Recycled Equipmentslide 13

• Many organizations and individuals recycle older equipment
  • By donating them or by selling them online
• Information that should have been deleted from the equipment often is still available
• With many operating systems, simply deleting a file does not necessarily make the information irretrievable
• Data can be retrieved by an attacker

Search Engine Scanningslides 14–15

• Search engines are important tools for locating information on the Internet
• Search engines offer advanced search tools
  • That can narrow criteria for more specific information
• Attackers can use search engines to scour the Internet for important attack information

Dumpster Divingslide 16

• Dumpsters can be a source of secure information
  • Files, letters, memos, passwords, and similar sensitive data can be found in dumpsters
• Heightened emphasis on security today has resulted in sensitive documents being shredded

Wardrivingslide 17

• Scanning the radio frequency airwaves for a signal
  • Can identify and map the location of a wireless network

What Is Wardriving?slides 18–19

• Wireless location mapping
  • Used to refer to passive wireless discovery
    • Process of finding a WLAN signal and recording information about it
• Technically involves using an automobile to search for wireless signals over a large area
  • Warflying uses airplanes instead of automobiles
• Wardriving is in itself not an illegal activity
  • Using that RF signal to connect to networks without the owner’s permission can be illegal

• Techniques used by wardrivers
  • Driving at slower speeds
  • Using surface streets
  • Creating a plan
  • Repeating over time

Wardriving Hardwareslides 20–37

• Mobile computing devices
  • Laptop computer
  • Tablet computer
    • Designed for truly mobile computing
    • Can be operated with a stylus instead of a keyboard
    • Types: convertible and slate
    • Advantages
      • Users can write rather than type
      • Handwritten notes are immediately digitized
      • Ideal for drawings, formulas, signatures, and other graphical objects

• Mobile computing devices
  • Handheld PC
    • Small enough to be held in a single hand
    • Has many of the features of a laptop computer
  • Personal digital assistant (PDA)
  • Smartphones
    • Combine functions of a PDA and a cellular telephone

• Wireless network interface card
  • Allows mobile computing device to detect a wireless signal
  • Also called a wireless client network adapter
  • WNICs shapes and styles
    • Standalone USB
    • USB Key fob
    • CardBus card
    • Mini PCI card
    • Type II PC card
    • CompactFlash (CF) card (may require an optional sled)

• Wireless network interface card
  • Chipset
    • Group of integrated circuits that provide the functionality of the wireless NIC
    • Not all chipsets support radio frequency monitoring (RFMON)
  • RFMON
    • Passive method of receiving WLAN signals
  • Promiscuous mode
    • Allows a wired NIC to capture all the packets it receives
    • Promiscuous mode will not work on a WLAN

• Antennas
  • Attaching an external antenna will significantly increase the ability to detect a wireless signal
  • Fundamental characteristics
    • As the frequency increases, wavelength decreases
      • This means that the size of the antenna is smaller
    • As antenna gain increases, the coverage area narrows
      • High-gain antennas offer longer coverage areas

• Antennas
  • Basic categories
    • Omni-directional
      • Also called a dipole antenna
      • Detects signals from all directions equally
    • Semi-directional
      • Focuses the energy in one direction
    • Highly directional
      • Sends a narrowly focused signal beam
      • Generally concave dish-shaped devices

• Global Positioning System (GPS)
  • Used to precisely identify location of a GPS receiver
  • Composed of 27 earth-orbiting satellites
    • Continually transmits two signals, L1 and L2
  • GPS receiver measures signals from satellites
    • Calculates time required for signal to travel from satellite to receiver
  • GPS receiver can deduce its own location based on a mathematical principle called trilateration
  • GPS device is optional when wardriving

Wardriving Softwareslides 38–46

• Client utilities
  • When WLANs first appeared, operating systems were not equipped to be aware of their presence
  • Used to detect a wireless signal and then connect to that network
• Integrated operating system tools
  • Microsoft’s Wireless Zero Configuration (WZC)
    • Tightly integrated with Windows XP Service Pack 2 (SP2) and Windows Server 2003
    • Facilitates roaming between different WLANs

• Freeware discovery applications
  • Specifically designed to pick up a radio frequency WLAN signal
  • NetStumbler
    • Probably the most widely used
    • Can determine an access point’s location using a GPS device to mark locations
    • Cannot capture and decode wireless packets, monitor utilization, or make automatic connections
    • Cannot report all types of encryption
      • Such as IP Security (IPSec)

• Freeware discovery applications
  • Kismet
    • Runs under the Linux operating system
    • Can report similar information as NetStumbler
    • Also supports GPS
    • Can capture packets and dump them to a file
  • KisMAC
    • Kismet application for Apple MacOS X

Public Mapping Sitesslides 47–50

• Final step in wardriving
  • Document and then advertise the location of the wireless LANs
• Warchalking
  • Wireless networks were identified by drawing on sidewalks or walls around the area of the network
  • Has been replaced by public online databases and mapping sites

Wireless Packet Sniffersslides 51–54

• Monitoring network traffic is important to determine the health of a network
• Simple Network Management Protocol (SNMP)
  • Part of the TCP/IP protocol suite
  • Allows computers and network equipment to gather data about network performance
  • Software agents are loaded onto each network device that will be managed
    • Monitor network traffic
    • Store info in a management information base (MIB)

• Simple Network Management Protocol (SNMP)
  • SNMP management station
    • Communicates with the software agents and collects the data stored in the MIBs
  • First two versions of SNMP used community strings
    • Acted like a password to allow or deny access to the information that was collected
• Packet sniffer
  • Captures TCP/IP packets as they are transmitted

• Packet sniffer
  • Categories based on their functions
    • Counts the number of packets transmitted
    • Shows general characteristics of traffic
    • Provides a detailed analysis of all protocols
• Wireless packet sniffer
  • Can capture data frames and management frames

• Wireless packet sniffer
  • Helps reveal the following WLAN problems:
    • An access point that is advertising its SSID when it is intended to be turned off
    • An access point with encryption disabled
    • A wireless client that is sending a high rate of low-speed packets
    • An access point that is transmitting an excessive number of beacon frames