Practice Exam 7 Flashcards
PE7.1 Which of the following is a true statement?
A.Kismet can be installed on Windows, but not on Linux.
B.NetStumbler can be installed on Linux, but not on Windows.
C. Kismet cannot monitor traffic on 802.11n networks.
D. NetStumbler cannot monitor traffic on 802.11n networks.
D
D. Not only is this question overly confusing and very tool specific, it’s pretty much exactly the type of question you’ll see on your exam. Kismet and NetStumbler are both wireless monitoring tools with detection and sniffing capabilities. NetStumbler is Windows specific, whereas Kismet can be installed on virtually anything. Both do a great job of monitoring 802.11a, b, and g networks, but NetStumbler can’t handle 802.11n. Kismet can even be used as an IDS for your wireless network! One last fun fact to know in relation to this question—Kismet does a better job of pulling management packets. A lot of wireless cards on Windows systems don’t support monitor mode and have a difficult time pulling management and control packets.
A, B, and C are incorrect statements. Kismet can be installed on anything, NetStumbler is Windows specific and not available on Linux, and Kismet can monitor 802.11n networks.
PE7.2 Which of the following use a 48-bit initialization vector? (Choose all that apply.)
A. WEP
B. WPA
C. WPA2
D. WEP2
B,C
B, C. One of the improvements from WEP to WPA involved extending the initialization vector (IV) to 48 bits from 24 bits. An IV provides for confidentiality and integrity. Wireless encryption algorithms use it to calculate an integrity check value (ICV), appending it to the end of the data payload. The IV is then combined with a key to be input into an algorithm (RC4 for WEP, AES for WPA2). Therefore, because the length of an IV determines the total number of potential random values that can possibly be created for encryption purposes, doubling to 48 bits increased overall security. By itself, this didn’t answer all security problems—it only meant it took a little longer to capture enough IV packets to crack the code. However, combined with other steps, it did provide for better security.
A is incorrect because WEP uses a 24-bit IV. In WEP, this meant there were approximately 16 million unique IV values. Although this may seem like a large number, it’s really not—a determined hacker can capture enough IVs in a brute-force attack in a matter of hours to crack the key.
D is incorrect because there is no such thing as WEP2.
PE.7.3 Which of the following are true statements? (Choose all that apply.)
A. WEP uses shared-key encryption with TKIP.
B. WEP uses shared-key encryption with RC4.
C. WPA2 uses shared-key encryption with RC4.
D. WPA uses TKIP and AES encryption.
B, D. WEP uses a 24-bit initialization vector and RC4 to “encrypt” data transmissions, although saying that makes me shake in disgust because it’s really a misnomer. WEP was designed as basic encryption merely to simulate the “security” of being on a wired network—hence, the “Equivalent” part in Wired Equivalent Privacy. It was never intended as true encryption protection. WPA was an improvement on two fronts. First, the shared key portion of encryption was greatly enhanced by the use of Temporal Key Integrity Protocol (TKIP). In short, the key used to encrypt data was made temporary in nature and is swapped out every 10,000 packets or so. Additionally, WPA2 uses NIST-approved encryption with AES as the algorithm of choice.
A is incorrect because WEP does not use TKIP. Along with the same key being used to encrypt and decrypt (shared key), it’s not changed and remains throughout the communication process—which is part of the reason it’s so easy to crack.
C is incorrect because WPA2 does not use RC4 as an encryption algorithm.
n.
PE.7.4 Which of the following would you recommend as a means to deny network access by unauthorized wireless devices to network assets? A. Wireless access control list B. Wireless jammer C. Wireless analyzer D. Wireless access point
A. Of the choices provided, the access list is the only one that makes sense. It’s exactly what an access list is designed for: by making sure only devices that are authorized can connect, you ensure unauthorized devices cannot connect (or at least take steps to avoid their connection). As a side note here, be careful not to confuse a wireless intrusion prevention system (WIPS) with the ACL. A WIPS will monitor your traffic and, just like the better-known network intrusion prevention system, will take steps to prevent intrusion based on traffic analysis, thresholds, and alerts. Lastly, on questions like this, the process of elimination can help you discern the answer pretty easily.
