FragAttacks (fragmentation and aggregation attacks)

FragAttacks is a collection of new security vulnerabilities that affect Wi-Fi devices. This is an adversary that is within range of a victim's Wi-Fi network can abuse these vulnerabilities to steal user information or attack devices. 

Three of the discovered vulnerabilities are design flaws in the Wi-Fi standard and therefore affect most devices. On top of this, several other vulnerabilities were discovered that are caused by widespread programming mistakes in Wi-Fi products. Experiments indicate that every Wi-Fi product is affected by at least one vulnerability and that most products are affected by several vulnerabilities.

The discovered vulnerabilities affect all modern security protocols of Wi-Fi, including the latest WPA3 specification. Even the original security protocol of Wi-Fi, called WEP, is affected. This means that several of the newly discovered design flaws have been part of Wi-Fi since its release in 1997! Fortunately, the design flaws are hard to abuse because doing so will requires user interaction or is only possible when using uncommon network settings. As a result, in practice the biggest concern are the programming mistakes in Wi-Fi products since several of them are trivial to exploit.

Design flaws:

• CVE-2020-24588: aggregation attack (accepting non-SPP A-MSDU frames)
• CVE-2020-24587: mixed key attack (reassembling fragments encrypted under different keys)
• CVE-2020-24586: fragment cache attack (not clearing fragments from memory when (re)connecting to a network)

Implementation vulnerabilities allowing the injection of plaintext frames:

• CVE-2020-26145: Accepting plaintext broadcast fragments as full frames (in an encrypted network)
• CVE-2020-26144: Accepting plaintext A-MSDU frames that start with an RFC1042 header with EtherType EAPOL (in an encrypted network)
• CVE-2020-26140: Accepting plaintext data frames in a protected network
• CVE-2020-26143: Accepting fragmented plaintext data frames in a protected network

Other implementation flaws:

• CVE-2020-26139: Forwarding EAPOL frames even though the sender is not yet authenticated (should only affect APs)
• CVE-2020-26146: Reassembling encrypted fragments with non-consecutive packet numbers
• CVE-2020-26147: Reassembling mixed encrypted/plaintext fragments
• CVE-2020-26142: Processing fragmented frames as full frames
• CVE-2020-26141: Not verifying the TKIP MIC of fragmented frames

Links:

• https://www.fragattacks.com/
• https://arstechnica.com/gadgets/2021/05/farewell-to-firewalls-wi-fi-bugs-open-network-devices-to-remote-hacks/
• https://github.com/vanhoefm/fragattacks
  

RawCap - Network Sniffer for Windows

RawCap (only 17kB)  is a free raw sockets network sniffer for Windows. It requires no external libraries or DLL, just standalone exe.

It can sniff any interface including loopback, WiFi, PPP interfaces.

Personally, I use it for 2 purposes: penetration testing and incident response:

• Sniff additional credential after break into remote machine (admin) without Winpcap or NDIS driver.
• Sniff loopback interface to detect data leakage via SSL tunnelling proxy.
• Sniff WiFi (WPA2) for any suspicious TCP connections.

RawCap is provided for free and can be downloaded from here:

• http://www.netresec.com/?page=RawCap

wifite - Mass WEP/WPA Cracker

wifite is created to to attack multiple WEP and WPA encrypted networks at the same time. This tool is customizable to be automated with only a few arguments and can be trusted to run without supervision. wifite is available in BackTrack4.

