KR20040094188A - Analysis System and Method for wireless LAN vulnerability - Google Patents

Abstract

PURPOSE: A system for analyzing wireless LAN vulnerability is provided to actively retrieve a part where vulnerability can occur from an AP(Access Point) and a wireless LAN card, and to collect responses of the AP and the wireless LAN card, thereby inspecting vulnerability of a wireless LAN. CONSTITUTION: An attack module(102) performs a DOS attack to analyze vulnerability as well as an attack on a wireless LAN card and an AP under a wireless LAN environment(1). A collection module(104) collects attack responses for the wireless LAN card and the AP by the attack from the attack module(102), or collects basic security vulnerable factors under the wireless LAN environment(1). An inspection module(106) checks whether the wireless LAN environment(1) is normal through the collected information, and diagnoses vulnerability of the wireless LAN.

Description

Analysis System and Method for wireless LAN vulnerability

The present invention relates to a WLAN vulnerability analysis system and method that may occur when using a wireless LAN. The present invention attacks an area where a vulnerability may occur in an access point (AP) and a wireless LAN card used in a wireless LAN environment, and accordingly It collects responses from AP and WLAN card to enable vulnerability inspection of WLAN.

Wireless LAN can access the network including the Internet even when it is not physically accessible to the network by wires, and can communicate with the same level as when using a wired network, and does not require the installation of a physical network cable. Due to these characteristics, it can reduce the time required to construct the network, and it is widely used due to the advantages such that the network can be used immediately by installing the AP even in a place where the network cannot be used, but various security vulnerabilities have been found. It is becoming.

In the wireless LAN system security solution that complies with the IEEE802.11b standard of the rapidly growing wireless LAN market, SSID (Sub System Identification) is the first network name that performs logical division in wireless LAN. It provides a level of access control. Since SSID is generally not very secure, it is dangerous to configure the network by itself.

The 802.11b standard, on the other hand, uses an optional encryption technique called Wired Equivalent Privacy (WEP). WEP is based on a symmetric algorithm that encrypts and decrypts data using the same keys and algorithms. This can prevent unauthorized users from accessing the network without the correct WEP key. However, this method also has a problem that it is likely to be breached if the primary key values are widely distributed.

The authentication protocol typically uses the Extensible Authentication Protocol (EAP) protocol. In the LAN section, the EAP packet is wrapped in the EAPOL (EAPOL) protocol and delivered to the intermediate bridge, and the bridge passes the EAP part of the EAPOL frame to the authentication server. do.

On the other hand, systems have been developed to enable the use of secure WLAN by detecting and analyzing security vulnerabilities of WLAN in advance. However, the technologies related to the conventional WLAN security vulnerability diagnosis have been limited to a method of monitoring and finding a problem by monitoring the WLAN. Therefore, there is a problem that the vulnerability related information needs to be found over a long time, and there is a problem that is difficult to cope with depending on the situation.

In addition, since only the information transmitted between the AP and the wireless LAN card is simply monitored and used as the basis for analysis, there are few types of vulnerabilities that can be found. When no information is transmitted between the AP and the wireless LAN card, the vulnerability cannot be diagnosed. There was a problem.

Accordingly, the present invention has been made to solve the above-described problems, an object of the present invention is to actively search for a part that can cause vulnerabilities in the AP and wireless LAN card using a wireless LAN, according to the AP and the wireless LAN card The response is collected to enable vulnerability inspection of the WLAN.

Another object of the present invention is a WLAN vulnerability diagnosis system performs a direct attack on the AP and WLAN card, collect the response information of the other AP and WLAN card to discover and report the security vulnerability of the WLAN system It is done.

1 is a block diagram of a WLAN vulnerability analysis system according to an embodiment of the present invention.

2 is a flowchart for checking a vulnerability by collecting information related to a basic vulnerability according to an embodiment of the present invention.

3 is a flowchart illustrating a SSID attack on an AP according to an embodiment of the present invention.

