Gaining access hacking, Essays (university) of Cybercrime, Cybersecurity and Data Privacy

Download Gaining access hacking and more Essays (university) Cybercrime, Cybersecurity and Data Privacy in PDF only on Docsity!

Gaining Access

● Wired Equivalent Privacy ● Old encryption. ● Uses an algorithm called RC4. ● Still used in some networks. ● Can be cracked easily.

WEP Cracking

WEP

Access Point

internet

Client

Data to send to the router

● Client encrypts data using a key. ● Encrypted packet sent in the air. ● Router decrypts packet using the key.

internet

Client

Access Point

● Client encrypts data using a key. ● Encrypted packet sent in the air. ● Router decrypts packet using the key.

internet

Client

Access Point

● Client encrypts data using a key. ● Encrypted packet sent in the air. ● Router decrypts packet using the key.

Access Point

internet

Client

● Each packet is encrypted using a unique key stream. ● Random initialization vector (IV) is used to generate the keys streams. ● The initialization vector is only 24 bits! ● IV + Key (password) = Key stream.

Data to send to the router

internet

Client

ASDKASDIASDJA

Access Point

● Each packet is encrypted using a unique key stream. ● Random initialization vector (IV) is used to generate the keys streams. ● The initialization vector is only 24 bits! ● IV + Key (password) = Key stream.

Keystream + "Data to send to the router” = ASDKASDIASDJA

internet

Client

Data to send to the router

Access Point

● Client encrypts data using a key. ● Encrypted packet sent in the air. ● Router decrypts packet using the key.

● IV is too small (only 24 bits). ● IV is sent in plain text.

Result:

● IV’s will repeat on busy networks. ● This makes WEP vulnerable to statistical attacks. ● Repeated IVs can be used to determine the key stream; ● And break the encryption

WEP

Conclusion:

To crack WEP we need to:

1. Capture a large number of packets/IVs. → using airodump-ng
2. Analyse the captured IVs and crack the key. → using aircrack-ng

WEP

Problem:

● If network is not busy. ● It would take some time to capture enough IVs.

Solution:

→ Force the AP to generate new IVs.

WEP

● Wait for an ARP packet. ● Capture it, and replay it (retransmit it). ● This causes the AP to produce another packet with a new IV. ● Keep doing this till we have enough IVs to crack the key.

ARP Request Replay

WEP

WPA / WPA2 Cracking

WPA/WPA

● Both can be cracked using the same methods ● Made to address the issues in WEP. ● Much more secure. ● Each packet is encrypted using a unique temporary key.

→ Packets contain no useful information.

WPA / WPA2 Cracking

WPA/WPA

● Fixed all weaknesses in WEP. ● Packets contain no useful data. ● Only packets that can aid with the cracking process are the handshake packets. ○ These are 4 packets sent when a client connects to the network.

WPA / WPA2 Cracking

● The handshake does not contain data the helps recover the key. ● It contains data that can be used to check weather a key is valid or not.

Handshake