Wireless & password security

Mark Theeuwes

2

Wireless basics

3

Wireless basics

Radio waves

4

Wireless basics

Channels 2,4 GHz (802.11 B/G/N)

5

Wireless basics

Channels 5GHz (802.11 A/N)

6

Wireless basics

Reflection

Absorbtion

Refraction

Scattering

7

Wireless basics

Omnidirectional antenna

8

Wireless basics

Other Antenna’s

9

Wireless basics

WLAN Cell

10

Wireless basics

Range

11

Wireless basics

Roaming

12

Wireless basics

Roaming

13

Wireless basics

Cells

14

Wireless basics

Honey cone

15

Wireless basics

Building

16

Wireless basics

Autonomous Accespoint

17

CiscoWireless

LWAP

18

Cisco Wireless

4) Cisco Secure ACS servers

Printers with wireless workgroup bridge

Notebook Wireless workstations

CISCO AIRONET 1200 I WIRELESS ACCESS POINT CISCO AIRONET 1200 I WIRELESS ACCESS POINT

5) ADS Domain Controllers

RA

DIU

S

LDAP

AES

WEP128

CISCO AIRONET 1200 I WIRELESS ACCESS POINT

CISCO AIRONET 1200 I WIRELESS ACCESS POINT

CISCO AIRONET 1200 I WIRELESS ACCESS POINT

CISCO AIRONET 1200 I WIRELESS ACCESS POINT

LAN LWAP

WLAN controllers

Firewalls

19

Wireless

20

Wireless basics

Association

21

Wireless basics

Security options

22

Wireless attacks

23

Wireless attacks

24

WEP cracking

25

WPA2 cracking

26

Passwords

27

Strong passwords

28

Passwords

password

2Mypassword

2MyPa$$w0rd!

1Ef$aŎX9s2!#

29

Password policy considerations

What is too simple ? Password age ? Password length ?

30

Passwords

31

Strong passwords

32

Myspace attack 2006 (34.000 passwords)

33

Myspace attack 2006

34

Most common passwords (America)

password1, abc123, myspace1, password, blink182, qwerty1, fuckyou, 123abc, baseball1, football1, 123456, soccer, monkey1, liverpool1, princess1, jordan23, slipknot1, superman1, iloveyou1, monkey

35

Password hashes

36

Password hashes

37

Password hacking

38

Password guessing

The word "password" The same as the user name Name of the user Birthdays or birth places Relatives Pets Favorite colors, foods, places, etc.

39

Dictionary attacks

40

Brute force

41

Rainbow tables

NTLM hashes

42

Password database Fontys Venlo (10 years ago)

43

Future ?

44

Security is a trade off

45

Questions

46