4 is a flowchart illustrating a flow of SSID modification attack according to an embodiment of the present invention.

5 is a flowchart illustrating an example of attempting a DOS attack in the WLAN vulnerability diagnosis system of the present invention.

6 is a flowchart illustrating a DOS attack through EAPOL-Logoff frame transmission in a WLAN DOS attack according to an embodiment of the present invention.

7 is a flowchart illustrating a DOS attack through EAP_Failure frame transmission in a WLAN DOS attack according to an embodiment of the present invention.

8 is a flowchart illustrating a DOS attack through EAPOL_Start frame transmission in a WLAN DOS attack according to an embodiment of the present invention.

9 is a flowchart illustrating a DOS attack through transmission of an EAP_Identifier frame in a WLAN DOS attack according to an embodiment of the present invention.

In one aspect of the present invention for achieving the above object is a WLAN vulnerability diagnosis system used in a wireless LAN environment comprising a wireless LAN user computer equipped with a wireless LAN card and the AP to enable a wired network connection, An attack module for performing a DOS attack to analyze an attack and a vulnerability of a WLAN card and an AP in a WLAN environment, and collect an attack response to the WLAN card and the AP by an attack from the attack module, or WLAN vulnerability diagnosis system including a collection module for collecting basic security vulnerabilities of the environment, and a inspection module for diagnosing the vulnerability of the WLAN by checking whether the WLAN environment is normal through information collected from the collection module. To provide.

On the other hand, basic security vulnerabilities include SSID broadcasting, whether to use WEP, whether to connect without WEP key, whether to obtain IP from DHCP server of AP, whether to access AP in administrator mode via WLAN, SNMP vulnerability and SNMP. It may be at least one of DOS vulnerability attacks.

In addition, the DOS attack is an attack for analyzing a vulnerability against 802.1x, and may be an attack that detects a vulnerability problem of a system by sending an EAPOL-Logoff, EAP Failure, EAPOL-Start, or EAP Identifier frame. Preferably, an attack that detects a system vulnerability problem by sending an EAPOL-Logoff, EAP Failure, EAPOL-Start, or EAP Identifier frame uses two WLAN cards to connect an EAP user to one WLAN card, and the other. The frame attack disguised as an AP is attempted to the user by using the WLAN card, and the user's connection to the EAP is disconnected to determine whether there is a vulnerability.

In addition, one of the attacks on the WLAN card and the AP may be an attack on the SSID, and may perform an SSID attack using a basic SSID list, a user set SSID, and modifications thereof. On the other hand, the attack using the modification is an SSID connection attack that converts the input SSID consisting of all alphabets or numbers into uppercase letters, an SSID connection attack that converts uppercase and lowercase letters in the alphabet, and converts the SSID into a repeated form several times. At least one of the SSID connection attack, the SSID connection attack converted to the form of adding one or more digits, and the SSID connection attack converted to the addition of special characters is possible.

Another aspect of the present invention is a WLAN vulnerability diagnosis method used in a WLAN environment including a WLAN user computer equipped with a WLAN card and an AP that enables a wired network connection. And collecting information related to the basic vulnerability for the AP and checking the vulnerability, and performing an SSID attack using a basic SSID list, a user-configured SSID, and modifications thereof as an attack on the WLAN card and the SSID for the AP. Providing a WLAN vulnerability diagnosis method comprising: checking for vulnerabilities; and checking whether the AP and the WLAN card interfere with normal activities by attempting a DOS attack to analyze vulnerabilities for 802.1x. do.

Hereinafter, a WLAN vulnerability analysis method according to an embodiment of the present invention will be described with reference to the accompanying drawings. However, embodiments of the present invention may be modified in various forms, and the scope of the present invention should not be construed as being limited by the embodiments described below. Embodiments of the present invention are provided to more fully describe the present invention to those skilled in the art.