B is incorrect for what should be obvious reasons. Yes, you would prevent unauthorized connections, but you’d also prevent all connections—even those from authorized devices. If that’s the case, why have wireless turned on at all? Now, I can hear some of you screaming that jamming could be used in restricted geographical spaces to control access, but trust me, ECC sees jammers as an attack tool knocking everything off. You’re better off seeing it the same way for your exam.
C is incorrect because an analyzer doesn’t affect access one way or another.
D is incorrect because that’s not the intent of a WAP. Sure you can configure certain things on the device (like, dare I say, an ACL), but the device itself is designed as the access point.
PE7.5 While on vacation, Joe receives a phone call from his identity alert service notifying him that two of his accounts have been accessed in the past hour. Earlier in the day, he did connect a laptop to a wireless hotspot at McDonald’s and accessed the two accounts in question. Which of the following is the most likely attack used against Joe?
A. Unauthorized association
B. Honeyspot access point
C. Rogue access point
D. Jamming signal
B. Sometimes EC-Council creates and uses redundant terminology, so don’t blame me for this insanely annoying jewel. In this case, Joe most likely connected to what he thought was the legitimate McDonald’s free Wi-Fi while he was getting his morning coffee and checked the accounts in question. However, an attacker in (or close to) the restaurant had set up another wireless network using the same SSID as the restaurant’s. This practice is known as the honeyspot attack.
A is incorrect because the unauthorized association attack exploits so-called soft access points—embedded wireless LAN radios in some mobile devices that can be launched inadvertently and used by the attacker for access to the enterprise network.
C is incorrect, but just barely so. The whole idea of a honeyspot attack is predicated on the idea that the attacker has some kind of rogue access point set up to trick people into connecting. However, this is a case of one answer being more correct than the other. Honeyspot attacks are explicitly called out as a separate type of rogue attack by EC-Council, so you’ll need to remember it that way.
D is incorrect because a jamming attack seeks to DoS the entire signal, not necessarily to steal anything from it.
PE7.6 An attacker is attempting to crack a WEP code to gain access to the network. After enabling monitor mode on wlan0 and creating a monitoring interface (mon 0), she types this command:
aireplay –ng -0 0 –a 0A:00:2B:40:70:80 –c mon0
What is she trying to accomplish?
A.To gain access to the WEP access code by examining the response to deauthentication packets, which contain the WEP code
B.To use deauthentication packets to generate lots of network traffic
C.To determine the BSSID of the access point
D.To discover the cloaked SSID of the network
B. Within 802.11 standards, there are several different management-type frames in use: everything from a beacon and association request to something called (and I’m not making this up) a probe request. One of these management frames is a deauthentication packet, which basically shuts off a client from the network. The client then has to reconnect—and will do so quickly. The idea behind this kind of activity is to generate lots of traffic to capture in order to discern the WEP access code (from clients trying to reassociate to all the new ARP packets that will come flying around, since many machines will dump their ARP cache after being shut off the network). Remember that the initialization vectors within WEP are relatively short (24 bits) and are reused frequently, so any attempt to crack the code requires, in general, around 15,000 or so packets. You can certainly gather these over time, but generating traffic can accomplish it much faster. One final note on this must be brought up: this type of attack can just as easily result in a denial-of-service attack against hosts and the AP in question, so be careful.
A is incorrect because the response to a deauth packet does not contain the WEP access code in the clear. If it did, the attacker wouldn’t need to bother with all this traffic generation in the first place—one simple packet would be enough to crack all security.
C is incorrect because the basic service set identifier (BSSID) is the MAC address of the AP. It’s usually easy enough to gain from any number of methods (using airodump, for instance) and isn’t a reason for sending multiple deauth packets. There are networks where the BSSID is hidden (referred to as cloaking), but other tools (airmon and airodump) can help with that.
