Wi-Fi Security – Monitoring Hacking Attempts

Wired Ethernet is no longer the best option for many enterprises. The preferred network access technology for users and endpoints is now IEEE 802.11 Wi-Fi. Compared to conventional LANs, wireless LANs have many benefits. They can lower ownership costs and are dependable and adaptable.

Background

WLANs provide simple installation, mobility so users are not restricted to one place, and scalability. Security, meanwhile, is a significant drawback that comes along with the benefits. WLAN security is a daunting task due to the open-ended nature of Wi-Fi and the confounding variety of traditional and contemporary authentication, access control, and encryption solutions. Many companies also neglect to conduct a complete risk analysis, which prevents the identification and remediation of those risks. Attacks on wireless networks are frequent as a result of these security weaknesses and how simple it is to take advantage of them.

Importance of Wi-Fi Security

Previously, Wi-Fi access required a fee, but nowadays, free WiFi is something many people take for granted. Visitors increasingly anticipate free WiFi whether they visit a hotel, coffee shop, bar, retail location, or restaurant. Free WiFi availability is a common deciding factor when deciding whether to utilize a specific institution, but connection quality is also increasingly important. Many customers now prefer businesses that provide secure WiFi access due to the sharp increase in cyberattacks made possible by unsecured public WiFi networks, as well as the widespread media warnings about WiFi threats. Data theft may result from threats to WLAN cybersecurity. Security teams have placed safeguards in place to prevent attempts to read messages sent or received over wireless mediums and gather sensitive data, such as a person’s personal information, login passwords, or company data.

Common Wireless Vulnerabilities

It is important to look at some of the typical wireless network vulnerabilities that can be used to eavesdrop on traffic, infect users with malware, and steal sensitive data before discussing some of the most prevalent wireless attacks.

• Use of Default SSIDs and Passwords: SSID and password defaults are included with WiFi access points when they are sold, but far too often, these settings are not altered. Because of this, it is simple for an attacker to get in and take over the router, modify the firmware or settings, install malicious scripts, or even change the DNS server so that all traffic is routed to an attacker-owned IP. To prevent anyone within the signal’s range from connecting and sniffing traffic, default passwords must be modified.
• Use of WEP Protocol: The first protocol to encrypt wireless traffic was the Wired Equivalent Privacy (WEP) protocol. Although WEP’s name suggests that it was designed to make wireless networks as secure as their wired counterparts, WEP wireless networks are not inherently secure. The secure RC4 cipher, on which WEP is built, is used. The implementation of RC4 in WEP is the issue. Reusing keys is never a good idea, however, WEP permits the usage of initialization vectors. This makes it simple for an attacker to break the encryption. WEP is not secure at all because of numerous other flaws that have been found. Many organizations continue to use WEP despite the fact that it is no longer secure and that there are considerably more secure wireless encryption methods to utilize.
• WPA2 Krack Vulnerability: Key Reinstallation Attack, often known as KRACK, is a vulnerability that can be used in a man-in-the-middle attack to steal sensitive data transferred via a WPA-encrypted WiFi connection. An attacker might eavesdrop on communications, and gain banking credentials, passwords, and credit card information by using the WPA weakness.
• NetSpectre – Remote Spectre Exploit: A vulnerability known as Spectre affects branch prediction microprocessors. An attacker might take advantage of the flaw to gain access to certain virtual memory locations and obtain sensitive data. An attacker would first need to persuade a victim to download and run malicious code or to visit a website where JavaScript is run in the browser in order to exploit the bug.

Types of Wireless Network Attacks

• IP and MAC spoofing: Bad actors can use tools to impersonate or “spoof” trusted devices if they are able to connect to the corporate WLAN successfully. They can do this by altering an allow listed device’s MAC address or changing the source IP address in the packet header. Receiving devices can unintentionally accept the spoof communications in return. Man-in-the-middle attacks and DDoS botnets are two of the most often used spoofing techniques.
• DNS cache spoofing/poisoning: In order to spoof the DNS server that other connected clients use, an unauthorized device is placed on the WLAN. This practice is known as DNS spoofing. Users and devices that try to access a reliable remote resource, like a website, are then redirected to a malicious page by the spoof DNS server.
• Rogue/evil twin access points (APs): These happen when malicious parties set up a wireless AP that makes use of a service set identity that looks alike or similar (SSID). Unaware users connect to the malicious device, allowing traffic to be recorded, monitored, or even rerouted to malicious websites.
• War driving: War drivers look to seek open or vulnerable WLANs to utilize for free internet access when WLAN signals spread outside of corporate buildings and into public locations. This practice is known as piggybacking. War driving can also be used by criminals for more malicious purposes, such as trying to locate and steal confidential corporate information.

Preventing and Monitoring Wifi Hacking Attempts

• Find out what the highest encryption level can be used on production devices.
• Use 802.1x authentication techniques instead of PSKs whenever possible.
• Give visitors internet-only access as their only option.
• Put in place network- and device-based security measures such as firewalls, intrusion detection systems, and antivirus/malware protection.
• Maintain security patches for wireless APs and controllers on a regular basis.
• Physically secure Wi-Fi APs to prevent tampering.
• Perform wireless WLAN scans to find rogue APs.
• To help enforce correct usage and stop password sharing, create WLAN usage policies.