Chapter 11: Wireless Connection

Wireless Networks Overview: Two common types: Ad hoc (stations self-organize) and Infrastructure (stations connect to access point). Stations are endpoints in wireless networks. Authentication: Open (no password) or secure (requires authentication). Wireless Encryption: WEP: First encryption attempt, flawed initialization vector led to key leakage. WPA: Stopgap measure before WPA2. WPA2: Final replacement for WEP, supports Personal and Enterprise authentication. WPA3 (2018): Stronger encryption keys, Simultaneous Authentication of Equals for improved security. Wireless Network Attacks: WEP Networks: Key derivation possible with enough collected frames; sniffing tools like Wireshark used. Deauthentication Attack: Spoofs messages as access point, disrupts station's connection to gather data. Evil Twin Attack: Rogue access point impersonates legitimate network to collect authentication credentials. Key Reinstallation Attack (KRACK): Reuses traffic to force station to use a known key, allowing decryption of traffic. Bluetooth Attacks: Bluejacking: Sending messages via Bluetooth. Bluesnarfing: Collecting data from a device via Bluetooth. Bluebugging: Using Bluetooth to initiate a call for eavesdropping. Mobile Device Security: Mobile devices use wireless protocols (802.11, Bluetooth). Vulnerable to various attacks: Malicious applications, phishing, malware, programming errors, data leakage.

1. What are the two types of wireless networks?

A. Star and ring

B. Bus and hybrid

C. Infrastructure and hybrid

D. Infrastructure and ad hoc

. D. An infrastructure wireless network is one that uses an access point. An ad hoc wireless network is one organized by the participants. These are the two types of wireless networks. Star, ring, bus, and hybrid are all wired topologies.

2. How many stages are used in the WPA handshake?

A. Two

B. Four

C. Three

D. One

B. There are four stages used in a WPA handshake. This four‐stage process is used to derive the key and agree on capabilities

3. What mode has to be enabled on a network interface to allow all headers in wireless traffic to be captured?

A. Promiscuous

B. Monitor

C. Radio

D. Wireless LAN

B. Promiscuous mode is used on network interfaces to collect frames that are not destined for the network interface. This is insufficient on a wireless network because the radio headers are not captured. To capture radio headers, monitor mode needs to be enabled in addition to the promiscuous mode that will always be set to get all frames and all information from the frame. Only monitor mode gives the radio headers.

4. What wireless attack would you use to take a known piece of information to be able to decrypt wireless traffic? A. Sniffing

B. Deauthentication

C. Key reinstallation

D. Evil twin

C. Sniffing can be used to collect information that may be needed to launch wireless attacks. A deauthentication attack can be used to force a station to generate traffic. An evil twin attack uses a rogue access point to pretend to be a legitimate network. In order to decrypt network traffic, you would need the key. One way to get the key is to reuse information from network traffic that generated a known key. This is a key reinstallation attack

5. What is the purpose of performing a Bluetooth scan?

A. Identifying open ports

B. Identifying available profiles

C. Identifying endpoints

D. Identifying vendors

C. Bluetooth doesn't use ports. While profiles are important, you get the profile capabilities during the pairing process. Just performing a scan won't get you a list of supported profiles. While you should be able to identify vendors as part of the process of running a Bluetooth scan, it's not the purpose of the scan. The purpose is to identify endpoints and their associated addresses so you can run other attacks on them.

6. What is the purpose of a deauthentication attack?

A. Disabling stations

B. Forcing stations to reauthenticate

C. Reducing the number of steps in the handshake

D. Downgrading encryption

B. The purpose of a deauthentication attack is to force stations to reauthenticate. This allows the attacker to collect information from the authentication and handshake. This information could be used later to potentially derive the key, as in WEP transmissions. A deauthentication attack doesn't disable stations. There is no way to reduce the number of steps in a handshake, and downgrading encryption is considerably harder, if it's possible at all.

7. What is the policy that allows people to use their own smartphones on the enterprise network?

A. Bring your own device

B. Use your own device

C. Bring your own smart device

D. Use your own smart device

A. Bring your own device (BYOD) is a policy that allows employees to use their own devices on an enterprise network. This opens the door to the potential for attacks from unknown and unexpected devices. None of the other answers is a real thing.

