WiFi security self-defense

$whoami

Igor Tarpan
2009 – 2013: Military Academy “Alexandru cel Bun” Chisinau
2013 – 2017: Networking team National Army Server/Service team National Army Security team National Army
2017 – Present : Information Security Engineer at Starlab

WiFi protocol (IEEE 802.11)

b,g,n

2.4 GHz up to 600 Mbit/s

a,ac

5 GHz up to 3466 Mbit/s

WiFi deffence

Protocols

WEP
WPA/WPA2
Authetntication: PSK / EAP
WPS
Chipher: AES, TKIP
Aditional Techincs:

Hide SSID
MAC addres filtering
IEEE 802.1X Authentication

WEP attack !

WEP Security

10 000 broadcast packets what's all what I need !
Type (ARP,ICMP, IPv6-NDNP)
Fragmentation frame attack

Only my granny WEP

WPS Security

8 digits pin = 100 000 000
Last simbol is checksum
Remain 7 digits pin = 10 000 000
COOL !
M4, M6 and EAP-NACK packets
1 part = 4 digits (10 000)
2 part = 3 digits (1000)
11 000 < 100 000 000

IEEE 802.1X

Typical authentication progression

- Initialization

- Initiation

- Negotiation

- Authentication

IEEE 802.1X

Typical authentication progression

- Initialization

- Initiation

- Negotiation

- Authentication

Demo Wigle

wigle.net

WPA/WPA2 hacking

WPA / WPA 2

Home of office use
- PSK (AES or TKIP)
- AES international cryptography standard
- TKIP (use pack to pack encryption)

Company or industrial

EAP (Extensible Authentication Protocol

```
EAP Transport Layer Security
```
```
EAP-MD5
```
```
EAP Protected One-Time Password
```
```
EAP Pre-Shared Key
```
```
EAP Tunneled Transport Layer Security
```
```
EAP Internet Key Exchange
```

Password cracking

Top 100 passwords
Top 1000 passwords
Top 10 000 passwords
Top 99.99 passwords
…

Password Min 8 Max 63

Password pattern

Name+(2-4)
Lastname+(2-4)
name+(2-4)
lastname+(2-4)
Nr.tel+name
Nr.tel
Company+(2-4)
Company+(2-4)

Demo password generation

Tool Mentalist and deauth

How to protect ?

Use hard password (I know you will not)
Make misspelling in your password
Iggor
Igariok
Tarrpan
Gromeara
Anndreii

* Separate networks

WiFi Evil Twin

Ewill twin attack

Tool fluxion

How to protect ?

Open WIFI

Park WIFI
Cafe WIFI
Hotels WIFI
Airport WIFI
University /School WIFI
Operators WIFI
etc...

How to find ?

Wiredriving

WiGLE
https://wigle.net
WiGLE Android

Demo Wigle

wigle.net and tool mdk3

How to protect ?

Karma attack

How Karma attack work

Hey Internet FREE ?

Hey Park WIFI ?

Hey Star Kebab Free WIFI ?

Hey Internet gratis ?

Hey Restaurant Codru ?

Hey Guest WIFI ?

How Karma attack work

I am Internet FREE !

I am Park WIFI !

I am Star Kebab Free WIFI !

I am Internet gratis !

I am Restaurant Codru !

I am Guest WIFI !

Demo Mana toolkit

Tool mana toolkit

How to protect ?

At the end

Use only WPA2
Do not connect to open wifi
Turn off WIFI card when you not use it
Disable auto connect to WIFI networks
Beware strange messages in browser
Use VPN (buy or create your own)

I am a hacker !!!

"With great power comes great responsibility"

Questions ?

Contacts:
Facebook: Igor Tarpan
e-mail: hi@tigorv.com , itarpan@starlab.md