RU124102U1 - VULNERABILITY IDENTIFICATION DEVICE IN WIRELESS NETWORK TYPE WI-FI - Google Patents

Abstract

A vulnerability detection device in Wi-Fi-type wireless networks, comprising a wireless interface unit, the output of which is connected to the input of the network inventory unit, a network traffic capture unit, the first input of which is connected to the first output of the network inventory unit, and the output is connected to the input of the network traffic analysis unit , the output of the network traffic analysis block is connected to the first input of the memory block, the output of which is connected to the first input of the attack protocol authentication block, the output of the attack protocol authentication block with connected to the first input of the display unit, the second input of which is connected to the fifth output of the control unit, the first output of which is connected to the input of the packet generation unit, the output of the package generation unit is connected to the input of the wireless interface unit, the input of the control unit is connected to the second output of the network inventory unit, the second , the third and fourth outputs of the control unit are connected to the second inputs of the network traffic capture unit, the memory unit and the block of attacks on authentication protocols, respectively, while the control unit It sends a command to the packet generation unit to generate traffic to the network using the WEP encryption protocol, selects the network whose traffic will be captured in the network traffic capture unit, gives commands to read / write to the memory block, and selects the type of attack depending on the encryption protocol used , and also redirects information received in the network inventory unit to the display unit.

Description

The utility model relates to wireless technologies, and more specifically to identifying vulnerabilities in wireless networks such as Wi-Fi and solves the problem of identifying vulnerabilities in authentication protocols of Wi-Fi networks.

Wireless technologies are becoming increasingly indispensable in modern human life every year. This is primarily due to the ever-increasing requirements for employee mobility, which directly affects the speed of decision-making on issues important to the company.

With many advantages of wireless data transmission technologies, there is one significant minus: an open information transfer medium, which leads to the possibility of unimpeded interception of encoded streams transmitted over the network. An increase in the share of information transmitted over wireless channels entails an increase in the share of attacks on Wi-Fi networks. It is for this reason that the issue of protecting information when transmitting it over the air is so important. But not only protection is important, but also confirmation that the wireless network through which data is transmitted is actually safe and meets the security requirements for it. To determine this, it is necessary to conduct an audit of the security of the wireless network, identifying possible vulnerabilities that could be used for unauthorized access to the network.

The main vulnerabilities of Wi-Fi networks include vulnerabilities associated with the use of weak encryption protocols such as WEP, as well as vulnerabilities associated with the use of simple passwords for more modern encryption protocols WPA / WPA2.

The prior art device for detecting network vulnerabilities [1], containing the input module network parameter module scanner network and report module.

The disadvantages of this device are limited functionality, which consists in the inability to determine the vulnerabilities of authentication protocols Wi-Fi networks.

The prior art also known a system for intrusion detection and security audit of a wireless network [2], which includes many network monitoring applications installed on many wireless devices, many wireless access points, secure channels for communication between many wireless devices and many wireless points access, decision server for collecting data on network events, for sorting data on network events to normal and abnormal, for transmitting decision data to hell server active feedback based on the processing of normal and abnormal data and for receiving status data from the adaptive feedback server, a fuzzy association server that includes an adaptive learning system for detecting anomalous events and preventing similar anomalous events.

The disadvantages of this system are limited functionality, which consists in the inability to determine the vulnerabilities of authentication protocols Wi-Fi networks.

The technical result, which the utility model aims to achieve, is to expand the functionality of vulnerability detection devices in Wi-Fi-type wireless networks by identifying vulnerabilities in Wi-Fi authentication protocols.

The technical result is achieved due to the fact that the device for detecting vulnerabilities in wireless networks such as Wi-Fi contains a wireless interface unit, the output of which is connected to the input of the network inventory unit, a network traffic capture unit, the first input of which is connected to the first output of the network inventory unit, and the output connected to the input of the network traffic analysis block, the output of the network traffic analysis block is connected to the first input of the memory block, the output of which is connected to the first input of the block of attacks on authentication protocols, the output is bl An attack on authentication protocols is connected to the first input of the display unit, the second input of which is connected to the fifth output of the control unit, the first output of which is connected to the input of the packet generation unit, the output of the packet generation unit is connected to the input of the wireless interface unit, the input of the control unit is connected to the second the output of the network inventory unit, the second, third and fourth outputs of the control unit are connected to the second inputs of the network traffic capture unit, the memory unit and the block for conducting attacks on authentication protocols display accordingly, while the control unit instructs the packet generation unit to generate traffic to the network using the WEP encryption protocol, selects the network whose traffic will be captured in the network traffic capture unit, gives commands to read / write to the memory block, and selects the type attacks depending on the encryption protocol used, and also redirects information received in the network inventory block to the indication block.

