Wireless Attack and Defense data transmitted in the air

Author: Zhang Wei, Zhongguancun online
Page 1: Common Intrusion Methods

When I tried a wireless router at home two days ago, I suddenly found that there were more and more neighbors using wireless networks. However, most users were not encrypted, and the SSID of many machines was not modified, looking at D-LINK, mesh, TP-LINK all kinds of brands are everything. Of course, some neighbors still encrypt the network. One of them is the "ji de jia mi" SSID, which impressed me.

There is no doubt about the mobility and flexibility of wireless networks. However, from a security perspective, users' networks also form a broadcast source. Without any security measures, others will easily find and connect to your network. When hackers access the Internet for free, some important information and privacy on your computer will be stolen, and the neighbor's SSID "ji de jia mi" (remember to encrypt) we are also reminding you in good faith. However, objectively speaking, even if encryption measures are adopted, wireless networks are still not absolutely secure. wireless technologies are advancing and intrusion technologies and tools are also being followed up. So how can we effectively protect the spread of data in the air at this stage? In this article, we will introduce some preventive measures to some typical intrusion methods.

Several typical wireless intrusion methods:

Encryption attacks: This is a brute-force cracking method. Currently, encryption attacks are mainly targeted at WEP. Due to the defects of WEP encryption, intruders will use corresponding tools to detect WEP Security protocol vulnerabilities, the attack is then cracked through packet capture analysis and other means. This process can be completed within several hours.

Wireless phishing: similar to the popular online phishing method, hackers first set up a disguised wireless access device on a certain attempt network or in a public location, in this way, the victim may mistakenly assume that there is a wireless network. Especially in public scenarios, when the signal strength of disguised wireless devices is very good, users are most likely to be deceived. At this point, hackers can wait to receive the password entered by the victim, or enter the virus code into the victim's computer. Although this is not a real intrusion, it is better than the "brute force" attack described above and has more serious consequences.

Malicious spoofing: a disguised wireless access device is set up by a hacker. If the victim wants to connect to the server, the fake server will send a response message to connect the victim to a fake server. This method is similar to the aforementioned "phishing attack.

In addition, if your wireless network is fully open, intruders can access the Internet for free, or attack third parties and explore other networks through your network.

Page 1: Common Intrusion tools

Anyone interested in wireless security may know that there are a lot of brute-force cracking tools available now, from detection, listening to final cracking, are we only waiting for threats from these cracking tools as common users? Below I will list several popular cracking tools and methods. I hope you can take corresponding measures to protect them while learning about these tools.

Network Stumbler: A common software used in wireless Network testing. This Windows-based tool can easily discover wireless signals broadcast within a certain range, it can also determine which signals or noise information can be used for site measurement. For many home users, this software can be used to test the optimal placement of wireless routers. for users with bad intentions, Network Stumbler is used as a tool to capture the signal source. Therefore, I suggest that you disable your SSID broadcast when network encryption is enabled.

Kismet: a stronger Network search tool. Network Stumbler cannot find wireless sources that Disable SSID broadcast, but Kismet can, therefore, we can only rely on more advanced and more complex security settings to avoid this potential risk.

After a target is searched and determined, intruders use some brute-force cracking tools to perform illegal links, including Airsnort, Cowpatty, and Ethereal.

Airsnort: a tool used to sniff and crack the WEP Key. This tool will capture a large number of captured packets to crack the WEP Key. However, in terms of the security technology of wireless products, WEP is rarely used, but friends who bought or still use WEP encryption earlier have noticed that, to avoid such intrusion, the most effective method is to use a 128-bit encryption key instead of a 40-bit WEP encryption key, which takes a longer time to crack. Of course, using more advanced WPA encryption is also very effective.

Page 5: Wireless, shared-based

CowPatty: this tool is mainly used to crack the WPA-PSK by simply trying a variety of different options in an article to see if a piece is exactly the same as a pre-shared key. Therefore, friends who care about network security can set complicated passwords to avoid such intrusion, or try to delay the time for intruders to guess.

Ethereal: Ethereal can scan wireless and Ethernet information, and has a very strong filtering capability. It can also sniff out 802.11 management information or be used as a sniffing non-broadcast SSID. It is actually very easy to prevent Ethereal. As long as WPA2 is used, hackers using the AES algorithm are unlikely to intrude into the system.

Simply put, disabling SSID broadcast or using advanced encryption (WEP encryption is not recommended for users currently) can deny most illegal intruders. In addition, disabling DHCP and SNMP settings, especially DHCP, makes sense for wireless networks. After DHCP is disabled, hackers have to crack your IP address, making it more difficult to intrude.

In addition to protection at the technical level, it is also a method for ordinary home users to choose reasonable placement points for wireless routes. Because most wireless security problems are caused by access points not in a closed environment, reasonable placement can limit the transmission distance of signals outside the coverage area, therefore, a location like a window sill is not suitable for wireless routers. (Enterprise-level users can also use this method to divide networks between departments to reduce management difficulty)

Conclusion:

With the popularity of wireless applications, its security is a topic that we have to deal with. However, I believe that this topic does not have to be overly exaggerated, because any network may have vulnerabilities, these should not be the reason for us to abandon it, and from the perspective of actual application, wireless is still very powerful in terms of overall security, as long as the configuration and use are reasonable, there will be no problems. In addition, friends who are happy to intrude into others' wireless networks do not need to do so. Now, free wireless is available in many public places, as far as I know, there are also many online alliances that advocate "wireless sharing" to facilitate sharing and communication between wireless enthusiasts.