In this attack

In this attack, an adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replying cryptographic handshake message. When the victim reinstall the key, associated parameters such as the incremental transmit packet number and receive packet number are reset to their initial values. What is this attack called?

Leave a Comment / CEHv11 / By

In this attack, an adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replying cryptographic handshake message. When the victim reinstall the key, associated parameters such as the incremental transmit packet number and receive packet number are reset to their initial values. What is this attack called?

Option 1 : Evil Twin
Option 2 : KRACK
Option 3 : Wardriving
Option 4 : Chop chop attack

1. Evil Twin

In this attack evil twin may be a type Wi-Fi attack that works by taking advantage of the very fact that the majority computers and phones will only see the “name” or ESSID of a wireless network. This actually makes it very hard to differentiate between networks with an equivalent name and same quite encryption. In fact, many networks will have several network-extending access points all using an equivalent name to expand access without confusing users.
If you would like to ascertain how this works, you’ll create a Wi-Fi hotspot on your phone and name it an equivalent as your home network, and you will notice it’s hard to inform the difference between the 2 networks or your computer may simply see both because the same network. A network sniffing tool like Wigle Wifi on Android or Kismet can clearly see the difference between these networks, but to the typical user, these networks will look an equivalent .
This works great for tricking a user into connecting if we’ve a network with an equivalent name, same password, and same encryption, but what if we do not know the password yet? we cannot be ready to create a network which will trick the user into connecting automatically, but we will try a social engineering attack to undertake to force the user to offer us the password by kicking them off the important network.

2. KRACK

In this attack KRACK is an acronym for Key Reinstallation Attack. KRACK may be a severe replay attack on Wi-Fi Protected Access protocol (WPA2), which secures your Wi-Fi connection. Hackers use KRACK to take advantage of a vulnerability in WPA2. When in close range of a possible victim, attackers can access and skim encrypted data using KRACK.

How KRACK Works

Your Wi-Fi client uses a four-way handshake when attempting to attach to a protected network. The handshake confirms that both the client — your smartphone, laptop, et cetera — and therefore the access point share the right credentials, usually a password for the network. This establishes the Pairwise passkey (PMK), which allows for encoding .
Overall, this handshake procedure allows for quick logins and connections and sets up a replacement encryption key with each connection. this is often what keeps data secure on Wi-Fi connections, and every one protected Wi-Fi connections use the four-way handshake for security. This protocol is that the reason users are encouraged to use private or credential-protected Wi-Fi instead of public connections.
KRACK affects the third step of the handshake, allowing the attacker to control and replay the WPA2 encryption key to trick it into installing a key already in use. When the key’s reinstalled, other parameters related to it — the incremental transmit packet number called the nonce and therefore the replay counter — are set to their original values.
Rather than move to the fourth step within the four-way handshake, nonce resets still replay transmissions of the third step. This sets up the encryption protocol for attack, and counting on how the attackers replay the third-step transmissions, they will take down Wi-Fi security.

Why KRACK may be a Threat

Think of all the devices you employ that believe Wi-Fi. it isn’t almost laptops and smartphones; numerous smart devices now structure the web of Things (IoT). due to the vulnerability in WPA2, everything connected to Wi-Fi is in danger of being hacked or hijacked.
Attackers using KRACK can gain access to usernames and passwords also as data stored on devices. Hackers can read emails and consider photos of transmitted data then use that information to blackmail users or sell it on the Dark Web.
Theft of stored data requires more steps, like an HTTP content injection to load malware into the system. Hackers could conceivably take hold of any device used thereon Wi-Fi connection. Because the attacks require hackers to be on the brink of the target, these internet security threats could also cause physical security threats.
On the opposite hand, the necessity to be in close proximity is that the only excellent news associated with KRACK, as meaning a widespread attack would be extremely difficult.
Victims are specifically targeted. However, there are concerns that a experienced attacker could develop the talents to use HTTP content injection to load malware onto websites to make a more widespread affect.

Everyone is in danger from KRACK vulnerability. Patches are available for Windows and iOS devices, but a released patch for Android devices is currently in question (November 2017). There are issues with the discharge , and lots of question if all versions and devices are covered.
The real problem is with routers and IoT devices. These devices aren’t updated as regularly as computer operating systems, and for several devices, security flaws got to be addressed on the manufacturing side. New devices should address KRACK, but the devices you have already got in your home probably aren’t protected.

The best protection against KRACK is to make sure any device connected to Wi-Fi is patched and updated with the newest firmware. that has checking together with your router’s manufacturer periodically to ascertain if patches are available.

