Security Analysis of N encryption methods for Wi-Fi networks

With the increasing popularity of Wi-Fi, security issues have also been highlighted. 802.11 is a wireless LAN standard developed by IEEE. Wi-Fi is a commercial standard of 802.11. Due to the lack of mature security mechanisms in the early days of the Wi-Fi Alliance, the network hit flood occurs.
This document analyzes the security of MAC-bound wep wpa WPA2 and its Enterprise Edition. Due to the lack of mature security mechanisms in the early days of the Wi-Fi Alliance, the network hit flood occurs. How can we better encrypt our wireless network and make it difficult for network users to retreat? Here are some references for you.

1. Hide the SSID.
Prevent Unauthorized users from scanning your wireless network.
But it is easy to crack. As long as data passes through, some sniffing software can easily scan wireless networks without broadcasting and get your SSID and ap mac.
Therefore, it can only be used as an auxiliary means of wireless security.
Security level: Very low.

2. Modify the SSID
When you use wpa or wpa2 encryption, the modified SSID can effectively prevent brute-force cracking through the existing table.
The method used to crack wpa or wpa2 is to obtain the four handshake packets and then crack them violently. With the HASH table, the cracking speed can be hundreds of times higher. This HASH uses the SSID and password as variables. Many hackers have made common SSID and HASH table calculated by using a well-developed social engineering password, which can be downloaded online, and some are even free of charge. If your SSID is not in this column, there is no ready-made table. However, it takes more time to create a table than to create a dictionary to crack the table, so it is meaningless.
Security level: high (must be used with wpa wpa2 ).

3. Use MAC Filter
On the surface, it seems to be a perfect anti-fraud solution. However, you can forge your MAC to access the Internet. Easy to crack. In addition, MAC values are easily sniffed.
Security level: Very low.

4. Use wep Encryption
Easy to crack. Today, using wep encryption is basically the same as without encryption, and there is no security at all. Even complex passwords can be cracked within several minutes.
Security level: Very low.

5. Use wpa or wpa2 for personal Encryption
So far, there is only one method to crack: brute-force cracking. If you set a strong password, the probability of cracking is almost 0. In addition, select AES as the encryption algorithm.
Try to select wpa2 because wpa2 has better security than wpa. Wpa2 is the real 802.11i, while wpa is only draft 3, which has many shortcomings.
The speed of brute-force cracking is extremely low. Generally, there is only 10000 key/s. Even if the so-called GPU acceleration is adopted, the speed is only key/s. For complex password cracking times with 8-digit and letter characters, it takes! Even if we use 100 distributed servers, it will take 29 years!
Security level: relatively high.

Here, we should see that if you do not encrypt or use wep, it makes no sense even if you adopt 1, 2, and 3 methods. Cracking is a matter of minutes. However, if you only use wpa2 and the password is extremely complex, the cracking is calculated on a yearly basis.

Now I will introduce more advanced methods of wifi security.

1 Wpa2 Enterprise Edition
Wpa2 Enterprise Edition requires a radius dial-up server that provides 802.1x authentication.
In the Personal Edition, PMK = PSK and PSK are fixed. In subsequent communications, keys change, but the initial keys are fixed. This is the reason why the original four handshake packets can be cracked (the HASH mentioned above is the HASH generated by PSK, and there are other HASH calculations in the four handshakes ). In addition, PSK is unique throughout the WLAN. Once leaked, it has disastrous consequences. Generally, you need to reset the vro and all valid clients.
In Wpa2, obtaining PMK depends on 802.1x authentication results. If authentication fails, PMK cannot be obtained. The PMK obtained for each authentication is random. Therefore, the above brute-force cracking is meaningless here. Unless you first crack the authentication mechanism and get the user name and password.
Currently, 802.1x security is good. Generally, a better EAP can provide good security. The following are the most common EAP Methods: LEAP EAP-TLS EAP-TTLS PEAP. All EAP methods support two-way authentication to prevent man-in-the-middle attacks-because the customer needs to authenticate the server, and vice versa. Forged wireless access points cannot forge server-side security authentication.
Even if an account and password are leaked, only one illegal user can access the Internet. Cancel this account on the authentication server.

2. You are advised to change the vro logon password, and disable wireless network logon. The wireless router cannot be modified even if there is a network.

3. Enable the PPPOE server. You must use PPPOE for dial-up before you can access the vro and Internet.
PPPOE can effectively prevent ARP attacks and enhance the security of wireless networks. Even if a user attempts to crack a wireless password, it is meaningless. However, cracking PPPOE is not easy.
Through professional settings, PPPOE can be more secure. For example, specify the service name (ISP name), select CHAP only, and do not select PAP for plaintext transmission.

This is what I think of to make wireless networks more secure and its analysis. Relatively superficial. If you have any mistakes, please give an axe