The figure 1 shows a wireless network in infrastructure mode.

Figure 2 shows the main types of authentication protocols used in Wi-Fi networks.

The figure 3 shows a structural diagram of a device for identifying vulnerabilities in wireless networks such as Wi-Fi.

Figure 4 shows a block diagram of a wireless interface unit.

The figure 5 shows the structural diagram of the block conducting attacks.

Figure 1 shows a typical Wi-Fi network configuration. The network operates in infrastructure mode. Communication between client computers provides an access point that can be thought of as a wireless switch. Client stations do not communicate directly with one another, all their interaction goes through the access point. A Wi-Fi network in this mode is of most interest to the intruder, since this mode is most often used to deploy a corporate network, and a large number of client stations are connected to the access point. In the infrastructure of the corporate network, data warehouses and other servers can be deployed on which information of commercial value is organized.

Figure 2 shows the main types of authentication protocols.

Open authentication consists in the fact that the workstation makes an authentication request in which only the MAC address of the client is present. The access point responds either with a denial or with authentication confirmation. The decision is made based on MAC address filtering. This type of authentication is the most unsafe among others, since to connect to such a network you need to know only one of the MAC addresses allowed in the network, finding them is not a difficult task for an attacker [3].

For authentication with a shared key, you must configure a static encryption key for the WEP algorithm. The client makes a request from the access point for authentication, for which it receives a confirmation that contains 128 bytes of random information. The station encrypts the received data with the WEP algorithm (bitwise addition modulo 2 of the message data with the key sequence is performed) and sends the encrypted text along with the association request. The access point decrypts the text and compares it with the source data. In case of coincidence, an association confirmation is sent, and the client is considered connected to the network. Shared-key authentication is currently unreliable in terms of security, as it uses a vulnerable WEP encryption algorithm. Currently, there are a sufficient number of ways to carry out attacks on the WEP algorithm, which allow finding the key used in such a network in a short time. Among the existing attacks, the most effective statistical attacks of PTW and FMS can be distinguished [4].

When authenticating with a Pre-Shared Key, a key phrase is used to generate network keys and to enter the network. This type of authentication is secure provided that a key of sufficient length and complexity is used.

In the case of authentication using a RADIUS server (IEEE 802.1x), the authentication task of the connected client rests with this server. This type of authentication is implemented in many network environments that require a high level of protection.

The vulnerability detection device in wireless networks such as Wi-Fi (figure 3) works as follows.

Signals from networks of available access points are fed to the input of the wireless interface unit. After receiving and processing (analog-to-digital conversion), signals from access points are fed to the input of the network inventory unit, whose task is to build a list of available wireless networks and determine their parameters (ESSID, MAC address of the access point, encryption protocol used). Further, upon a command from the control unit, the network traffic capture unit captures the network traffic of the access point that is selected by the control unit. The captured traffic is analyzed in the network traffic analysis unit, in which unnecessary information is filtered out and only that information is needed to carry out attacks on authentication protocols. Data from the output of the network traffic analysis block is sent to the memory block. Depending on the authentication protocol used, the control unit selects the type of attack that is most suitable for the authentication protocol used. The selected attack is carried out in the block of attacks on authentication protocols over the wireless network traffic stored in the memory block. The purpose of the attack is to determine the encryption key used in the investigated wireless network. To display information about wireless networks and the keys found to them, an indication unit is used. If the wireless network uses the WEP encryption protocol to accelerate the cracking of the encryption key used in the studied wireless network, the packet generating unit implements the traffic into the wireless network.

The wireless interface unit (figure 4) consists of a series-connected antenna, transceiver, DAC / ADC and controller. This unit carries out reception and analog-to-digital conversion of Wi-Fi network signals, as well as digital-to-analog conversion and data transmission, intended for implementation in a wireless network in order to accelerate the cracking of the encryption key. The controller is designed to interact with the wireless interface unit with other units of the device.