1 is a block diagram of a WLAN vulnerability analysis system 100 according to an embodiment of the present invention. As shown in FIG. 1, the WLAN environment 1 includes an AP that enables a wired network connection with a WLAN user computer equipped with a WLAN card, and according to the 802.11b standard, WEP (Wired Equivalent Privacy) Communication is performed between the AP and the WLAN user using an optional encryption method called. WEP is based on a symmetric algorithm that encrypts and decrypts data using the same key and algorithm, preventing unauthorized users from accessing the network without the correct WEP key. Each AP is connected to the WWW server through a hub.

The WLAN vulnerability analysis system 100 used in the WLAN environment as described above includes an attack module 102 for performing an attack on the system, a collection module 104 for collecting a response to the attack, and basic vulnerability, and collecting information. An inspection module 106 for inspecting may be included, and a result output module 108 for outputting a result may be further included. That is, the function of the WLAN vulnerability analysis system 100 collects information from APs and WLAN cards constituting the WLAN environment, performs a direct attack, and collects responses of the AP and WLAN cards thereto. The result of checking the information will be printed / reported.

The attack performed by the attack module 102 is a normal activity on the system by attempting a direct attack on the WLAN card and AP such as SSID cracking such as a password and a DOS (Denial of Service) attack to analyze the vulnerability for 802.1x. See if it interferes with it. That is, a cracking attack and a DOS attack are performed on SSID and 802.1x, which are vulnerable parts of AP and WLAN card, respectively. DOS attacks detect vulnerabilities in the system by sending EAPOL-Logoff, EAP Failure, EAPOL-Start, and EAP Identifier frames.

The collecting module 104 collects the result of the attack response, for example, in the WLAN card and the AP by the basic security weakness (threatening) element and the attack module 102. Examples of basic security vulnerabilities include SSID broadcasting, whether to use WEP, whether to connect without a WEP key, whether to obtain IP from the DHCP server of the AP, whether to connect to the administrator mode of the AP via WLAN, SNMP vulnerability, SNMP Collection of DOS attacks.

The inspection module 106 examines the information collected by the collection module 104 to determine whether the WLAN environment is normal, and performs a detection function that determines that the WLAN is vulnerable if it is not normal.

2 is a flowchart of vulnerability checking by collecting information related to a basic vulnerability according to a preferred embodiment of the present invention. Referring to FIG. 2, the basic vulnerability related information collecting step performs a search for each WLAN channel (eg, 14) (S101), and collects AP presence and AP related basic information in each channel. (S103). Next, the AP checks whether the AP exists in the channel (S105), and performs the next vulnerability check. That is, first, it is checked whether the wireless LAN uses WEP, which is a method for encrypting the user's APs (S107), and collects the WLAN packets and checks whether IP can be allocated by accessing DHCP (S109). On the other hand, in addition to the information shown in Figure 2 through the detection of the basic security threats to the WLAN system, SSID broadcasting, whether access is possible without the WEP key, whether access in the administrator mode of the AP through the WLAN, SNMP vulnerability check, SNMP DOS attack items can be detected and configured to identify threats.

3 is a flowchart for explaining an SSID attack on an AP. Referring to FIG. 3, the SSID attack method first obtains a basic SSID list necessary for an attack from a basic SSID storage location (S301), and receives a user-configured SSID that may be used in an attacking WLAN environment (S303). The SSID access attack is attempted using the imported basic SSID list (S305). The specific attack method is not particularly limited and various methods known to those skilled in the art are possible. In addition, if the attack is successful, it is obvious that it is determined to be vulnerable to the basic SSID list access attack.

Next, an SSID access attack is attempted using the user-set SSID list input by the user (S307). If the attack is successful, the user is considered to be vulnerable to the SSID list access attack.

Next, the SSID access attack is attempted by modifying the basic SSID list (S309). Similarly, if the attack is successful, it is determined to be vulnerable to the SSID access attack that modified the default SSID list.

Next, the SSID access attack is attempted by modifying the user input SSID list input by the user (S311). If the attack is successful, it is determined that the user is vulnerable to the SSID access attack that modified the SSID list.

