Re: Wireless blocking

[Dragos Ruiu <dr () kyx net>]

Re: tracking down rogue APs by wire.

Please keep in mind that in a true malicious application,
it doesn't need a wire. There is no substitute for a directional
antenna sometimes :-).

Many machines allow dual wireless interfaces, allowing 
some nifty MITM style attacks. At CanSecWest this year,
Dino and K2 showed how they can even do it using a 
single NIC and special firmware.

Chapter N of this saga will show up at PacSec next month
as Cedric Blancher will show even more sophistication in these
802.11 MITM attack vectors in his WiFi talk in Tokyo.

Here is an abstract of Cedric's presentation:

        Abstract:

                        We know for a couple of years serious
                vulnerabilities against WiFi networks. However, some of
                them seemed to have been ignored for they required
                traffic injection and most chipset/drivers were not
                supporting this. That's why we can still find many
                handhelds (Zaurus, PSP, Smartphones, etc.), ISP
                all-in-one DSL boxes (Freebox or Livebox for FR ISP) and
                many other devices that only support WEP as security
                mechanism. That's also why commercial hotspots are still
                relying on open WiFi networks.
                        But wireless traffic injection is now possible
                very conveniently on some chipsets, allowing very
                efficient attacks against open and WEP WiFi networks.
                This presentation aims at showing theses attacks and
                demonstrate that open and WEP WiFi networks are
                vulnerable by design and should not be used.
                        Latest WiFi security schemes, namely WPA and
                802.11i/WPA2 will be discussed as a solution to WiFi
                insecurity.

Cedric has been refining this stuff for a long time, and some of his
demonstrations will be uh... eye-opening caveats, to say the least :-).

cheers,
--dr

-- 
World Security Pros. Cutting Edge Training, Tools, and Techniques
Tokyo, Japan    November 14-16 2005  http://pacsec.jp
pgpkey http://dragos.com/ kyxpgp