Decoding Wi-Fi Security: Vulnerabilities and Solutions for LANs

Dominiq Jakab — Thu, 21 Mar 2024 10:32:28 +0000

Importance of LAN Security

Local Area Networks (LANs) play a pivotal role in modern organizations for data processing and communication. Securing these networks is crucial to prevent cyber-attacks, especially given the prevalence of wireless LANs in homes and businesses. This article investigates wireless security, addresses common issues with Wi-Fi routers, provides actionable recommendations, and includes real-world examples to illustrate the importance of robust LAN security measures.

To begin, a wireless network refers to a computer network that makes use of Radio Frequency (RF) connections between nodes in the network. Wireless networks are a popular solution for homes, businesses, and telecommunications networks.

Benefits and downfalls of a wireless LAN

Advantages:

Mobility
Easy setup
Cost effective.

Disadvantages:

Security
Performance
Interference
Range
Compatibility

Wi-Fi standards

Wi-Fi standards are a set of protocols and specifications that govern how wireless networks operate, including data transmission rates and frequency bands. The most common Wi-Fi standards you’ll encounter are part of the IEEE 802.11 family, which includes variations such as 802.11a, 802.11b, 802.11g, 802.11n, 802.11ac, and 802.11ax. These standards operate on either the 2.4 GHz or 5 GHz frequency bands, with future expansions planned for the 6 GHz band. Each standard offers different speeds, features, and compatibility levels, catering to various network requirements and advancements in wireless technology.

Securing a Wi-Fi network?

Usually, a common practice to secure the Wi-Fi network is to change default passwords. Other practices may be using different encryption standards, like:

WEP
WPA
WPA2
WPA3

The 4-way handshake in WPA2, the most common encryption method used, is a crucial process used to establish a secure connection between a client device (such as a laptop or smartphone) and a wireless access point (AP) in Wi-Fi networks. The figure below describes the process, involving four messages:

Client Initiation: The client sends a request to the AP, specifying its capabilities and preferred security protocols.
AP Response: The AP responds with its chosen security protocol and a nonce (a random number used only once).
Client Confirmation: The client generates its nonce, creates a Message Integrity Code (MIC) using the AP’s nonce and encryption key, and sends this confirmation back to the AP.
Secure Connection Establishment: Upon receiving and verifying the MIC, the AP acknowledges the secure connection, and both parties establish a Pairwise Transient Key (PTK) for encrypting data during the Wi-Fi session.

Ref [https://www.wifi-professionals.com/wp-content/uploads/2019/01/4-WAY-handshake.png]

In many cases, even this is not enough to prevent cyberattacks and in the following chapter describes the most common attacks that are used to access and exploit the LAN.

Common attacks used to hack a Wi-Fi LAN

The approach for the project was to showcase the most common vulnerabilities of a LAN from inside and outside the network.

Consequently, a LAN was defined, with a classic network address 192.168.0.0/24. The router chosen for this case was an older generation TP-Link router. Different virtual machines (VMs) – Kali Linux, Windows 10, Metasploitable v2 – and smartphones were connected to the network.

Internal Network Attacks

DoS Attack (Denial of Service): Using tools like Kali Linux, an attacker floods the router with DHCP requests, causing network congestion and denial of service for legitimate users.
MITM Attack (Man-in-the-Middle): The attacker sets up a rogue DHCP server to intercept and modify traffic between a Windows 10 device and the router, allowing for data manipulation or eavesdropping.
Router Exploitation: Exploiting known vulnerabilities in the router’s firmware or software to gain unauthorized access or control over the device.
Password Attack: Conducting dictionary attacks against the router to guess or crack weak passwords and gain access to network credentials.

External Network Attacks

Password Cracking: Using brute force or dictionary attacks to guess Wi-Fi passwords and gain unauthorized access to the network.
DoS Attack: Continuously de-authenticating other users’ devices to disrupt network access.
Captive Portals: Setting up fake access points (APs) with captive portals to trick users into entering credentials, leading to credential theft.