4 is a flowchart illustrating the flow of SSID modification attack. With reference to this, a connection attack performed by modifying a basic SSID list and a user-defined SSID can be used.

First, an SSID connection attack is attempted by converting an input SSID composed of alphabets or numbers into uppercase alphabetic characters (S501).

Next, an SSID connection attack is attempted by converting the input SSID composed of alphabets or numbers into a mixture of uppercase and lowercase alphabets (S503).

Next, an SSID connection attack is attempted by converting the SSID composed of the input alphabet or number into a form of repeated multiple times (S505).

Next, an SSID connection attack is attempted by converting the input SSID composed of alphabets or numbers into a form of appending a number (S507). Numbers are attacked by converting from one number appended to several numbers appended.

Next, an SSID connection attack is attempted by converting the SSID composed of the input alphabet or number into a form of appending a special character (S309). Special characters are attacked starting with the conversion of one special character and then converting them to the addition of several special characters. Special characters refer to characters other than alphabets and numbers that can be input from the computer's keyboard.

5 is a flowchart illustrating an example of attempting a DOS attack in the WLAN vulnerability diagnosis system of the present invention. This attack can be used to find out if it interferes with the normal activities of the AP and WLAN card. To analyze vulnerabilities for 802.1x, try a Denial of Service (DOS) attack to see if your system is preventing normal activity. For DOS attacks, EAPOL-Logoff attack (S701), EAP Failure attack (S703), EAPOL-Start attack (S705), and EAP Identifier frame attack (S707) are sent to detect the problem of the system.

6 is a diagram illustrating an EAPOL-Logoff attack among WLAN DOS attacks. Referring to FIG. 6, the step of attacking uses an EAP user access to one WLAN card using two WLAN cards (S801), and performs an EAPOL-Logoff frame attack disguised as an AP using another WLAN card. It attempts to the user (S803), checks whether the user connected to the EAP is disconnected (S805), and if it is disconnected, determines that there is a vulnerability to the EAPOL-Logff attack (S807). It is determined that the logoff attack is not vulnerable (S809).

7 is a diagram illustrating an EAP-Failure attack in a WLAN DOS attack. Referring to FIG. 7, the step of the attack attempts to access an EAP user with one WLAN card using two WLAN cards (S901), and an EAP-Failure attack disguised as an AP using another WLAN card. To the user (S903), examines whether the user's EAP connection failed (S905), and if that fails, determines that there is a vulnerability to the EAP-Failure attack (S907), and if successful, the EAP-Failure attack It is determined that it is not vulnerable (S909).

8 is a diagram illustrating an EAPOL-Start attack in a WLAN DOS attack. Referring to FIG. 8, the attack-based step attempts an EAPOL-Start attack disguised as a user with one WLAN card using two WLAN cards to the AP (S1001), and establishes an EAP connection to the AP with another WLAN card. Try (S1003). By checking whether the user's EAP connection failed (S1005), if it fails, it is determined that there is a vulnerability to the EAPOL-Start attack (S1007), and if successful, it is determined that the user is not vulnerable to the EAPOL-Start attack (S1009).

9 is a diagram illustrating an EAP-Identifier attack among WLAN DOS attacks.

Referring to FIG. 9, the attack-based step attempts an AP access attack disguised as a user with one WLAN card using two WLAN cards (S1101), and attempts an EAP access to an AP with another WLAN card ( S1103). By checking whether the user's EAP connection failed (S1105), if it fails, it is determined that there is a vulnerability to the EAP-Identifier attack (S1107), and if it is successful, it is determined that it is not vulnerable to the EAP-Identifier attack (S1109).

Various modifications of the present invention can be made without departing from the spirit or scope of the present invention. Accordingly, the foregoing description of embodiments in accordance with the present invention will be provided for purposes of illustration only, and not for the purpose of limiting the subject matter defined by the appended claims and their equivalents.