D is incorrect because even if an SSID is “cloaked,” that doesn’t mean it’s actually hidden; all it means is that it is not broadcast. The SSID is still contained in every single packet sent from the AP, and discovering it is easy enough.
PE7.7 Which wireless standard works at 54 Mbps on a frequency range of 2.4 GHz?
A. 802.11a
B. 802.11b
C. 802.11g
D. 802.11n
C
C. The 802.11 series of standards identifies a variety of wireless issues, such as the order imposed on how clients communicate, rules for authentication, data transfer, size of packets, how the messages are encoded into the signal, and so on. 802.11g combines the advantages of both the “a” and “b” standards without as many of the drawbacks. It’s fast (at 54 Mbps), is backward compatible with 802.11b clients, and doesn’t suffer from the coverage area restrictions 802.11a has to contend with. Considering it operates in the 2.4 GHz range, however, there may be some interference issues to deal with. Not only is a plethora of competing networks blasting their signals (sometimes on the same channel) near and around your network, but you also have to consider Bluetooth devices, cordless phones, and even baby monitors that may cause disruption (due to interference) of wireless signals. And microwave ovens happen to run at 2.45 GHz—right smack dab in the middle of the range.
A is incorrect because 802.11a operates at 54 Mbps but uses the 5 GHz frequency range. The big drawback to 802.11a was the frequency range itself—because of the higher frequency, network range was limited. Whereas 802.11b clients could be spread across a relative large distance, 802.11a clients could communicate much faster but had to be closer together. Combined with the increased cost of equipment, this contributed to 802.11a not being fully accepted as a de facto standard. That said, for security purposes, it may not be a bad choice. Not as many people use it, or even look for it, and its smaller range may work to assist you in preventing spillage outside your building. Lastly, it’s not necessarily the higher frequency itself that causes the distance limitation; instead, it’s how common building materials and propagation issues interact with it. It’s overly complicated, but if you are of a mind to do so and have some time to kill, you’ll find this topic fascinating to read about.
B is incorrect because 802.11b operates at 11 Mbps on the 2.4 GHz frequency range. It’s slower than “a” and “g,” but soon after its release it became the de facto standard for wireless. Price and network range contributed to this.
D is incorrect because 802.11n works at 100 Mbps (+) in frequency ranges from 2.4 to 5 GHz. It achieves this rate using multiple in, multiple out (MIMO) antennas.
PE7.8 The team has discovered an access point configured with WEP encryption. What is needed to perform a fake authentication to the AP in an effort to crack WEP? (Choose all that apply.)
A. A captured authentication packet
B. The IP address of the AP
C. The MAC address of the AP
D. The SSID
C, D. Cracking WEP generally comes down to capturing a whole bunch of packets and running a little math magic to crack the key. If you want to generate traffic by sending fake authentication packets to the AP, you need the AP’s MAC address and the SSID to make the attempt.
A and B are incorrect because this information is not needed for a fake authentication packet. Sure, you can capture and replay an entire authentication packet, but it won’t do much good, and the IP is not needed at all.
PE7.9 Which of the tools listed here is a passive discovery tool?
A. Aircrack
B. Kismet
C. NetStumbler
D. Netsniff
B
B. A question like this one can be a little tricky, depending on its wording; however, per the EC-Council, Kismet works as a true passive network discovery tool, with no packet interjection whatsoever. The following is from www.kismetwireless.net: “Kismet is an 802.11 layer 2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and (with appropriate hardware) can sniff 802.11b, 802.11a, 802.11g, and 802.11n traffic. Kismet also supports plugins which allow sniffing other media.” You might also see two other interesting notables about Kismet on your exam: First, it works by channel hopping, attempting to discover as many networks as possible. Second, it has the ability to sniff packets and save them to a log file, readable by Wireshark or tcpdump.
A is incorrect because Aircrack is “an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, as well as the all-new PTW attack” (www.aircrack-ng.org).
