-: So, we've talked about securing our wireless networks.
Let's now spend a few minutes talking about
the different types of attacks that focus
on our wireless networks.
The first is war driving.
War driving is the act of searching for wireless networks
by driving around until you find them.
You could try this tonight.
You can go sit in the backseat of your car,
have your friend or your wife
drive you around the neighborhood
and see which networks you can connect to.
That's the idea here.
They're simply going to drive around and hunt for networks.
Now, the attackers here are going to use
different tools to do this.
They can use wireless survey tools
or other open source attack tools,
but the common theme here is just finding out
what networks are around and where you can access them from.
Why would an attacker want to find open wireless networks
or networks that they can get on to?
It's not necessarily to attack your network,
but it's to attack other networks through your network.
So, that way, if they are doing some hacking
or something like that,
it traces back to your home and your home network,
as opposed to tracing it back to them.
The next type of attack is called war chalking.
War chalking is the act of physically drawing symbols
in public places to denote the open, closed,
or protected networks that are in range.
It gets its name because in the early days,
people would actually take chalk
and draw on a telephone pole different symbols
to tell other people what it is.
Now, an example of this might be
as you're doing a war driving,
you might find an open network.
If you did, you could find a telephone pole nearby,
you can mark it down with a symbol like this.
We have two open half circles faced back to back
with the SSID of it written above them
and the number below to signify the bandwidth
of the network.
After all, attackers can be nice people too.
And they like to share their findings with others
and they wouldn't want somebody else wasting
their time looking for a network,
only to find it has low bandwidth.
So, by marking that down,
you can help other people avoid that network.
Now, in addition to open networks,
you may find closed networks.
If you find a closed network,
it's going to be a closed circle with an SSID
written above it and bandwidth written below it.
This tells us that that network has some kind of encryption,
it's closed,
but we haven't quite figured out the password yet.
Now, if we do figure out the password,
we can actually use this other symbol.
We have the closed circle,
we have the SSID on the top left left,
we have the password on the top right,
and the bandwidth below it.
Inside the circle, we might write something like
W or WEP or WPA2,
so people know what type of encryption
they need to connect to that network.
Now, as I said, war chalking is not nearly as popular
as it used to be.
In fact, we don't really see a lot of these symbols
around in the city anymore.
Instead, most of this is being done digitally.
This is being done as part of websites
or other apps that hackers use and share their finds,
so people know what other kind of Wi-Fi is out there.
The next attack we have is known as an IV attack.
An IV attack occurs when an attacker
observes the operation of a cipher being used
with several different keys and they find
this mathematical relationship between those keys
to determine the clear text data.
Now, I know that sounds really complicated,
but the good news is you don't have to do the math to do it.
There's programs that do it for you.
This happened with WEP because of that 24-bit
initialization vector.
It makes it very easy to crack WEP
because there's programs that do it for us.
In the next lesson, as I've been promising,
I'm going to show you how we break WEP
in just a couple of minutes.
The next attack we have
is known as a Wi-Fi disassociation attack.
This is going to target an individual client
that's connected to the wireless network.
It's going to force it offline
by sending deauthentication packets to it,
and then it's going to capture the handshake that
that client makes when it attempts to reconnect.
This is used as part of an attack on WPA or WPA2.
Our final attack is known as a brute force attack.
A brute force attack occurs when an attacker
continually guesses at a password until they finally
get the correct one.
So, an example of this might be
that you have the password of dog,
and I know that your password is three characters long.
So, I start out guessing AAA, AAB, AAC,
and I keep going until I get to DOF and finally DOG,
dog, I've found your password.
That's what a brute force does.
Now, eventually, you'll find every password out there.
Any password can be brute forced.
It's just a matter of how much time
and power it's going to take.
If you have a three-letter password like dog,
it's not going to take me very long.
But, if you use the passwords like I tell you,
14 characters, upper case, lower case, special characters,
and numbers, that's a long, strong, complex password.
It can take a million years
or more with current processing power,
and that way you can prevent
a brute force attack from happening.