The network inventory unit determines the parameters of available access point networks, such as the ESSID network identifier, the access point MAC address, the encryption protocol used (WEP, WPA / WPA2) and transmits information about them to the control unit input.

The control unit receives data on available wireless networks and redirects them to the second input of the display unit. In addition, the control unit analyzes wireless networks for encryption and, if the network under study uses it, the control unit instructs the network traffic capture unit to start recording the traffic of this wireless network. If there are several networks that use encryption, network traffic is captured one at a time.

The network traffic analysis unit performs the following functions:

- retrieves packets that are of interest for breaking the encryption key;

- Deletes obviously “uninteresting” packets (for example, the size of which is smaller than the IEEE 802.11 standard header).

The block for conducting attacks on authentication protocols (an example of its implementation is shown in Fig. 5) carries out an attack on the data accumulated in the memory block. Depending on the encryption protocol used, using the demultiplexer, the data from the output of the memory block is transmitted to one or another block of the attack. The choice of this or that type of attack is carried out by the control unit, which sends signals to the control inputs of the demultiplexer. An attack on the WPA / WPA2 protocol is possible only by either enumerating passwords in the dictionary or by using the exhaustive search method. When using the WEP encryption protocol, statistical attacks such as PTW and FMS are used. In order to reduce the time of hacking, the implementation of traffic in a wireless network using the WEP encryption protocol is used. To do this, from the first output of the monitoring and control unit, a command is sent to the input of the packet generation block, forcing this block to generate the necessary traffic, for example, ARP packets. This signal contains information about the MAC address of the access point in the network of which it is planned to implement ARP packets.

The display unit displays data on networks determined using the network inventory unit, and also in case of a successful attack, the keys used in the studied wireless networks. Based on the results of a study of available wireless networks, a conclusion is made about their security. So, insecure (having vulnerabilities) networks are those that use open authentication and shared key authentication (WEP), as well as those networks in which when using WPA / WPA2, a simple password is set that was selected during the attack on the network, using such a password. Found wireless network passwords using WEP and WPA / WPA2 encryption protocols are displayed by the display unit.

Network inventory, network traffic capture, network traffic analysis, packet generation blocks can be implemented on the Xilinx Spartan 3 series FPGAs, and control and attack blocks on authentication protocols can be implemented on Virtex 6. Atheros wireless adapter can be used as a wireless interface unit.

1. RU 2005133198 A, TRASTRAVE CORPORATION, 10.06.2006

2. US 20050037733 A1, 3E Technologies, 02.17.2005

3. Vladimirov A.A., Gavrilenko K.V., Mikhailovsky A.A. Wi-fu: “combat” methods of hacking and protecting wireless networks. - M.: NT Press, 2005 .-- 464 p.

4. Beettau A., Handley M., Lucky D., The Final Nail in WEP's Coffin. - 2006. [Electronic resource]. - Access mode: http://tapir.cs.ucl.ac.uk/bittau-wep.pdf). free. - Zagl. from the screen. - Yaz. English

Claims (1)

A Wi-Fi-type vulnerability detection device containing a wireless interface unit, the output of which is connected to the input of the network inventory unit, a network traffic capture unit, the first input of which is connected to the first output of the network inventory unit, and the output is connected to the input of the network traffic analysis unit , the output of the network traffic analysis block is connected to the first input of the memory block, the output of which is connected to the first input of the attack protocol authentication block, the output of the attack protocol authentication block with connected to the first input of the display unit, the second input of which is connected to the fifth output of the control unit, the first output of which is connected to the input of the packet generation unit, the output of the package generation unit is connected to the input of the wireless interface unit, the input of the control unit is connected to the second output of the network inventory unit, the second , the third and fourth outputs of the control unit are connected to the second inputs of the network traffic capture unit, the memory unit and the block for conducting attacks on authentication protocols, respectively, while the control unit It sends a command to the packet generation unit to generate traffic to the network using the WEP encryption protocol, selects the network whose traffic will be captured in the network traffic capture unit, gives commands to read / write to the memory block, and selects the type of attack depending on the encryption protocol used , and also redirects information received in the network inventory unit to the display unit.

Images