Page 259 - StudyBook.pdf

Communication Security: Wireless • Chapter 4 243

Any authentication information that is broadcast can often be replayed to
services requiring authentication (NT Domain,WEP authentication, and
so on) to access resources.

The use of VPNs, SSL, and SSH helps protect against wireless interception.
Due to the design of TCP/IP, there is little that you can do to prevent
MAC/IP address spoofing. Static definition of MAC address tables can
prevent this type of attack. However, due to significant overhead in
management, this is rarely implemented.

Wireless network authentication can be easily spoofed by simply replaying
another node’s authentication back to the AP when attempting to connect
to the network.

Many wireless equipment providers allow for end users to redefine the
MAC address for their cards through the configuration utilities that come
with the equipment.
External two-factor authentication such as RADIUS or SecurID should
be implemented to additionally restrict access requiring strong
authentication to access the wireless resources.
Due to the design of TCP/IP, some spoof attacks allow for attackers to
hijack or take over network connections established for other resources on
the wireless network.
If an attacker hijacks the AP, all traffic from the wireless network gets
routed through the attacker, so the attacker can then identify passwords
and other information that other users are attempting to use on valid
network hosts.
Many users are susceptible to these MITM attacks, often entering their
authentication information even after receiving many notifications that
SSL or other keys are not what they should be.
Rogue APs can assist the attacker by allowing remote access from wired or
wireless networks.These attacks are often overlooked as just faults in the
user’s machine, allowing attackers to continue hijacking connections with
little fear of being noticed.

Many wireless networks that use the same frequency within a small space
can easily cause network disruptions and even DoS for valid network
users.

www.syngress.com