Slide Heading

1. Slide Heading Security Auditing Wireless Networks Ted J. Eull viaForensics October 12, 2011

2. Introductions • viaForensics • Digital security via forensics. Leader in mobile forensics and security assessment • Apply methods used for computer crime investigation and incident response proactively to enhance security. • Based in Oak Park, IL (Chicago suburb) • Ted Eull, VP Technology Services • 10+ years in IT consulting, corporate and security • Background in Web app development • GWAPT, CRISC pending • Not a wireless pen test specialist (sorry)

3. Agenda or contents slide Slide Heading

4. Why: Reasons to audit CobiT Linking Business Goals to IT Goals Many reasons to leverage wireless Key reasons to security audit 

5. Why: Reasons to audit • Regulations, regulations • Both industry and government • PCI / Payment Card Industry • GLBA / Gramm–Leach–Bliley Act • Federal Financial Institutions Examination Council / FFIEC • Health Information Portability and Accountability Act / HIPAA • Federal Energy Regulatory Commission / FERC • Sarbanes-Oxley / SOX

6. Why: Duh. • Protect your business / organization • Sensitive and proprietary information • Clients and business partner data • Reputation • The reasons behind the regulations

7. Why: Wireless Issues From the FFIEC IT Examination Handbook http://ithandbook.ffiec.gov/it-booklets/information-security/security-controls-implementation/access-control-/network-access-.aspx Wireless Issues Wireless networks are difficult to securebecause they do not have a well-defined perimeter or well-defined access points.  Unlike wired networks, unauthorized monitoring and denial of service attacks can be performed without a physical wire connection.  Additionally, unauthorized devices can potentially connect to the network, perform man-in-the-middle attacks, or connect to other wireless devices.  To mitigate those risks, wireless networks rely on extensive use of encryption to authenticate users and devices and to shield communications. More 

8. Why: Wireless Issues • Wireless Issues (continued) • If a financial institution uses a wireless network, it should carefully evaluate the risk and implement appropriate additional controls. Examples of additional controls may include one or more of the following: • Treating wireless networks as untrusted networks, allowing access through protective devices similar to those used to shield the internal network from the Internet environment; • Using end-to-end encryption in addition to the encryption provided by the wireless connection; • Using strong authentication and configuration controls at the access point and on all clients; • Using an application server and dumb terminals; • Shielding the area in which the wireless LAN operates to protect against stray emissions and signal interference; and • Monitoring and responding to unauthorized wireless access points and clients.

9. Why: The threats • Data Interception • Can be intercepted at distance with directional antennas (Wi-Fi sniper rifles clocked at > 10 miles) • WEP can be cracked in seconds • TKIP vulnerable to a keystream recovery attack which can allow injection of certain frames, this can enable ARP poisoning and DoS for example. AES is better. • WPA/WPA2 vulnerable to dictionary attacks, rainbow tables and brute forcing. • Many large organizations adopt a standard 802.11x configuration using EAP-TLS with user certificates and a RADIUS server for authentication. Although considered very secure, be aware that it can still expose username and domain in the clear when authenticating.

10. Why: The threats • Denial of Service • Signal/frequency jamming • Cheap portable devices from China • Deauth Attack • Management frames are sent in the clear for 802.11a/b/g/n which includes deauth frames. 802.11w protects management frames which prevents deauth attacks but only adopted by a few vendors • A small laptop or handheld device can send out deauth requests continually which drops clients. Can even be targeted at a certain vendor (e.g. all Apple devices) • WIDS should detect this • Channel Reservation • Attacker can send out repeated frames with a maximum wait duration and silence the channel, for equipment that follows 802.11 spec

11. Why: The threats • Rogue Access Points • Unauthorized APs plugged into the internal LAN. • Can be detected by some enterprise APs which scan for nearby rogue APs, and also by scanning the internal LAN for the management interface of popular wireless routers. • Can be detected by regular site surveys using Wi-Fi scanning equipment and directional antennas. • Spectrum analyzer capability is useful to catch highly covert installations and devices tuned off-band so as to avoid detection from standard equipment.

12. Why: The threats • Misconfigured APs • With the vast number of configuration options it requires a great deal of planning, testing, on-going maintenance and training to operate a large Wi-Fi installation. • Ad Hoc and Software APs • Can allow for an attacker to connect directly to a corporate laptop inside a building and route traffic onto the corporate LAN, bypassing network security. • Client Driver Attacks • Exploiting bugs in Wi-Fi drivers of clients to remotely execute code on a victim's device without even needing a Wi-Fi network. • Defense is to keep client drivers patched, but still exposed to zero days

13. Why: The threats • Misbehaving Clients and Evil Twin APs • Clients forming unauthorized connections accidentally or intentionally • If corporate SSID is hidden, it will cause the client device to continually probe for it wherever it goes, leaking information and providing the ability for devices to be tracked. • If a client has previously connected to a hidden open network, or an open network with a common name such as Starbucks, McDonalds, then an attacker can easily trick the client into connecting to their AP from where a MITM attack can occur. • If a user is allowed to connect to any Wi-Fi networks then they could be enticed to connect to an attacker's AP with the promise of free Wi-Fi or because it looks like an official corporate one.

14. Why: In short • Because it is a scary cyber world out there • To determine whether wireless technologies are properly managed and secured, in accordance with overall enterprise IT governance

15. What: Wireless components • WLAN • IEEE 802.11 Spec • aka Wi-Fi • b/a/g/n • Router/access point • Wireless clients • Typical range has nearly doubled in 10 years • Anything else?