8. What part of the encryption process was weak in WEP? A. Keying

B. Diffie‐Hellman

C. Initialization vector

D. Seeding vector

. C. The initialization vector is a random value that seeds the key used for encryption and decryption. In WEP, the algorithm specified for the initialization vector yielded nonrandom, predictable values. While the initialization vector is part of keying, it's not the keying itself that was weak. Seeding vector is not a real thing, and Diffie–Hellman is a process used to derive and exchange keys securely. It's not part of WEP.

9. What is the WPA four‐way handshake used for?

A. Passing keys

B. Deriving keys

C. Encrypting messages

D. Initialization seeding

B. The four‐stage handshake is used to authenticate stations against wireless networks. As part of the handshake, encryption keys are generated. Keys are derived on both sides of the transaction rather than being exchanged directly. This is handled during the four‐stage handshake. Keys are not passed. Messages can't be encrypted until the four‐stage handshake is complete and the keys are generated. There is no such thing as initialization seeding

10. What is the SSID used for?

A. Encrypting messages

B. Providing an IP address

C. Identifying a network

D. Seeding a key

C. The service set identifier (SSID) is used to identify a network. It is the name of the network you would select when you were trying to connect to a network. The SSID is not the MAC address, and it has nothing to do with keys or encryption.

11. What kind of access point is being used in an evil twin attack?

A. Infrastructure

B. Ad hoc

C. WPA

D. Rogue

D. Ad hoc and infrastructure are types of wireless networks. Only infrastructure uses access points, but infrastructure is not a type of access point. WPA is an encryption protocol. A rogue access point, meaning one that isn't legitimate, is used in an evil twin attack by pretending to be a legitimate access point.

12. How does an evil twin attack work?

A. Phishing users for credentials

B. Spoofing an SSID

C. Changing an SSID

D. Injecting four‐way handshakes

B. An evil twin attack uses an access point masquerading as the point of connection for stations trying to connect to a legitimate wireless network. Stations reach out to make connections to this access point masquerading as another access point. While you may phish for credentials as part of an evil twin attack, credential phishing is not how evil twin attacks work. SSIDs don't get changed as part of an evil twin attack, meaning no SSID that exists will become another SSID. Injecting four‐stage handshakes won't do much, since four‐stage assumes both ends are communicating, so the injection of a full communication stream will get ignored.

13. What is a method to successfully get malware onto a mobile device without having to get the user to do something they wouldn't normally do?

A. Using the Apple Store or Google Play Store

B. Using external storage on an Android

C. Using a third‐party app store

D. Jailbreaking

C. The Apple App Store and the Google Play Store are controlled by Apple and Google. It's not impossible to get malware onto mobile devices through them, but it's difficult because apps get run through a vetting process. While some Android devices will support external storage, it's not an effective way to get malware onto a smartphone or other mobile device. Jailbreaking can lead to malware being installed, but it's not the means to get malware onto a mobile device. Third‐party app stores can be a good means to get malware onto mobile devices because some third‐party app stores don't vet apps that are submitted.

14. What would you use a bluebugging attack for?

A. Identifying Bluetooth devices nearby

B. Listening to a physical space

C. Enabling a phone's camera

D. Gathering data from a target system

B. A bluebugging attack is used to gain access to a smartphone to initiate a call out to the attacker's phone. This allows the attacker to listen to anything happening around the phone owner. Scanning is used to identify Bluetooth devices nearby. There is no particular attack used to enable a phone's camera. Gathering data from a target device or system is bluesnarfing.

15. What would a signal range for a Class A Bluetooth device commonly be?

A. 300 ft.

B. 3,000 ft.

C. 75 ft.

D. 500 ft.

A. While there are Bluetooth devices that will transmit much farther, a common range is about 300 feet (100 meters) for Bluetooth 4.0.

16. What tool could you use to enable sniffing on your wireless network to acquire all headers?

A. Ettercap

B. tcpdump

C. aircrack‐ng

D. airmon‐ng

D. tcpdump can be used to capture frames/packets. Ettercap is used for captures and spoofing attacks. Neither can capture all headers, including radio headers in a wireless network. The package aircrack‐ ng includes the program airmon‐ng, which can turn on monitor mode on a network interface. The program aircrack‐ng itself cannot do that.

