full-disclosure - Wireless Security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1070037983.8646.27.camel@tantor.nuclearelephant.com>
From: jonathan at nuclearelephant.com (Jonathan A. Zdziarski)
Subject: Wireless Security

> You should be aware that MAC addresses can be forged as well.

I believe this also works (at least in Linux)

ifconfig wlan0 hw ether [new mac]

Tools like kismet make it all too easy to find a valid MAC address to
spoof on the network.

Application-Layer encryption is definitely the most secure method. 
EAP+Dynamic WEP keys is a significant enhancement, but still vulnerable
to session hijacking.  You may also consider using Token-based
authentication if you are going to run EAP (and to authenticate your
shells too).  RSA SecurID's ACE/Server will emulate a RADIUS server,
making it very useful for these types of authentication.  I'm sure
Cryptocard has something useful too.

What would be schweet is if you could use the SecurID token code (which
changes every 30 or 60 seconds) as a one-time pad for dynamic WEP key
changes.  Then you wouldn't have to pass WEP keys across the network
where they could be intercepted...and changing every 60 seconds would
make it virtually un-bruteable.

If you haven't read "Wireless Hacks" by O'Reilly yet, I strongly
recommend you grab a copy; it's an excellent little book.

http://www.amazon.com/exec/obidos/tg/detail/-/0596005598/qid=1070037607/sr=1-1/ref=sr_1_1/002-0400399-7348019?v=glance&s=books

Jonathan