無線區域網路網路安全現況報告人-drr.ppt

無線區域網路網路安全現況 報告人: 黃上峰 報告內容 Wireless Service Category WLAN Security History WLAN Attack conclusion Wireless Service Category WPAN : 10m, such as hands-free cell phone WLAN : 100m, such as laptop to broadband access WMAN : xx km, such as building-to-building WWAN : cell phones 802.11 Header 802.11 header : WLAN Security History (1/3) No Security : WLAN access control by MAC address WEP : only one 64/128 bit WEP key WLAN access control by MAC address. All STA in the same WLAN use the same key. All STA in the same WLAN can capture each other packets. 802.1x : WLAN access control by RADIUS server. WEP 802.1x Security Header WLAN Security History (2/3) All STA in the same WLAN use the same group and uni-cast key. AP can change WEP key random or periodically. All STA in the same WLAN can capture each other packets if user can show WEP key real time. IPSec VPN : transport mode It is stronger than RC4 algorithm, but it is not popular. IPSec VPN tunnel is used for layer 3. WLAN Security History (3/3) WPA 1.0 : WPA or WPA-PSK TKIP + MIC algorithm All STA in the same WLAN use the same group key and different uni-cast key. AP can change group and uni-cast key random or periodically. TKIP security is still based on RC4 algorithm. WPA 2.0 (802.11i) : CCMP + MIC algorithm WPA 1.0 Security Header WPA 2.0 Security Header WLAN Attack 網卡位址偽裝(MAC Spoofing) 無線訊號干擾(RF Jamming) 中斷訊框攻擊(De-authentication) 雙面攻擊(Evil Twin Attack) 網卡或基地台弱點攻擊(Wireless Device Vulnerability) MAC Spoofing (1/2) MAC Spoofing (2/2) 困難點: AP無法主動判別此使用者此刻是否為合法者? AP無法主動判別合法者與駭客是否同時存在? 預防: 使用login認證機制，例如：RADIUS server WLAN採用加密模式保護 設定每個使用者存取權限，例如：使用時間限制、與頻寬限制 RF Jamming (1/3) 特定無線設備攻擊: RF Jamming (2/3) 全頻帶攻擊: 802.11b/g可以用11/13頻道，每個頻道佔5 MHz 802.11b/g訊號使用20 MHz，所以相鄰2個頻道到會被影響 RF Jamming (3/3) 困難點: 此種無線網路阻斷式攻擊，須配合無線訊號偵測器來確定干擾源位置 此類攻擊程式可隨時隨地發動干擾，受影響範圍取決於發射功率 2.4GHz有許多干擾源，例如：無線電話、藍芽、微波爐等，都容易相互干擾 De-authentication 困難點: 此種無線網路阻斷式攻擊，STA無法偵測出來 Evil Twin Attack (1/2) 冒充合法SSID引誘上網 Evil Twin Attack (1/2) 困難點: 駭客可以偽造SSID、BSSID(MAC a