17. Why is bluesnarfing potentially more dangerous than bluejacking from the standpoint of the victim?

A. Bluejacking sends while bluesnarfing receives.

B. Bluejacking receives while bluesnarfing sends

. C. Bluejacking installs keyloggers.

D. Bluesnarfing installs keyloggers.

B. Bluesnarfing is an attack that connects to a Bluetooth device to grab data from that device. Bluesnarfing sends data to the attacker. Bluejacking can be used to send information to a Bluetooth device, such as a text message. Neither of these attacks installs a keylogger.

18. What tool would allow you to run an evil twin attack? A. Wireshark

B. Ettercap

C. wifiphisher

D. aircrack‐ng

. C. Wireshark is used to capture packets/frames from a network. Ettercap is used for spoofing attacks. The program aircrack‐ng can be used to crack wireless keys. wifiphisher, though, can be used to set up an evil twin attack.

19. What types of authentication are allowed in a WPA‐encrypted network?

A. Handshake and personal

B. Personal and enterprise

C. Enterprise and handshake

D. 802.11 and personal

B. WPA supports both Personal and Enterprise authentication. Personal authentication makes use of a pre‐shared key, while Enterprise authentication uses usernames and passwords to authenticate specific users, providing accounting and access control, meaning we know exactly who has connected to the network.

20. What wouldn't you see when you capture wireless traffic that includes radio headers?

A. Capabilities

B. Probe requests

C. SSIDs

D. Network type

D. Radio headers in a wireless network will provide you with the capabilities of the devices, since that's negotiated during the association process. You will also see probe requests asking what networks are in the area, including specific networks that a station knows about. These requests will include the SSID. The responses will also include the SSID. You will not get the network type in the headers

21. What does WPA3 use to start the authentication and association process between stations and access points?

A. Four‐way handshake

B. Mutual authentication of peers

C. Simultaneous authentication of equals

D. Separate authentication with encryption

. C. WPA3 uses the simultaneous authentication of equals (SAE). Previous versions have used the four‐stage handshake alone. The other two answers are not real.

22. Which of these Bluetooth attacks can result in a denial of service?

A. Bluejacking

B. Bluesnarfing

C. Bluedumping

D. Bluesmack

D. The Bluesmack attack is a denial‐of‐service attack that is caused by manipulating packet sizes sent to a victim system. The other attacks are Bluetooth but do not result in a denial‐of‐service attack.

23. What technique would you likely be using if you had a Pringles can along with a laptop?

A. Bluesnarfing

B. Wireless footprinting

C. Evil twin

D. Key reinstallation

B. A Pringles can may be used to increase the wireless signal, so it is helpful for wireless footprinting or wardriving. Evil twin is used to mimic an existing wireless network. Key reinstallation is another type of wireless attack. Bluesnarfing is a Bluetooth attack and wouldn't require a Pringles can.

24. What piece of information would you need to have to perform a Bluedump attack?

A. BDADDR

B. BDIP

C. IPADDR

D. DUMPADDR

A. The BDADDR is needed to perform a Bluedump attack. An IP address would not be used in a Bluetooth attack. The other answers aren't real things. BDADDR stands for Bluetooth Device Address. It is a unique identifier assigned to each Bluetooth device. This address is typically represented as a 48-bit value and is used to uniquely identify a Bluetooth-enabled device in a network. In essence, the BDADDR serves as the "MAC address" of a Bluetooth device, allowing it to be distinguished from other devices in the vicinity. In a Bluedump attack, an attacker spoofs the BDADDR of a trusted device to gain unauthorized access.

25. What type of building material would you select to keep the wireless signal mostly in the building, rather than leaking out?

A. Plywood

B. Glass

C. Sheetrock

D. Concrete

D. Plywood and sheetrock effectively offer no resistance to a wireless signal. Glass offers minimal resistance. If you wanted to keep your wireless signal inside your building, you should use concrete as a building material. Masonry blocks and bricks would also work well.