Networking & Cellular
E11 Wireless Ops & Security — Study Guide
This guide covers Wireless Ops & Security as part of Networking & Cellular. Start with the vocabulary, then try to answer each question before revealing the answer. Connect these facts to a real network or cellular connection and practice the subject in the arcade when you are ready.
Acronyms first
| Term | Meaning |
|---|---|
| CNE | Computer Network Exploitation |
| CCMP | Counter Mode with Cipher-Block Chaining Message Authentication Protocol |
| KRACK | Key Reinstallation Attack |
| WPS | Wi-Fi Protected Setup |
Key facts
When surveying wireless networks, collection focuses on which frames?
Management frames
Why focus on management frames during a survey?
They're transmitted at the lowest data rates for fewer errors
What should be used with survey data to assign rough network locations?
GPS
All 2.4 and 5 GHz channels must be scanned for a complete survey picture.
True
An analyst's intel drives operations by determining WHERE to go, WHEN to be there, and…
WHAT to collect
Associating selectors with real names, associates and communications is called…
Pattern-of-Life (POL)
Which target nomination option = 'collect to maintain awareness, no action'?
Continue Collection
Why be careful with CNA activities?
Denial effects disrupt future collection and may alert the target
Kill/Capture is the final part of which picture?
Find/Fix/Finish
Which attack places the attacker in the flow to view, modify, or drop frames in real time?
Man-in-the-Middle
A fake Wi-Fi network that looks like a legitimate AP is a…
Rogue AP / Evil Twin
Attackers push victims to associate with a rogue AP by first initiating a…
Deauthentication
Which toolkit sets up rogue APs by immediately replying to Probe Requests?
KARMA
KARMA only works for ____ networks.
unencrypted
Creating IP packets with a modified source address to hide or impersonate is…
IP spoofing
Linking the attacker's MAC with a legitimate user's IP via fake ARP messages is…
ARP spoofing
DNS spoofing is also known as…
DNS cache poisoning
CNA operations are designed to…
Deny, Degrade, Disrupt, or Destroy
A wireless DoS attack can affect stations other than the intended targets.
True
Which attack exploits RTS/CTS by spoofing CTS frames or repeating RTS to an AP?
CTS attack
A CTS attack affects…
all devices on that channel, even other networks in RF range
Wireshark filter for Management frames?
wlan.fc.type eq 0
wlan.fc.type_subtype eq 12 filters…
Deauthentication
wlan.fc.type_subtype eq 4 filters…
Probe Request
wlan.fc.type_subtype eq 5 filters…
Probe Response
wlan.fc.type_subtype eq 0 filters…
Association Request
wlan.fc.type_subtype eq 1 filters…
Association Response
wlan.fc.type_subtype eq 27 filters…
Request to Send (RTS)
wlan.fc.type_subtype eq 28 filters…
Clear to Send (CTS)
The INTENTIONAL use of RF energy to deny or degrade wireless comms is…
Jamming
The UNINTENTIONAL degrading of a frequency by RF-emitting devices is…
Interference
Find/Fix is conducted in support of…
Kill/Capture operations
Geolocating a device guarantees a specific user is using it.
False
An antenna array produces lines with direction but no distance called…
LOBs (Lines of Bearing)
Multiple LOBs from different angles create a…
Fix
Geolocation results are usually expressed in…
10-digit MGRS
Geolocation measurements include TOA, TDOA, and…
FDOA (Frequency Difference of Arrival)
Exploiting naturally sent signals without transmitting any frames is…
Passive exploitation
Keylogging is given as an example of…
Passive exploitation
If encryption is on, what gets encrypted in an 802.11 data frame?
Only the payload
WEP was ratified in…
1997
WEP uses which cipher and integrity check?
RC4 and CRC-32
WEP's initialization vector is how many bits?
24
WEP secret key length?
40–104 bits
WEP max payload?
2312 bytes
WEP was decommissioned in…
2004
WPA uses which protocol as an interim fix for WEP?
TKIP (Temporal Key Integrity Protocol)
Why does TKIP still use RC4?
It had to work on existing hardware under time constraints
TKIP uses ___ bits for encryption, with different keys per packet.
128
TKIP max payload?
2324 bytes
The two modes of WPA operation?
WPA Enterprise and WPA Pre-Shared Key
WPA2 draws on FIPS-197, which introduced…
AES (Advanced Encryption Standard)
Which is the most common Wi-Fi security in use today (per slides)?
WPA2
WPA2 requires which protocol?
CCMP
AES is a standard, not a protocol; CCMP is the protocol.
True
In CCMP, counter-mode provides ____; CBC-MAC provides ____.
data privacy; authentication & integrity
WPA2 passphrase auth targets SOHO; enterprise networks use…
802.1X/EAP
Which tool (pre-installed in Kali) is a sniffer, WEP/WPA cracker, and hash capture tool?
Aircrack
A brute force attack on a 40-bit WEP key with a weak generator can take…
less than a minute
The three main kinds of brute force attacks?
Simple, Hybrid, Reverse
Guessing based on personal details (birth year as PIN) without tools is…
Simple brute force
Combining dictionary words with numbers/characters ('Rover2020') is…
Hybrid brute force
Testing ONE leaked password against MANY user IDs is…
Reverse brute force
Order the steps of a passive WPA attack.
Capture packets with a sniffer (aircrack) → Wait for a client to authenticate (4-way handshake) → Run an offline brute force on the passphrase
Which attack truncates the last byte of an encrypted packet and guesses it, exploiting the CRC32 ICV?
Chop Chop
Chop Chop averages how many guesses per byte?
128
Most secure encryption for PERSONAL wireless networks (per slides)?
WPA2-PSK (AES)
KRACK attacks which part of WPA2?
The 4-way handshake
KRACK targets…
users/clients, not the AP itself
In the WPA2 handshake, the client hashes the shared key salted with the SSID using…
SHA-1
KRACK works against…
WPA2-PSK and WPA2-Enterprise
Which is NOT a goal of a deauthentication attack?
Encrypt the target's traffic
Deauth can force a Windows client to flush its ___ cache and send a request.
ARP
The goal of an ARP Request Replay attack is to force new…
Initialization Vectors (IVs) to crack WEP
TKIP protects against replay attacks by adding a…
sequence counter
WPA2 started in…
2004
WPA-PSK gives every user the same ___-bit key.
256
Which mode gives each user a DIFFERENT authentication method — no shared key?
WPA-Enterprise
WPS is highly vulnerable to brute force using the…
PIN method
Practice this module
Continue with a Networking & Cellular game. Choose this module in games that offer module selection.