By Paul Rubens

December 27, 2007

Rogue access points, weak passwords and poor security standards plague every network administrator. Aircrack-ng can help you sniff out these problems and take care of them, before your network gets taken care of by someone less benign.

Rogue access points and weak passwords are the bane of any network administrator’s life: all it takes is one user setting up a consumer-grade wireless router in the cube farm so he or she can use a PDA or whatever and you’ve got yourself a potentially serious security risk. It’s quite possible that the wireless signal is leaking out into the street, and anyone passing by could get access to your network – even if they are using WEP, WPA or WPA2 encryption.

But it’s not just rogue APs that are a worry. If you’re not using WPA-Enterprise or WPA-Enterprise (both of which use a RADIUS server) in your organization, then any wireless networks you are running using WEP, WPA or WPA2 are also at risk.

That’s where Aircrack-ng can be useful. This open source suite of applications can help you locate all the access points in your offices, check that the networks are protected by encryption, and test the strength of the keys or passphrases that are in use. If any networks uses WEP encryption, it will usually find the relevant WEP key in under a couple of minutes, demonstrating that WEP is totally ineffective.You can use Aircrack-ng with any wireless laptop, but make sure to catch our previous articles on building a dedicated network security machine with the ultra-portable eeePC and Ubuntu Linux:

• Build a Portable Security Tool with the ASUS Eee PC and Ubuntu
• Master Port Scanning with Nmap

Before you can start you’ll need to download and install Aircrack-ng. On an eeePC running Ubuntu you can do this via Synaptic. On any other device you can check you can find it at http://www.aircrack-ng.org/doku.php?id=downloads.

In order carry out attacks on wireless networks efficiently you’ll almost certainly need to patch your wireless drivers to support packet injection – patches and details of how to do this can be found at http://www.aircrack-ng.org/doku.php?id=install_drivers. At the time of writing a suitable Madwifi driver and patch for the eeePC’s built in wireless card had been released but then withdrawn, but it’s likely that an “official” one will be available very soon. Pre-patched drivers are also included with some live Linux security distributions such as BackTrack2, and can be used with many laptops and wireless cards.

Capture Packets with Monitor Mode

Once you’ve got the necessary patched drivers installed, the next step is to put the wireless card into monitor (also known as RFMON) mode so that it can capture packets without associating with any particular network.

The way to do this varies slightly from one driver to another, but for cards using Madwifi drivers the best way to do this is to become root and from a terminal session type:

    iwconfig

and then:

    airmon-ng stop ath0

(replacing ath0 with the name of the active wireless interface displayed by iwconfig)

and then:

    airmon-ng start wifi0

Issuing another iwconfig command should confirm a new interface – probably ath0 – has been placed in monitor mode.

Now, to scan for access points, type:

    airodump-ng ath0

This will show you any networks detected, the MAC addresses of the access points (BSSID), the MACs of any computers which are connected to them (STATION), and the wifi channels they are operating on. If the access point is broadcasting its name (ESSID), this will also be shown. (see Figure 1.)

Audit Wireless Access Points

If you find any rogue access points, at this point you can take steps to find their owners and make sure they are closed down. But what about your official ones? How secure are they?

Here’s how to find out.

Firstly, if they wireless networks are secured by WEP, then as mentioned above the answer is “not secure at all.” Here’s proof:

First, make a note of the channel of the WEP protected access point you want to test from the Airodump-ng window. In the case above the channel (CH) is channel 1.

Next, quit airodump-ng by doing a control-c , then restart it by typing:

    airodump-ng -c X -w mycapture ath0

changing the X for the channel number of your access point. This will start capturing data which you will use to crack the WEP key, in a file called mycapture-01.cap in your home directory.

Next you’ll need to inject some traffic onto the network. To do this you can use Aircrack-ng’s packet injection tool, Aireplay-ng, to monitor the network and wait for an ARP request, and then re-inject (or replay) this ARP request over and over again. This stimulates a response from the access point, until enough packets have been collected to crack the WEP key.

How many is enough? 40,000 packets will be enough 50 per cent of the time, while 85,000 packets gives you a 95% chance of success.

To inject the ARP requests onto the network, you’ll first need to look in the Airodump-ng window and make a note of the MAC addresses of the base station and a connected client.

Then start aireplay, by typing:

    aireplay-ng -3 –b 'base station MAC address' –h 'client Mac address' ath0

(The -3 in the command tells aireplay-ng to search for ARP requests and then replay them)

As soon as an ARP request is received, aireplay-ng will start injecting it back onto the network, and airodump-ng will start collecting packets in the file mycapture-01.cap. (see Figure 2.)

To crack the key, all that’s required is to start Aircrack-ng, and tell it to work on the data in mycapture-01.cap using a statistical attack known as PTW, which is activated using the –z option:

    aircrack-ng –z mycapture-01.cap

Wait a minute or two, and in most cases you’ll have the WEP key to the network. If you can do that, then so can a hacker. The moral of the story is never, ever rely on WEP for any sort of network protection. (see Figure 3.)