As described above, the security vulnerability diagnosis system in a wireless LAN according to the present invention prevents security incidents that may occur in a wireless LAN environment by diagnosing, analyzing, and reporting a security vulnerability that may occur in a wireless LAN environment. Has a useful effect. That is, by using the WLAN security vulnerability diagnosis system according to the present invention can find out the security vulnerabilities of the currently used WLAN environment to supplement them.

Claims (9)

In a WLAN vulnerability diagnosis system used in a WLAN environment including an AP that enables a wireless LAN user computer equipped with a WLAN card and a wired network connection, An attack module for performing a DOS attack for analyzing an attack and a vulnerability of a WLAN card and an AP in the WLAN environment; A collection module for collecting attack responses to the WLAN card and the AP by the attack from the attack module or collecting basic security vulnerabilities of the WLAN environment; And And a inspection module for diagnosing the vulnerability of the wireless LAN by checking whether the wireless LAN environment is normal through the information collected from the collection module. The method of claim 1, The basic security vulnerabilities include SSID broadcasting, whether to use WEP, whether to access without WEP key, whether to obtain IP from DHCP server of AP, whether to access AP in administrator mode via WLAN, SNMP vulnerability and SNMP DOS. WLAN vulnerability diagnosis system, characterized in that at least one of the attacks. The method of claim 1, The DOS attack is an attack for analyzing a vulnerability for 802.1x, and the WLAN vulnerability diagnosis system is characterized by an attack that detects a vulnerability problem of a system by sending an EAPOL-Logoff, EAP Failure, EAPOL-Start, or EAP Identifier frame. . The method of claim 1, The attack that detects a vulnerability problem of the system by sending the EAPOL-Logoff, EAP Failure, EAPOL-Start, and EAP Identifier frames, uses two WLAN cards to connect an EAP user to one WLAN card, and another WLAN. Wireless LAN vulnerability diagnosis system, characterized in that by attempting the frame attack disguised as an AP by using a card to the user, if the user connected to the EAP is disconnected and determined that the connection is broken. The method of claim 1, One of the attacks on the AP is an attack on the SSID, wherein the WLAN vulnerability diagnosis system uses an SSID list using a basic SSID list, a user-defined SSID, and modifications thereof. The method of claim 4, wherein Attacks using the above modifications include SSID connection attacks in which all SSIDs composed of input alphabets or numbers are converted to uppercase letters, SSID connection attacks in which uppercase and lowercase letters are mixed, and SSIDs converted into repeated forms of SSIDs. A WLAN vulnerability diagnosis system, characterized in that at least one of a connection attack, an SSID connection attack converted to a form of appending one or more numbers, and an SSID connection attack converted to a form of adding a special character. In a WLAN vulnerability diagnosis method used in a WLAN environment including an AP that enables a WLAN user computer equipped with a WLAN card and a wired network connection, Collecting vulnerability related information about the basic vulnerability of the WLAN card and the AP in the WLAN environment and inspecting the vulnerability; As an attack on the SSID against the WLAN card and the AP, performing an SSID attack using a basic SSID list, a user-configured SSID, and modifications thereof to check for vulnerabilities; And In order to analyze the vulnerability for 802.1x, attempting a DOS attack and checking whether it interferes with the normal activity of the AP and the WLAN card. The method of claim 7, wherein Attacks using the above modifications include SSID connection attacks in which all SSIDs composed of input alphabets or numbers are converted to uppercase letters, SSID connection attacks in which uppercase and lowercase letters are mixed, and SSIDs converted into repeated forms of SSIDs. A wireless LAN vulnerability diagnosis method comprising at least one of a connection attack, an SSID connection attack converted to one or more numbers, and an SSID connection attack converted to a special character. The method of claim 7, wherein The attack that detects a vulnerability problem of the system by sending the EAPOL-Logoff, EAP Failure, EAPOL-Start, and EAP Identifier frames, uses two WLAN cards to connect an EAP user to one WLAN card, and another WLAN. WLAN frame vulnerability diagnosis method characterized in that the user attempts the frame attack disguised as an AP using a card, and determines whether there is a vulnerability when the user connected to the EAP is disconnected.