60-564 Security and Privacy in the Internet

Dr. A. K. Aggarwal

Aniss M Zakaria

Tuesday, November 2, 2004

Wireless Network Security: NoCat

Wireless Network Security: NoCat

Agenda:

• Introduction

• Securing Wireless Network

• NoCat

• What is NoCat?

• Installation

• Testing

•Conclusion

Wireless Network Security: NoCat

Introduction:

• Wireless Network uses Radio waves (2.4 GHz unlicensed spectrum).

• Typically have zones with a range of 100-1000 feet; signals pass through walls.

• Wireless technology used in Data networks, i.e., local area networks (wireless LANs).

• IEEE 802.11 is the standard for WLANs which comes with three versions IEEE 802.11a,b,g, each has its own speed, range and radio frequency (b and g standards uses the same 2.4 GHz).

Wireless Network Security: NoCat

Introduction:

Wireless Threats:

• Medium is open to everybody in the frequency range.

• DoS attacks.

Jamming, Fake Collisions.

• Integrity attacks.

Packet capture, modified and then reinjected.

• Confidentially attacks.

Capture passwords.

• Authentication attacks.

Anonymity of attacker, Spoofing and Unauthorized access.

Wireless Network Security: NoCat

Securing Wireless Network :

• Change default SSID NetStumbler

• Disable SSID broadcasting

• Enable Encryption (WEP and WPA)

WEPCrack and AirSnort

• Use MAC address based accessMAC Spoofing

• Firewall, VPN .. etc

Wireless Network Security: NoCat

NoCat :

• Captive Portal, two modes:

• Closed (passive) mode

• Open (Active) mode

• NoCat is Open Source, written with PERL.

• Works as gateway and Authentication server.

• requires Linux ( works perfectly on Red Hat) Tested on Sun x86 machine operating Fedora Core 2.

• Independent from any specific wireless technology.

Wireless Network Security: NoCat

NoCat :

Hardware requirements:- Any PC or Server with x86 architecture.

- Two NICs.

- 10 GB free hard drive space.

- At least 256 RAM.

Note: NoCat currently installed on Sun Server with x86 architecture with 2 processors, 2 GB RAM and 36 GB of Hard drive space connected to the main CS router using a routable (real) IP on one NIC while the other NIC connect all access points (AP) using non-routable IPs (192.168.137/24).

We are using Fedora Core 2 as an Operating system.

Software requirements:

- Linux (preferably Red Hat or Fedora).

- Apache, MySQL and PERL.

- DHCP and DNS.

- NoCatAuth. Source Code, no binaries!

obtained from http://www.nocat.net

Wireless Network Security: NoCat

NoCat :

Testing:

- Any PC or Laptop with wireless capabilities. Please select an OS that support wireless networking like Windows XP or Linux.

- Our current Wireless Network at School of Computer Science (C-WL-2) does not have any encryption method turned on, and we do not use MAC address filtering like we did with (CS-WL-1), which was a hard job to keep track of all MAC address and setting up almost every computer wants to connects to our network.

- No need for special configuration at the client side.

- Incase of Windows 2000 or earlier, you need to install software which comes with the wireless NIC.

My tests done on Windows XP with SP2, but actually we have test almost every platform!

Wireless Network Security: NoCat

Wireless Network Security: NoCat

After contacting the NoCat server, the first thing it will issue an IP to the machine, even before authenticating occurs.

Wireless Network Security: NoCatOnce you got an IP, open your favorite Internet Browser like IE or FireFox.

Wireless Network Security: NoCat

If username and password were entered correctly, you will be directed after the following page to your default home page.

This page will stay for 5 seconds!

Please allow popup for this site, or it will ask you for authenticating every 30 minutes.

Wireless Network Security: NoCat

But you may ask, what security measures NoCat has added to our wireless network! As it did not enable Encryption or MAC address Filtering?!

So why we need it!?

Wireless Network Security: NoCat

NoCat, mainly will only give the feelings that your network is under control, as the users will think twice before they miss around, as they already has given their own user name, so they feel that they are monitored, which is true!, NoCat provides a nice monitoring page which can help determining who Is online, when s/he logged in and some extra information like machine MAC address and current IP address.

Wireless Network Security: NoCat

Wireless Network Security: NoCat

Thank you!