Wireless Auditing and Risk Assessment

Wireless Auditing and Risk Assessment

1. WLAN Discovery Tools

   • NetStumbler
     • Captures SSID,signal strength, AP name
     • GPS settings, MAC addresses
     • not work well with modern 64-bit systems
   • InSSIDer
     • commercial Wi-Fi network-scanning
     • Supports Windows and Mac OS
     • Performs scans
   • Kismet
     • runs on Linux
     • Works as a network sniffer and detector
     • determine network IP ranges
     • built-in channel hopping
   • HeatMapper
     • Locates and maps radio frequency
     • presents coverage overlaid
     • showing gaps and overlaps

2. Penetration Testing Tools

   • Metasploit
     • Open source software
     • assist administrators in “attacking” their networks
     • assess state of defense
     • Used for both pentesting and vulnerability assessments
   • Security Auditor’s Research Assistant
     • vulnerability scanner
     • Performs SQL injection, cross-site scripting (XSS) tests and etc
     • Integrates with Nmap

3. objectives

   • Password-Capture and Decryption Tools
     • Auditing and recovering passwords
       • Nessus
       • Aircrack-ng
       • PSK passwords
       • Win Sniffer
       • Ettercap
     • Dictionary-style attacks
       • word listed is encrypted in sequence
       • using same encryption method as the password
       • password crackers: Aircrack-ng, Cain & Abel, and John the Ripper
     • Brute-force attacks
       • comparing all possible combinations of characters
       • generally inefficient against strong, complex passwords
     • ways to overcome
       • Create strong passwords
       • Use different passwords for different applications
   • Network Enumerators
     • scan a network for active hosts
     • Detecting Windows shares
       • e.g : Legion from Rhino9
     • OS fingerprinting or port scanning
       • e.g : LanGuard
     • use wireless intrusion prevention system (WIPS)

4. Wireless Protocol Analyzers

   • theory : reveal and locate devices that are behaving contrary to the rules and protocols of the network
   • Aircrack-ng
     • network detector
     • built-in protocol analyzer
     • Runs on Windows and Linux
   • Airshark
     • wireless variant of the Wireshark protocol analyzer
     • use for wired Ethernet networks
     • discovering rogue AP
     • Runs network in promiscuous mode
     • pinpoint TCP conversations and threads

5. Network Management Systems

   • theory : Provides a single viewpoint that administrator can view
   • Enables use of SNMP
   • NMS applications-open source
     • e.g : OpenNMS, Nagios, and Zenoss
   • NMS applications-commercial
     • e.g : WhatsUp Gold, SolarWinds, IBM Tivoli

6. WLAN Hardware Audit Tools

   • Pineapple
     • pentesting and network auditing toolbox
     • runs application scripts Comes
     • use preconfigured attack software

7. WLAN Antennas

   • Omnidirectional antennas
     • have 360-degree coverage
   • semi-directional antennas
     • narrower broadcast beam
     • 180 degrees

8. Attack Tools and Techniques

   • Radio Frequency Jamming
     • Jamming of the 2.4 GHz and 5 GHz bands vulnerability
     • flood a frequency channel
   • Denial of Service
     • Sending packets with spoofed MAC addresses to AP
   • Hijacking Devices
     • uses death packets and then takes advantage on client devices attempt to reconnect
     • create a rogue access point

9. Risk Assessment

   • determine any change in requirements, technologies, or threats
   • Interception: Applies to data that travels over the network
   • Availability: Systems, servers, and applications must be available
   • Access: Refers to the points where remote users can join the network
   • Other Types
     • Pre-production assessment
     • High-level assessment

10. IT Security Management

    • Involves several activities that as part of a cycle of repeating security processes
    • Security practices and policies should be appropriate for size and value of network and its assets
    • Should be cost-effective
    • Identify assets needing protection

11. Security Risk Assessment Stages

    • planning
    • information gathering
    • risk analysis
    • identifying and implementing controls
    • monitoring