WOTS WIRELESS OBSCURITY THROUGH SECURITY. Marko Laakso, Jani Kenttälä, Pekka Pietikäinen. Oulu University Secure Programming Group

Transcription

1 WOTS WIRELESS OBSCURITY THROUGH SECURITY Marko Laakso, Jani Kenttälä, Pekka Pietikäinen Oulu University Secure Programming Group

2 t h i n k g l o b a l

3 t h i n k l o c a l

4 L a y e r i n g v i o l a t i o n s B u f f e r o v e r f l o w e x p l o i t s F o r m a t s t r i n g e x p l o i t s S Q L i n j e c t i o n Wo r m s c o m p l e x i t y i n s i m p l e n e t w o r k

5 authentication server PPP RFC1661, RFC1662; Frame relay FRF.1, RFC1490 HDLC ; IP RFC791 ; Ipv6 over Ipv4 supported, RFC2529 ; Ipv6 over Ipv4 tunneling supported, RFC2185 ; Network time protocol RFC1305 ; Network address translation (NAT) ; DHCP RFC2131 ; CIDR RFC1519 ; ICMP Router Discovery (server portion) RFC1256 ; ICMP RFC792 ; ARP RFC826 Route aggregation ; Requirements for IPv4 routers RFC1812 ; Route redistribution ; DVMRP RFC1075 ; IGMPv2 RFC2236 ; PIM-SM ; Multicast tunnels ; PIM-DM (multicast) ; RIPv1 RFC1058 ; VRRP RFC2338 ; OSPFv2 RFC2328 ; RIPv2 (with authentication) ; RFC1723 ; IGRP (optional) ; Static routing BGP4 (optional, available ; only for IP330) RFC1771 ; Supports IEEE802.1x authentication framework GRE tunneling ; SSL versions 2 and 3, TLS ; version 1 supported ; Native IPSec (IKE, AH, ESP) ; SSH server, versions 1 and 2 ; supported ; MD5 Routing Authentication ; (RIPv2) RFC1723 ; SNMPv3 with User-Based Security Model ; Radius client RFC2865 Radius accounting client ; RFC2866 ; Proxy Radius RFC2865 ; Virtual Router Redundancy ; Protocol RFC2338 ; Traffic management ; SSL/TLS RFC2246 ; SSL/TLS RFC2216 ; SSH server, versions 1 and 2 supported ; SNMP, SNMPv2 and SNMPv3 CLI via Telnet RFC854 ; RFC959 ; SMTP mail (send) RFC821 ; RFC1760 ; SNMP and SNMP MIB II RFC1213 ; RADIUS auth.client MIB RFC2618 ; RADIUS acc.client MIB RFC2620 ; P022 MIB ; DiffServ, EF) RFC2598 ; 1350 The TFTP Protocol K i t c h e n s i n k? e x a m p l e p r o t o c o l s

6 W EP 3 RC4 y e a h, b u t w e w a n t t o a u t h e n t i c a t e

7 X 2 EAPOL Start Key packet Logoff AAA 3 EAP RADIUS M icrosoft, certificate based Func Software Inc, usernam e based possible 4 EAP-M D5 EAP-TLS EAP-TTLS 5 W EP 6 RC4 i t s e x t e n s i b l e a f t e r a l l

8 X 2 EAPOL Start Key packet Logoff AAA 3 EAP RADIUS, lightweight M icrosoft/ branches,tunneled M icrosoft, certificate based Func Software Inc, usernam e based possible 4 EAP-LEAP EAP-PEAP EAP-M D5 EAP-TLS EAP-TTLS 5 W EP 6 RC4 but WEP sucks or does it?

9 X 2 EAPOL Start Key packet Logoff AAA 3 EAP RADIUS M icrosoft, certificate based Func Software Inc, usernam e based possible, lightweight M icrosoft/ branches,tunneled 4 EAP-M D5 EAP-TLS EAP-TTLS EAP-LEAP EAP-PEAP 5 W EP TKIP 6 W eak IV evade IV Size M IC 7 RC4 i t i s s t i l l e x t e n s i b l e

10 X i o f e EAPOL Start Key packet Logoff AAA 3 W PA RobustSecurity Network Transition Security Network EAP RADIUS M icrosoft, certificate based Func Software Inc, usernam e based possible, lightweight M icrosoft/ branches,tunneled Nokia fastreauth Ericsson Nokia 4 EAP-M D5 EAP-TLS EAP-TTLS EAP-LEAP EAP-PEAP EAP-SIM EAP-FAST EAP-AKA 5 W EP TKIP 6 W eak IV evade IV Size M IC 7 RC4 wireless obscurity through security

11 1 W ireless O bscurity Through Security Portbased authentication X 3 EAPOL Start Key packet Logoff AAA i o f e 4 EAP RADIUS W PA RobustSecurity Network Transition Security Network M icrosoft, certificate based Func Software Inc,, usernam e based lightweight possible M icrosoft/ branches,tunneled Nokia fastreauth Ericsson Nokia 5 EAP-M D5 EAP-TLS EAP-TTLS EAP-LEAP EAP-PEAP EAP-SIM EAP-FAST EAP-AKA 6 W EP TKIP 7 W eak IV evade IV Size M IC 8 RC4 standardization, QoS and interop

