5 - WLANs

Question 1

Hidden Terminal

Answer 1

When a node cannot ‘hear’ that another node is busy due to being out of range

Question 2

Exposed Terminal

Answer 2

When the node is busy transmitting, and unable to transmit due to fear of collision

Question 3

Wireless cards employ what sort of transmission?

Answer 3

Half-Duplex

Question 4

Definition of MACA

Answer 4

Multiple Access with Collision Avoidance

Question 5

MACA employs what type of sensing? (2)

Answer 5

• Physical Channel Sensing

- Virtual Channel Sensing

Question 6

Sender and receiver nodes must send what before sending data?

Answer 6

Control frames, which reserves the medium for communication

Question 7

Collision Avoidance Communication (5)

Answer 7

• Request to Send (RTS)
• Replies with Clear to Send (CTS)
• Any node that receives RTS, and should not transmit until indicated time has lapsed
• Any node that receive RTS but not CTS knows it isn’t close enough to receiver to interfere, so can still transmit
• After data received, it sends an ACK

Question 8

What if not CTS arrives at sender?

Answer 8

Assume a collision and start binary exp back-off

Question 9

Term employed to select an AP

Answer 9

Scanning

Question 10

Scanning Method (4)

Answer 10

• mobile client node send Probe frames
• all APs in range reply with Probe Response Frame
• Mobile node selects an AP and sends an Association Request frame
• AC responds with an Association Response frame

Question 11

P.L Attack

Answer 11

Saturate wireless network with RF noise

Question 12

D.L Attacks (2)

Answer 12

• Two-sided AP learns about MAC address, hackers copy MAC address and transmit loudly from other side of the wall
• Configure wireless card to masquerade as AP, easily attack victim

Question 13

Black-Hole Attacks

Answer 13

Complete termination of communication stream

Question 14

Grey-Hole Attacks

Answer 14

Selectivity drop or transmit a victim’s packets

Question 15

N.L Attack

Answer 15

Performing DoS attacks such as ICMP floods, file transfers

Question 16

Factors for Wireless Network Encryption (3)

Answer 16

• Need for privacy
• Ease of Use
• Government Regulations

Question 17

Forms of Network Encryption

Answer 17

• WEP (Wired Equivalent Privacy)

- WPA, WPA2, 802.11i(WiFi Protected Access)

Question 18

WEP method

Answer 18

Shares a secret key between mobile station and AP

Question 19

WEP Criteria (5)

Answer 19

• Optional
• “Reasonably Strong” Encryption
• Self-Synchronising
• Computationally Efficient
• Conform to government regulations

Question 20

WEP Encryption (4)

Answer 20

• Employs secret key of 40 or 104 bits
• Secret keys concatenated with 24-bit IV to form 64/128 bit encryption (silver/gold wireless card)
• Inputted to pseudo-random number generator, RC4 alg (stream cipher)
• Data XOR with key stream to produce cipher text

Question 21

WEP Decryption

Answer 21

• Cipher text XOR key stream to produce data and ICV

Question 22

Issues with WEP Encryption (4)

Answer 22

• Passive attack is subject to statistical analysis
• Active attacks inject new traffic
• Active attacks to decrypt traffic, by confusing AP
• Dictionary Build attacks, by analysing traffic

Question 23

RC4 Vulnerabilities (2)

Answer 23

• Single change in cipher text changes plain text message
• Eavesdropping two cipher texts encrypted with the same key stream, we can obtain the XOR of the plaintext leading to statistical attacks to recover plaintexts

Question 24

WEPs IV Problems

Answer 24

• IEEE 802.11 b/g doesn’t specify how often the IV should change, two wireless network cards inserted at the same time will both be initialised to zero
• Short 24 bit length guarantees the reuse of the same key stream under standard conditions (exhausted after 5 hours)

Question 25

Types of WEP Authentication (2)

Answer 25

• Open System Auth: all data sent in plaintext

- Shared Key Auth: a shared key between a group of nodes

Question 26

WEP Auth Method (4)

Answer 26

• Mobile sends AuthFrame
• AP replies with AuthChallengeText
• Mobile node encrypts bytes
• AP decrypts challenge and compares it to challenge

Question 27

Attacks by Patient Hackers (3)

Answer 27

• Passive Traffic Decryption
• Active Traffic Injection
• Table-based attacks

Question 28

Improvements to WEP Problems (3)

Answer 28

• Temporary Key Integrity Protocol (TKIP) to replace WEP without replacing hardware, by acting as a wrapper around WEP
• TKIP key is 128 bit
• Each TKIP packet has a unique 48-bit seq num, incremented for each new packet, ensuring key is different for each packet