The safest connection option may be a private VPN, especially when publicly spaces. If you would like a VPN for private use, avoid free options, as they need their own security problems and there’ll even be issues with HTTPs. Use a paid service offered by a trusted vendor like Kaspersky. Also, more modern networks use WPA3 for better security.
Avoid using public Wi-Fi, albeit it’s password protection. That password is out there to almost anyone, which reduces the safety level considerably.
All the widespread implications of KRACK and therefore the WPA2 vulnerability aren’t yet clear. what’s certain is that everybody who uses Wi-Fi is in danger and wishes to require precautions to guard their data and devices.

3. Wardriving

In this attack Wardriving consists of physically checking out wireless networks with vulnerabilities from a moving vehicle and mapping the wireless access points.
Wardrivers will use hardware and software to seek out WiFi signals during a particular area. they’ll shall only find one network or every network within a neighborhood . Once networks are located, wardrivers will record the locations of vulnerable networks and should submit the knowledge to third-party websites and apps to make digital maps.
There are three primary reasons wardrivers search for unsecured WiFi. the primary is to steal personal and banking information. The second is to use your network for criminal activity that you simply , because the owner of the network, would be responsible for . the ultimate reason is to seek out the safety flaws of a network. Ethical hackers do that via wardriving for the aim of finding vulnerabilities so as to enhance overall security.

Software Used for Wardriving

Wardriving on alittle scale are often through with an easy app on a smartphone. Larger attacks, however, usually require a whole rig with software and hardware specifically designed for the attack. The rig includes:
• Wardriving software or app: Popular wardriving programs include iStumbler, KisMAC, CoWPAtty, InSSIDer, WiGLE, NetStumbler, WiFi-Where, and WiFiphisher.
• GPS: A GPS, whether from a smartphone or standalone device, helps wardrivers log the situation of wireless acccess points.
• Wireless network card and antenna: While some wardrivers use their phone’s built-in antenna, some will use a wireless network card or antenna to enhance scanning capabilities.
• Smartphone or Laptop: could also be wont to run access point mapping software.

How To Prevent Wardriving

Wardrivers typically engage during this sort of hacking with criminal intent. While some wardriving practices are harmless, there’s also the potential for hackers to utilize your network to commit online crimes with the connection registered to you or steal personal data with the aim of exploitation. In either case, it’s best practice to guard your WiFi network from these sorts of breaches.
• Enable Encryption: Choose the very best network security protocol when choosing WEP, WPA, and WPA2 and never leave your network open or without a security protocol.
• Update the Password: Change the default password on your router and use multi-factor authentication when available.
• Add a Guest Network: found out a guest WiFi network for visitors and smart technologies that hook up with the web to limit the access of these less-secure devices.
• Use a Firewall: Firewalls block unapproved communication and any attempts to access your system.
• Update Your Devices: Always install updates to make sure the foremost up-to-date patches and security on your hardware and software.
While wardriving is a smaller amount common today than it had been in 2001, the matter persists. Although ethical hackers use the method to seek out network vulnerabilities, there’s still the likelihood for the more dangerous alternative—those trying to take advantage of weaknesses to extract data or perform illegal activities. Always protect your devices using responsible digital habits and therefore the privacy of VPN software.

4. Chop chop attack

In this attack against TKIP is named the Chopchop attack and it’s not a key recovery attack. The chopchop attack was implemented originally against WEP and allows the “attacker to interactivelydecrypt the last m bytes of plaintext of an encrypted packet by sending m*128 packets in average to the network .It relies on the weakness of the CRC32 checksum called the ICV which is appended to the info of the packet. The attacker truncates the last byte of the encrypted packet and guesses the worth and returns the packet to the access point. If it’s incorrect then the packet are going to be discarded thanks to an incorrect checksum and therefore the attacker knows the guess was wrong. Once they need guessed the proper value for the last byte they continue backwards through the remainder of the bytes until they need guessed the whole packet. It takes a mean of 128 guesses per byte to guess the proper value. However, since the MIC and sequence counters are now included in WPA it can prevent this attack from working within the original manner. The attacker now captures a packet and finds a coffee traffic channel where the sequence counter will still be low and tries the attack. If the attacker guesses the last byte wrong then the access point will still silently drop the packet, but if the guess is correct then a MIC failure report frame is shipped to the client. Once this is often received the attacker knows their guess is correct and must wait a minimum of 60 seconds before guessing so as to stop the client from being disconnected. Once the attacker has decrypted the last 12 bytes they’re going to have the MIC and therefore the ICV in plaintext. Using the ICV, the attacker can guess the remainder of the packet and perform the CRC32 until the values match and that they know they need decrypted the packet. With the recovered MIC the attacker can reverse the algorithm to recover the MIC key. With the MIC key recovered the attacker and send packets to the clients on any channel where the sequence counter is low and perform variety of attacks like traffic rerouting.

Learn CEH & Think like hacker

This Blog Article is posted by

Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us – www.info-savvy.com

https://g.co/kgs/ttqPpZ

Leave a Comment