C is incorrect because NetStumbler is considered an active network discovery application. NetStumbler is among the most popular wireless tools you might see in anyone’s arsenal.
D is incorrect because Netsniff is included as a distractor and is not a valid tool.
PE7.10 You have discovered an access point using WEP for encryption purposes. Which of the following is the best choice for uncovering the network key?
A. NetStumbler
B. Aircrack
C. John the Ripper
D. Kismet
B
B. Aircrack is a fast tool for cracking WEP. You’ll need to gather a lot of packets (assuming you’ve collected at least 50,000 packets or so, it’ll work swimmingly fast) using another toolset, but once you have them together, Aircrack does a wonderful job cracking the key. One method Aircrack uses that you may see referenced on the exam is KoreK implementation, which basically involves slicing bits out of packets and replacing them with guesses—the more this is done, the better the guessing and, eventually, the faster the key is recovered. Other tools for cracking WEP include Cain (which can also use KoreK), KisMac, WEPCrack, and Elcomsoft’s Wireless Security Auditor tool.
A is incorrect because NetStumbler is a network discovery tool. It can also be used to identify rogue access points and interference and is also useful in measuring signal strength (for aiming antennas and such).
C is incorrect because John the Ripper is a Linux-based password-cracking tool, not a wireless key discovery one.
D is incorrect because Kismet is a passive network discovery (and other auditing) tool but does not perform key cracking.
PE7.11 Which of the following statements are true regarding TKIP? (Choose all that apply.)
A.Temporal Key Integrity Protocol forces a key change every 10,000 packets.
B.Temporal Key Integrity Protocol ensures keys do not change during a session.
C.Temporal Key Integrity Protocol is an integral part of WEP.
D.Temporal Key Integrity Protocol is an integral part of WPA.
A, D. TKIP is a significant step forward in wireless security. Instead of sticking with one key throughout a session with a client and reusing it, as occurred in WEP, Temporal Key Integrity Protocol changes the key out every 10,000 packets or so. Additionally, the keys are transferred back and forth during an Extensible Authentication Protocol (EAP) authentication session, which makes use of a four-step handshake process in proving the client belongs to the AP, and vice versa. TKIP came about in WPA.
B and C are simply incorrect statements. TKIP does not maintain a single key (it changes the key frequently), and it is part of WPA (and WPA2), not WEP.
PE7.13 You are discussing WEP cracking with a junior pen test team member. Which of the following are true statements regarding the initialization vectors? (Choose all that apply.)
A. IVs are 32 bits in length.
B. IVs are 24 bits in length.
C. IVs get reused frequently.
D. IVs are sent in clear text.
E. IVs are encrypted during transmission.
F. IVs are used once per encryption session.
B, C, D. Weak initialization vectors and poor encryption are part of the reason WEP implementation is not encouraged as a true security measure on wireless networks. And, let’s be fair here, it was never truly designed to be, which is why it’s named Wired Equivalent Privacy instead of Wireless Encryption Protocol (as some have erroneously tried to name it). IVs are 24 bits in length, are sent in clear text, and are reused a lot. Capture enough packets, and you can easily crack the code.
A, E, and F are incorrect statements. IVs are not 32 bits in length, are not encrypted themselves, and are definitely not used once per session (that would be even worse than being reused).
PE7.12 Regarding SSIDs, which of the following are true statements? (Choose all that apply.)
A.SSIDs are always 32 characters in length.
B.SSIDs can be up to 32 characters in length.
C.Turning off broadcasting prevents discovery of the SSID.
D.SSIDs are part of every packet header from the AP.
E.SSIDs provide important security for the network.
F.Multiple SSIDs are needed to move between APs within an ESS.
B, D. Service set identifiers have only one real function in life, so far as you’re concerned on this exam: identification. They are not a security feature in any way, shape, or form, and they are designed solely to identify one access point’s network from another’s—which is part of the reason they’re carried in all packets. SSIDs can be up to 32 characters in length but don’t have to be that long (in fact, you’ll probably discover most of them are not).