12 1 W ireless O bscurity Through Security Portbased authentication X Security BS interoperability Quality ofservice i f e EAPOL Start Key packet Logoff o 4 Transition Security Network RobustSecurity Network EAP subset M icrosoft, certificate based Func Software Inc, usernam e based possible, lightweight M icrosoft/ branches,tunneled Nokia fastreauth Ericsson Nokia Siem ens Toshiba 5 W PA EAP-M D5 EAP-TLS EAP-TTLS EAP-LEAP EAP-PEAP EAP-SIM EAP-FAST EAP-AKA EAP-IKEv2 6 W EP TKIP AAA CCM P W RAP 7 M IC W eak IV evade IV Size RADIUS 8 M andatory Optional,IPR issues 9 10 AES in CCM -mode AES in OCB-mode 11 CCM -m ode AES OCB-m ode TLS 12 Counter-m ode CBC-M AC 13 RC4 Rijndael more security IPR issues

13 1 W ireless Obscurity Through Security Portbased authentication X Quality ofservice Security BS interoperability e i f EAPOL Start Key packet Logoff o 4 Transition Security Network RobustSecurity Network EAP subset Func Software Inc, usernam e based possible, lightweight M icrosoft, certificate based Nokia fastreauth Ericsson Nokia Siem ens Toshiba M icrosoft/ branches,tunneled 5 W PA EAP-TTLS EAP-LEAP EAP-TLS EAP-SIM EAP-FAST EAP-AKA EAP-IKEv2 EAP-M D5 EAP-PEAP M icrosoft M icrosoft 6 W EP TKIP AAA W RAP CCM P EAP-PEAPv1 EAP-PEAPv0 7 Key M anagem ent W eak IV evade IV Size M IC RADIUS 8 Preshared Key ServerBased Key Optional,IPR issues M andatory 9 EAPOL encryption Pairwise M asterkey [EAPOL integrity] Data Encryption [Data Integrity] Group M asterkey Group Encryption [Group Integrity] 10 Pairwise TransientKey Group TransientKey AES in OCB-m ode AES in CCM -m ode 11 OCB-m ode CCM -m ode TLS AES 12 CBC-M AC Counter-m ode 13 RC4 RSA M D5 Diffie-Hellm an SHA Rijndael M SCHAPv2 key management

14 1 W ireless Obscurity Through Security Portbased authentication X Security BS interoperability Quality ofservice 3 EAPOL Start Key packet Logoff i f e o 4 EAP RobustSecurity Network M ixed m ode (Vendorspecific NotW i-fitested) Transition Security Network fastreauth Ericsson Nokia Siem ens Toshiba M icrosoft, certificate based Nokia M icrosoft/ branches,tunneled Func Software Inc, usernam e based possible, lightweight subset 5 EAP-FAST EAP-AKA EAP-IKEv2 EAP-TLS EAP-M D5 EAP-SIM EAP-PEAP EAP-TTLS EAP-LEAP W PA M icrosoft M icrosoft 6 PSEUDONYM FAST REAUTH IM SI EAP-PEAPv0 EAP-PEAPv1 W RAP CCM P AAA TKIP W EP 7 EAP-PEAPv2 Key M anagem ent RADIUS IV Size M IC W eak IV evade 8 EAP-TLV Preshared Key ServerBased Key Optional,IPR issues M andatory 9 Crypto-Binding-TLV Result-TLV Group M asterkey Group Encryption [Group Integrity] EAPOL encryption Pairwise M asterkey [EAPOL integrity] Data Encryption [Data Integrity] 10 Group TransientKey Pairwise TransientKey AES in OCB-m ode AES in CCM -m ode 11 TLS OCB-m ode AES CCM -m ode 12 CBC-M AC Counter-m ode 13 M SCHAPv2 M D5 Diffie-Hellm an SHA RSA Rijndael RC4 got too slow - need faster specs

15 [9:26] ee-cn0002:/research/ouspg/ development/frontier/sota/citywlan- 2005/dot> dot -Tps ots-10.dot >../13-actually-eap-was-not-good-letsadd-another-framework.ps Segmentation fault (core dumped) ACTUALLY EAP (802.1X) WAS NO GOOD - LETS ADD ANOTHER FRAMEWORK core dumped

16 e x p e r i m e n t B ( 1 / 2 )

17 1 WiFipedia X 802.1AA GB HiperAccess MiscProprietarySolutions i o f e a c e DOCSIS WDS RADIUS 4 EAPOL RSN TSN Subset 5 EAP-IKEv2 EAP-MD5 EAP-GTC EAP-OTP EAP-TLS EAP-LEAP EAP-TTLS EAP-PEAP EAP-SIM EAP-FAST EAP-AKA WPA 6 WRAP CCMP TKIP WEP WAPI 7 Key-Management Weak-IV-evade increased-iv-size Michael MS-Chap-MPPE-Keys Server-Based-Keys Preshared-Key Pairwise-Master-Key Group-Master-Key 8 Pairwise-Transient-Key Group-Transient-Key 9 10 AES-in-OCB-mode AES-in-CCM-mode 11 TLS AES X CBC-MAC Counter-Mode 13 SHA RSA MD5 Diffie-Hellman Rijndael RC4 MSCHAPv2 e x p e r i m e n t B ( 2 / 2 )

18 e x p e r i m e n t C ( 3 / 3 )

19 t r a d i t i o n a l m e t h o d s ( 2 / 2 )

20 proto 1 in practice

21 p r o t o 2 i n p r a c t i c e

22 LINES 10 APPLICATION CODE BUGS LIBRARY CODE KERNEL / OS / CPU CODE c o m p l e x i t y f a l l o u t

23 kiss T H E E N D h t t p : / / w w w. e e. o u l u. f i / r e s e a r c h / o u s p g /