Wireless Security Flashcards
Wireless clients identify an AP by it’s IP address, TRUE or FALSE?
FALSE. They identify by the SSID
What feature of wireless LAN control protocols help detect rogue APs?
The WLAN controller protocols (LWAPP and CAPWAP) use Radio Resource Management that checks for rogue activity
How does Cisco Unified Wireless Network help to defend against unauthorized access to the corporate LAN through insecure ad-hoc networks?
It sends out DEAUTHENTICATION frames to stop ad hoc association
How can Management Frame Protection protect from DoS attacks on the wireless network?
Because DoS attacks use association frames to flood the network, and those frames are classed as management frames, MFP can prevent the deluge
How do wireless LAN DoS attacks typically work?
By flooding the network with deauthentication or disassociation frames to remove hosts from their networks
In infrastructure mode, what does an AP do when it receives an MFP protected frame from an unknown SSID?
It queries the controller for the key. If the BSSID isn’t in recognized by the controller it will drop the frame.
Describe the difference between and IDS and IPS
1) IDS purely detects malicious behaviours
2) An IPS will detect and block malicious behaviours
What is open authentication?
authenticating by supplying the SSID
Why isn’t WEP used in today’s VLANs
Because it sends the challenge in clear-text
Which networking access protocol is required under 802.1x to authenticate credentials for WPA/WPA2 Enterprise
RADIUS (Remote Authentication Dial-In User Service)
802.1x provides AAA services, true or false?
True
Once RADIUS authenticates, what does it allow us to do with those connections?
1) Specify the type of rights a user has
2) Control what they can do on the network
3) Records all access attempts and actions
Which two groups created Temporal Key Integrity Protocol?
802.11i and the Wi-Fi Alliance
What’s the difference between WPA and WPA2?
WPA2 uses the stronger AES-CCMP encryption
What is the PSK and how is it used by TKIP and AES?
Pre-Shared Key. It verifies users on an AP using a passphrase (i.e. the wifi password). The PSK also provides keying material for TKIP and AES to generate keys for each packet transmitted.
What 3 things are wireless packet keys made up of?
1) base key
2) transmitting device’s MAC address
3) packet’s serial number
What encryption alogorithm does TKIP use?
RC4
What’s the difference between WEP and TKIP transmitted packets?
WEP uses the same encryption key for each packet, TKIP encrypts a different key on each packet transmitted. (this is the Temporal part of the acronym)
What are nonces and what part of a packet key uses it?
Nonces are an assortment of random numbers gleaned from the workstation. They’re used to construct the base key.
How long is the encryption key used in TKIP and AES-CCMP?
TKIP - 128
AES - 256
What key feature makes TKIP more secure than WEP?
It changes the key for each packet
List in order from most secure 4 wireless security options
1) WPA2-PSK/AES
2) WPA2-PSK/TKIP
3) WPA-PSK/AES (mostly redundant option)
4) WPA-PSK/TKIP
Which security protocol should ideally be disabled to prevent hackers gaining the PSK for WPA or WPA2?
Wi-Fi Protected Setup
What is the most secure form of authentication and authorization on a WLAN?
WPA2 using Extensible Authentication Protocol to use security certificates to identify devices connecting to the AP
What do you need implemented to use EAP and certificates to authenticate devices?
Public Key Infrastructure (Server that issues certificates)
List the more secure versions of Extensible Authentication Protocol with most secure first.
1) EAP-TLS (Transport Layer Security) (hardest to implement)
2 EAP-FAST (Flexible Authentication via Secure Tunneling)
3) PEAP
You’re configuring PEAP, where do you need to install the PKI certificate?
Server only
EAP-TLS needs certificate only on the server side, TRUE or FALSE?
FALSE, both server and client require certificates installed
TKIP uses what two things to seed the RC4 algorithm?
1) MAC address
2) Initialization Vector
TKIP works with Message Integrity Checks to check the integrity of messages received at the access point. How many MIC CRCs need to fail and within what timer frame and then what happens if they do?
2 or more fail
Within 60 seconds
AP requires TKIP to rekey the RC4 seed value
CCMP stands for?
Counter Cipher Mode with Block Chaining Message Authentication Code
Which wireless security standard was deprecated in 2006?
WPA
What’s the difference between personal mode and enterprise mode?
Authentication method.
Personal mode is for home use and uses a PSK
Enterprise mode is for organizations that can use 802.1x methods to authenticate.
EAP-Flexible Authentication via Secure Tunnelling replaced Cisco’s LEAP - TRUE or FALSE
TRUE
EAP-FASTs 3 phases involve what
Phase 0 - shared secret (like a key/passphrase) agreed
Phase 1 - secure tunnel established
Phase 2 - Authentication occurs
Which version of EAP is an open standard and was defined by the IETF?
EAP-TLS
Which EAP method underpins WPA and WPA2 enterprise authentication?
EAP-TLS
Why is EAP-TLS harder to manage/implement?
Because it requires certificates on both client and server side
Which type of EAP that uses TLS comes built in for support on Windows operating systems?
PEAP
Which TLS enabled EAP protocol uses two phases where:
PHASE 1 - establishes an ‘outer’ secure tunnel using EAP-TLS to authenticate the server
PHASE 2 - using an ‘inner’ tunnel to authenticate the client e.g. using EAP-MS-CHAPv2
PEAP
What is the bit-length of the WPA pre-shared key (not the encryption)?
256-bit
EAP was designed to provide an authentication framework for point-to-point connections and wireless connections - true or false?
TRUE
What is the name of the framework who’s purpose is to provide a secure way of transferring keying material and associated parameters for many types of authentication mechanisms?
EAP
Which EAP method was developed by Cisco and is widely adopted on 3rd party network vendors? What is the major draw back?
Lightweight-EAP
It uses MS-CHAP which isn’t a very secure way of transferring user credentials
What are the two AP control protocols?
*LWAPP = Lightweight Access Point Protocol, Cisco CAPWAP = Control and Provisioning of Wireless Access Points
What is the term used to describe when Access Points split duties between ones running a lightweight operating system and a controller?
Split MAC
Which 2 main EAP implementations use tunnelling?
PEAP
EAP-FAST