A is incorrect because SSIDs do not have to be 32 characters in length. They can be, but they do not have to fill 32 characters of space.
C is incorrect because “cloaking” the SSID really doesn’t do much at all. It’s still part of every packet header, so discovery is relatively easy.
E is incorrect because SSIDs are not considered a security feature for wireless networks.
F is incorrect because an extended service set (ESS, an enterprise-wide wireless network consisting of multiple APs) requires only a single SSID that all APs work with.
PE7.14 A pen test member has configured a wireless access point with the same SSID as the target organization’s SSID and has set it up inside a closet in the building. After some time, clients begin connecting to his access point. Which of the following statements are true regarding this attack? (Choose all that apply.)
A.The rogue access point may be discovered by security personnel using NetStumbler.
B.The rogue access point may be discovered by security personnel using NetSurveyor.
C.The rogue access point may be discovered by security personnel using Kismet.
D.The rogue access point may be discovered by security personnel using Aircrack.
E.The rogue access point may be discovered by security personnel using ToneLoc.
A, B, C. Rogue access points (sometimes called evil twin attacks) can provide an easy way to gain useful information from clueless users on a target network. However, be forewarned: security personnel can use multiple tools and techniques to discover rogue APs. NetStumbler is one of the more popular, and useful, tools available. It’s a great network discovery tool that can also be used to identify rogue access points, network interference, and signal strength. Kismet, another popular tool, provides many of the same features and is noted as a “passive” network discovery tool. NetSurveyor is a free, easy-to-use Windows-based tool that provides many of the same features as NetStumbler and Kismet and works with virtually every wireless NIC in modern existence. A “professional” version of NetSurveyor is now available (you get ten uses of it before you’re required to buy a license). Lastly, identifying a rogue access point requires the security staff to have knowledge of every access point owned—and its MAC. If it’s known there are ten APs in the network and suddenly an 11th appears, that alone won’t help find and disable the bad one. It takes some level of organization to find these things, and that plays into your hands as an ethical hacker. The longer your evil twin is left sitting there, the better chance it will be found, so keep it short and sweet.
D is incorrect because Aircrack is used to crack network encryption codes, not to identify rogue access points.
E is incorrect because ToneLoc is a tool used for war dialing (identifying open modems within a block of phone numbers). As an aside, this was also the moniker for a 1980s two-hit-wonder rapper, although I can promise that won’t be on your exam.
PE7.15 A pen test member is running the Airsnarf tool from a Linux laptop. What is she attempting?
A.MAC flooding against an AP on the network
B.Denial-of-service attacks against APs on the network
C.Cracking network encryption codes from the WEP AP
D.Stealing usernames and passwords from an AP
D. Identifying tools and what they do is a big part of the exam—which is easy enough because it’s pure memorization, and this is a prime example. Per the tool’s website (http://airsnarf.shmoo.com/), “Airsnarf is a simple rogue wireless access point setup utility designed to demonstrate how a rogue AP can steal usernames and passwords from public wireless hotspots. Airsnarf was developed and released to demonstrate an inherent vulnerability of public 802.11b hotspots—snarfing usernames and passwords by confusing users with DNS and HTTP redirects from a competing AP.” It basically turns your laptop into a competing AP in the local area and confuses client requests into being sent your way.
A is incorrect because Airsnarf does not provide MAC flooding. You may want to MAC flood a network switch for easier sniffing, but that doesn’t work the same way for an access point on a wireless network.
B is incorrect because Airsnarf is not a DoS tool. You can make an argument the clients themselves are denied service while they’re erroneously communicating with the Airsnarf laptop, but it’s not the intent of the application to perform a DoS attack on the network. Quite the opposite: the longer things stay up and running, the more usernames and passwords that can be gathered.
C is incorrect because Airsnarf is not an encryption-cracking tool. It reads a lot like “Aircrack,” so don’t get confused (these will be used as distractors for one another on your exam).