16. What: More than WLAN

17. What: More than WLAN • Identify all use of wireless to evaluate potential risk • Cellular (3G, LTE) • Bluetooth • Radio-frequency identification / RFID • Near field Communication / NFC • Zigbee • Not all may require security assessment, but each should be understood and evaluated

18. What? More than WLAN • When identifying wireless in the enterprise, think outside the WLAN • Warehouse (RFID) • PC & Mobile accessories (Bluetooth) • “Smart Meters” (Wi-Fi, Zigbee) • And most of all…

19. What? More than WLAN • Mobile devices and more mobile devices • By 2013, mobile phones will overtake PCs as the most common Web access device worldwide [Gartner]. • Often consumer devices (iOS, Android) • Cellular + Wi-Fi • Inexpensive • Flexible • Fast evolving • Easy to secure • Just kidding

20. How: Audit Process • You decided auditing wireless is a good idea • Risk Assessment • Identify technology in use • Threat Profiling: start bottom-up. i.e. Consider all threats to the tech in use • STRIDE threats: Spoofing Identity, Tampering with data, Repudiation (insufficient logging), Information Disclosure, Denial of Service, Elevation of Privileges • Try to construct realistic scenarios • Find pre-constructed scenarios • Have business stakeholders involved

21. How: Audit Process • Evaluate Risk • Consider industry and company-specific regulatory, policy and risk factors • Use DREAD or other rating system • Damage + Reproducibility + Exploitability + Affected Users + Discoverability • Consider potential cost of “worst case scenario” • Evaluate security countermeasures and controls in place which can mitigate threats

22. How: Technical Process • Perform Security Assessment: Scope • Scope Appropriate for Risk • Vulnerability assessment vs. penetration testing • Test active production systems • Plan to trigger detection / countermeasures

23. How: Technical Process • Perform Security Assessment: Review • Design review of Wi-Fi infrastructure • Authentication • Defense in depth • Physical AP placement, security • Signal Coverage • Configuration review of Wi-Fi infrastructure to make sure it is configured correctly • Firmware versions • Review mobile device controls and security

24. How: Technical Process • Perform Security Assessment: Scan • Site survey with directional antenna and some good scanning software to identify rogue APs. Use a spectrum analyzer to pick up covert or malfunctioning wireless devices. • Test WIDS/WIPS if present by undertaking malicious activity such as deauth attacks and Evil Twin APs • Scans for client devices, such as: • Pineapple Karma attack to see who connects • Sniffing authentication to corporate Wi-Fi • Scanning for vulnerable client Wi-Fi drivers (can crash devices)

25. How: Technical Process • Wi-Fi Pineapple and Jasager • Jasager = “The Yes Man” • Portable Wi-Fi router built for initiating MITM position • Web interface for attacker, showing currently connected clients with their MAC address, IP address (if assigned) and the SSID they associated with • Run scripts on IP assignment • Full logging for later review • Extensible, with additional modules • Easy to set up phishing attacks • About $100 from http://hakshop.com/

26. How: Technical Process • Perform Security Assessment: Mobile Devices • Forensic analysis of mobile devices that access network and store data • Assess data exposure • Test efficacy of security controls (e.g. passcode, remote wipe) • Examples of issues uncovered: • Network username/password easily recoverable • Corporate email in user backups • Passcode enforcement and remote wipe failure • Keychain dump (iOS)

27. How: Technical Process • Mobile Risk Study from viaForensics • Focused on iOS & Android • Key issues, recommendations • Risk scenarios, risk map • Corporate policy recommendations • Comparison to BlackBerry • Lab tests of MS Exchange ActiveSync policy implementation • Technical review of encryption, passcode protection, malware vulnerability, etc. • High-level overview of Mobile Device Management (MDM) software • Available this month (online purchase/download)

28. Who: Internal or External • Some level of internal assessment capability should be maintained • Leverage external specialized expertise for more complete vulnerability assessment or pen test • Experienced testers should perform more than automated scans • Security certifications good, wireless-specific even better (e.g. GAWN)

29. When: And how often • Depends on enterprise audit program • At least annual basic assessment • Identify technologies, infrastructure, devices • Check configurations, logging • Level set with overall security policies • Regular mobile device audits • Frequency of vulnerability scans, pen tests depends on corporate risk evaluation • Ongoing security through active monitoring, such as WIDS/WIPS

30. Recommendations WEP

31. Recommendations • Assumeall wireless traffic can be intercepted • Isolate wireless from corporate LAN • If Wi-Fi on LAN is necessary, use strong authentication, isolated VLAN and NAC • Use IDS/IPS for continuous monitoring • Test security systems such as WIDS • Implement reliable VPN for mobile workers, use GPO to require VPN when off LAN • Assesshow mobile devices are being used and where data is going • Policy and training for users on wireless security

32. Resources • ISACA • What every IT auditor should know about wireless telecommunication (2006) http://www.isaca.org/Journal/Past-Issues/2006/Volume-4/Pages/What-Every-IT-Auditor-Should-Know-About-Wireless-Telecommunication1.aspx • Mobile Computing Security Audit/Assurance Program (2010) http://www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/Mobile-Computing-Security-Audit-Assurance-Program.aspx • viaForensics Mobile Risk Study • http://viaforensics.com/mobile-risk-study

33. Resources • RFID tools (rfidiot, proxclone reader/cloner) • http://hackaday.com/2007/03/25/rfidiot-rfid-io-tools/ • http://proxclone.com/reader_cloner.html • Other tools • Aircrack http://www.aircrack-ng.org/ • Kismac / KisMAC http://www.kismetwireless.net/ • Wireshark http://www.wireshark.org/ • Ettercap http://ettercap.sourceforge.net/ • Pineapple http://hakshop.com/products/wifi-pineapple

34. Questions? Closing comments (if any)