Features:

• sorts targets by power (in dB); cracks closest access points first
• automatically deauths clients of hidden networks to decloak SSIDs
• numerous filters to specify exactly what to attack (wep/wpa/both, above certain signal strengths, channels, etc)
• customizable settings (timeouts, packets/sec, channel, change mac address, ignore fake-auth, etc)
• all WPA handshakes are backed up to wifite.py’s current directory
• smart WPA deauthentication — cycles between all clients and broadcast deauths
• stop any attack with Ctrl+C — options: continue, move onto next target, skip to cracking, or exit
• switching WEP attack methods does not reset IVs
• intel 4965 chipset fake-authentication support; uses wpa_supplicant workaround
• SKA support (untested)
• displays session summary at exit; shows any cracked keys
• all passwords saved to log.txt
• built-in updater: ./wifite.py -upgrade

References:

• Download wifite at Google Code

Setting Up WPA2 Connection in BackTrack

The next thing is to setup my Internet connection. Since I'm using WPA2 at home, and here is the content of my /etc/network/interfaces

auto lo
iface lo inet loopback


auto wlan0
iface wlan0 inet dhcp
wpa-driver wext
wpa-ssid < ssid >
wpa-ap-scan 1
wpa-proto RSN
wpa-pairwise CCMP
wpa-group CCMP
wpa-key-mgmt WPA-PSK WPA-EAP
wpa-psk < hex key generated by wpa_passphase ssid passphase >

Create Wireless Hosted Networks in Windows 7

This new feature, wireless Hosted Network, is introduced by Microsoft in Windows 7 and Windows Server 2008 R2.

The wireless Hosted Network feature uses the VirtualWiFi technology along with a software-based virtual access point (Virtual AP) feature. It allows the creation of wireless AP with a supported Wi-Fi adapter and driver, while also having the ability to connect to another wireless network. It also includes a DHCP server, so users automatically receive an IP address.

Pre-requisites:

• Supported WiFi adapter
• Using certified WiFi drivers for Windows 7. 

You can check this by looing at the network connection (detail mode). You should see an adapter called Wireless Network Connection that using Microsoft Virtual WiFi Miniport Adapter.

Follow the steps below:

• Start "cmd" in "Administrator mode".
• To create the hosted network:

netsh wlan set hostednetwork mode=allow ssid=[Your-AP-Network]  key=[Your-WPA2-PSK-AES-Password]

• Replace the SSID and key placeholders with your desired network name and WPA2-PSK encryption key. Note that Microsoft requires all wireless Hosted Networks to use WPA2-PSK (AES) encryption. 
• Optional. If you want to allow Internet access for other users, enable ICS. See how to enable ICS here if it is disabled.
• To start/enable the Hosted Network:

netsh wlan start hostednetwork

• Optional. To manually turn the Hosted Network off, enter the following:

netsh wlan stop hostednetwork

• Optional. To see the Hosted Network details (see Figure 3), including the MAC addresses of connected users, enter the following:

netsh wlan show hostednetwork

• Optional. To change the WPA2-PSK key, you can enter the following:

netsh wlan refresh hostednetwork [New-WPA2-PSK-AES-Password]

Now others should see the Hosted Network appear in their list of available wireless networks. They can connect like normal and enter the encryption key when prompted.

Keep in mind that wireless Hosted Networks do not automatically restart after the computer resumes from sleep, hibernate, or restarts. However, if used, a third-party, such as Connectify, utility might initiate a reconnection.

My Alfa AWUS036H

Today I get my long range USB adapter from geek001.




- Posted from my iPhone.

Get Free Airport WiFi

Blogger Felix Geisendorfer points out a clever URL hack that scored him free Wi-Fi at the Atlanta airport.

I found that I could easily visit sites like slashdot, Google, or even this weblog, when adding a ?.jpg at the end of the url. The next logical step was to automate that. I downloaded Greasemonkey and wrote a 4 line script that would add ?.jpg to every link in a document. That way I was able to browse most sites without a hassle.

This trick will only work on Wi-Fi networks that allow images to go through without a redirect, and though it may seem like a bit of a stretch, it's better than shelling out $7 for 30 minutes of Wi-Fi.

One of the users suggest to use "#" or "&" instead of "?", as "#" terminates the url as far as most of the browsers are concerned.

Next time, if i'll ever be stuck on an airport, i'll try this trick! :-D