Bypassing shared authentication is a bit more challenging than the previous exercises, so follow the steps carefully:
- Let's first set up shared authentication for our Wireless Lab network. I have done this on my access point by setting the security mode as WEP and Authentication as Shared Key:
- Let's now connect a legitimate client to this network using the shared key we have set in step 1.
- In order to bypass SKA, we will first start sniffing packets between the access point and its clients. However, we would also like to log the entire shared authentication exchange. To do this, we use the
airodump-ngutility using theairodump-ng wlan0mon -c 11 --bssid <mac> -w keystreamcommand. The-woption, which is new here, requestsairodump-ngto store the packets in a file whose name is prefixed with the wordkeystream. Incidentally, it might be a good idea to store different sessions of packet captures in different files. This allows you to analyze them long after the trace has been collected:
- We can either wait for a legitimate client to connect to the access point or force a reconnect using the deauthentication technique used previously. Once a client connects and the SKA succeeds,
airodump-ngwill capture this exchange automatically by sniffing the air. An indication that the capture has succeeded is when theAUTHcolumn reads WEP. - The captured keystream is stored in a file prefixed with the word
keystreamin the current directory. In my case, the name of the file iskeystream-01-00-21-91-D2-8E-25.xor. - If this doesn't work, you can use
aireplay-ng -4 -h <Connected Device MAC> -a <AP BSSID> wlan0monto generate an.xorfile. This requires a connected device to be on the target WEP protected network and will generate packets spoofing their MAC address to identify the XOR stream and key.
- In order to fake a SKA, we will use the
aireplay-ngtool. We run theaireplay-ng -1 0 -e "Wireless Lab" -y keystream-01-00-21-91-D2-8E-25.xor -a <mac> -h AA:AA:AA:AA:AA:AA wlan0moncommand. Thisaireplay-ngcommand uses the keystream we just retrieved and tries to authenticate with the access point with the SSID,Wireless Laband the MAC address,00:21:91:D2:8E:25, and uses an arbitrary client MAC address,AA:AA:AA:AA:AA:AA. - Fire up Wireshark and sniff all packets of interest by applying a
wlan.addr == AA:AA:AA:AA:AA:AAfilter. We can verify this using Wireshark. You should see a trace on the Wireshark screen, as shown in the following screenshot:
- The first packet is the authentication request sent by the
aireplay-ngtool to the access point:
- The second packet consists of the access point sending the client challenge text, as shown in the following screenshot:
- In the third packet, the tool sends the encrypted challenge to the access point:
- As the
aireplay-ngtool used the derived keystream for encryption, the authentication succeeds and the access point sends a success message in the fourth packet:
- After the authentication succeeds, the tool fakes an association with the access point, which succeeds as well. If you check the wireless logs in your access point's administrative interface, you should now see a wireless client with the MAC address,
AA:AA:AA:AA:AA:AAconnected:
We were successful in deriving the keystream from a shared authentication exchange, and we used it to fake an authentication to the access point.
Access points have a maximum client count after which they start refusing connections. By writing a simple wrapper over aireplay-ng, it is possible to automate and send hundreds of connection requests from random MAC addresses to the access point. This will end up filling the internal tables and once the maximum client count is reached, the access point will stop accepting new connections. This is typically what is called a Denial of Service (DoS) attack and can force the router to reboot or make it dysfunctional. This can lead to all the wireless clients being disconnected and being unable to use the authorized network.
Check whether you can verify this in your lab!
Q1. How can you force a wireless client to reconnect to the access point?
- By sending a deauthentication packet
- By rebooting the client
- By rebooting the access point
- All of the above
Q2. What does Open Authentication do?
- It provides decent security
- It provides no security
- It requires the use of encryption
- None of the above
Q3. How does breaking SKA work?
- By deriving the keystream from the packets
- By deriving the encryption key
- By sending deauthentication packets to the access point
- By rebooting the access point