Conclusions

LAN security is paramount for all users. The demonstrated attacks highlight Wi-Fi network vulnerabilities. To enhance LAN security, consider the following recommendations:

Firmware and Software Updates: Regularly update devices to address vulnerabilities and improve overall security.
Strong Passwords: Encourage the use of complex and unique passwords to mitigate password cracking attacks.
Service Disabling: Disable unnecessary services to reduce the attack surface and enhance network resilience.
Encryption Protocols: Utilize robust encryption protocols like WPA2 and WPA3 to ensure data confidentiality and integrity.
Firewall Activation: Enable firewalls as an additional layer of defense against unauthorized access and network threats.
Multifactor authentication: requires users to provide two or more forms of verification before gaining access to the network.
VPN Usage: Implement VPNs for secure remote network access and data transmission.
WPS Disabling and Traffic Limiting: Turn off WPS (Wi-Fi Protected Setup) and limit network traffic to minimize potential attack vectors.
Public LAN Avoidance: Advise against using unsecured public LANs to protect sensitive data from interception.
Security Features Activation: Enable DHCP snooping, Port Security, IDS/IPS systems to detect and prevent unauthorized network access and attacks.

Additionally, the emerging trends in LAN security, such as the adoption of AI-driven threat detection and IoT devices will have an impact on network vulnerabilities. Moreover, upcoming technologies or protocols (e.g., Wi-Fi 6E, 802.11be) may influence LAN security practices soon.

By implementing these measures and staying informed about evolving security trends, users can significantly improve their LAN’s resilience against cyber threats.

The post Decoding Wi-Fi Security: Vulnerabilities and Solutions for LANs appeared first on .

The Crucial Role of Computer Networking in Cybersecurity

Dominiq Jakab — Sun, 28 Jan 2024 00:00:43 +0000

Importance of computer networking in cybersecurity

In the continuous development of technology, a solid grasp of computer networking is crucial for cybersecurity professionals.

Networking as well as Linux (including scripting) and servers are the key prerequisites that need to be addressed thoroughly before passing to security concepts. Similar to structural engineering, where a solid foundation is the starting point for building structures, networking concepts serve as the groundwork.

Concepts from networking that should be learned

Returning to networking, securing a network, website, or app requires an understanding of how technologies and computers communicate. Below are provided some of the base concepts that need to be studied and integrated as knowledge and skills from this area:

TCP/IP Protocols
- Understanding the foundational TCP/IP protocols, such as TCP, UDP, IP, and ICMP, is crucial for analyzing network traffic and identifying security threats.
Subnetting and IP Addressing
- Mastering subnetting and IP addressing is fundamental for designing secure networks and implementing effective network segmentation.
Firewalls and Network Security Devices
- Proficiency in the operation of firewalls and various network security devices is crucial for securing perimeters and monitoring traffic across network layers.
Virtual Private Networks (VPNs)
- Knowledge of VPN protocols, encryption methods, and configurations is essential for ensuring secure communication over untrusted networks.
Intrusion Detection and Prevention Systems (IDS/IPS)
- Acquiring knowledge about IDS/IPS, including signature-based and anomaly-based detection methods, is critical for identifying and mitigating network threats.
Network Monitoring and Packet Analysis:
- Proficient use of tools like Wireshark for packet analysis is vital, aiding in the identification of anomalies, malicious activity, and potential vulnerabilities.
Network Topologies and Architectures
- Understanding various network topologies, including star, mesh, bus, and ring, is essential for designing scalable and secure network architectures.
Wireless Security
- Knowledge of wireless security challenges and protocols (WPA/WPA2 or WPA3) is crucial for securing Wi-Fi networks and mitigating wireless-specific attacks.
DNS and DHCP Security
- Understanding secure configurations, DNS filtering, and DHCP snooping is crucial to prevent network-based threats often exploited in cyber-attacks.
Network Hardening Techniques:
- Implementing security best practices, such as disabling unnecessary services and enforcing strong authentication, is essential for hardening routers, switches, and other network devices.
Cloud Networking Security
- Mastery of cloud networking security, including virtual networks, security groups, and identity and access management, is crucial as organizations transition to the cloud.
Security Standards and Compliance
- Familiarity with security standards and compliance frameworks, such as ISO 27001, NIST, and CIS benchmarks, is essential for maintaining a robust and compliant cybersecurity posture.

Computer networking project

To showcase the knowledge, I learned from this area, I decided to tackle a complex project, like the one from the Cybersecurity Masterclass provided by the teachbit.ro platform, which is addressed during the Computer Networking Masterclass. One key point that needs to be mentioned is that indeed key security measures could also be addressed in this topology, but it was not defined as part of the objective for the current project. For example, port security may be assigned to mitigate a DoS attack – MAC flooding on a switch for example. However, these topics will be addressed in detail in other projects where security concepts are studied also.

The project requirements were grouped into two categories:

- Routing
- Switching

For the routing part, the following tasks were given (the template topology is given in the left figure below):

- Allocate IP addresses for the network between the routers with a subnet mask of /30 from the network 89.61.128.0/24
- Perform a routing configuration using static routes.
- Define a static default route from R4 to ISP
- Integrate a virtual machine – WordPress by Bitnami in topology.
- Connect the topology from GNS3 to your local PC network.

Similarly, for the switching part, other tasks were assigned (a template of the topology is in the right figure presented below):

- Create 6 VLANs (100 – Marketing, 200 – Sales, 300 – Production, 400 – Financial, 500 – HR, 600 – IT) on switches.
- Configure trunk interfaces between switches and access interfaces between switches and PCs.
- Configure RoaS (Roating on a Stick) on routers to allow routing between VLANs.
- Configure static routes between the 2 routers.

However, I decided to perform a more complex alternative of the project, in GNS3, and not in Cisco Packet Tracer, and put both parts into a single topology which is showcased in the following figure.

Before defining the topology and working on the project, I installed GNS3 IOU (IOS on UNIX), a VM from GNS3 which allows the virtualization of the operating system for the router and the switch (by default switching may not be handled without this in GNS3).

For the tasks, I used OSPF multi-area routing protocol (instead of static routes) for the network in area 0, area 3 and area 4. Area 1 and area 2, besides addressing different LANs for the switching part, were also defined as areas for OSPF protocol and integrated into the same topology.

The internet access was obtained using the cloud option from GNS3, connecting the ISP router from the topology via the ethernet adaptor defined in GNS3 VM option as bridged, and replicating the network configuration of the (NIC) Network Interface Card. Consequently, the host and the ISP router are in the same LAN.

The VM (by Bitnami) on which WordPress is hosted was integrated into the topology by linking it to the ISP router. The same procedure was adopted also for the Ubuntu VM.

Routers R1 and R6 represent routers R1 and R2 from the switching topology given in the tasks above and 2 static routes were assigned such that connectivity between the VLANs may be obtained. After defining the VLANs on the switches, I assigned RoaS on routers R1 and R6 to have connectivity in the same area between the end devices.

Completing this project, the implementation of OSPF multi-area routing, VLAN configuration, and advanced GNS3 topology integration has enhanced my technical knowledge in computer networking. These hands-on experiences not only demonstrated theoretical applications but also highlighted the intricate deployment of robust routing protocols, VLAN segmentation, and secure network architectures.

I am thrilled to bring you further insights and experiences in the upcoming articles. Stay tuned for the next project in this cybersecurity journey!

The post The Crucial Role of Computer Networking in Cybersecurity appeared first on .

Cybersecurity Masterclass Project

Dominiq Jakab — Wed, 13 Dec 2023 09:30:43 +0000

Welcome to my first article in which I present my project from the Cybersecurity Masterclass on the https://teachbit.ro platform.

This project signifies the start of a series where I’ll showcase the skills and knowledge gained over the past year.

The main focus was on security concepts and their practical application. Consequently, knowledge and skills about various operating systems, networking, security concepts, and essential security tools were required.

The tasks were divided into 3 categories:

Scanning and information gathering
Offensive
Defensive

For the scanning part, different websites were scanned for technologies and vulnerabilities using different platforms (https://builtwith.com, https://pentest-tools.com) and tools (WPScan from Kali Linux)

The offensive part covered different attacks:

DDoS (using LOIC, GoldenEye and Hping3)
MITM (acquiring credentials for a user of a HTTP website using bettercap)
Password attack (dictionary attack using Hydra)
Attacks on FTP server from Metasploitable VMs using Netcat and Metasploit Framework

During the defensive part, the following tasks were solved:

Configure WAF on a WordPress website to prevent brute force attacks and 2FA
Secure a WordPress site by upgrading from HTTP to HTTPS
Install an AV and display the use of a password manager
Create a cybersecurity procedure for a small company
Register a domain in the Cloudflare platform and enable DDoS protection

Excited to share more insights and experiences with you in the upcoming articles. Stay tuned for the next chapter in this cybersecurity journey!

The post Cybersecurity Masterclass Project appeared first on .