|
|
|||
 |
|
|||
CCCure QuizWe recommend: Video Library
Skimming for ID theft
Views: 218 Comments: 2 11-01-2008 00:18 Latest version of ATM skimmer hidden behind a speaker looking device
Views: 232 Comments: 0 11-01-2008 00:11 ATM Scam, do check your ATM machine before using it
Views: 213 Comments: 0 10-31-2008 23:59 Forums Posts [Criptography] DES Modes [Criptography] What algorithms to look close ? CEH V7 Exam Non Refundable Eligibility Fees for Self Study EC-Council officially released their ILABS for the CEH V7 The new CEH Version 7 Kit from the EC-Council CEH V7 is coming out very soon - Move away QEH, CPTS, etc. CEH: Summary of what to expect? Save those flash cards! Environment for testing tools help Jersey City, NJ, United StatesMethodologiesRecommended PodCastsRecommended SitesSecurity BlogsAJAX Blog LEGAL INFO BLOGS Best Downloads· 1: Web Application Testing Cheat Sheet
· 2: Sample Get out of Jail Card by Clement · 3: Reconnaissance CheatSheet · 4: NMAP and Nessus Cheatsheet from Skillz · 5: Tool Matrix for CEH Exam V1 · 6: Advanced/Other Techniques for ByPassing Firewalls · 7: NIST Guidelines on Network Security Testing · 8: The ISSAF Framework · 9: The beginner guide to Wardriving · 10: Brute Force Exploitation of Web Application Session ID Best Web Links· 1: Binary Revolution Hack TV
· 2: Iron Geek Hacking Tutorial · 3: Root Secure Videos Links · 4: Domain 1 - System Security - Flash Based Tutorial · 5: UnderGround Film · 6: AEROSOL · 7: Hack this site! · 8: ExitFrame · 9: PacketSniffers.Org · 10: Moloch TV SurveyWho's OnlineThere are currently, 192 guest(s) and 1 member(s) that are online. You are Anonymous user. You can register for free by clicking here |  |
Wi-Fi Alliance Expands WPA2 to include EAP-AKA, EAP-FAST
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
(Read More... | Score: 0)
Great Deal on Senao Cards
Posted by boss on Thursday, 12 April 2007 @ 20:19:22 EDT (6379 reads)
Topic Wireless Vulnerability
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On Behalf Of Seth Fogie
Sent: Thursday, April 12, 2007 1:03 PM
To: wifisec@securityfocus.com
Subject: Ebay deal on Senao cards at $10 a pop - 81 available
http://cgi.ebay.com/SENAO-NL-2511CD-PLUS-EXT2-LONG-RANGE-WIRELESS-PC-CARD_W0QQitemZ120108336387QQihZ002QQcategoryZ45000QQrdZ1QQcmdZViewItem
Now that is a pretty good deal - plus they combine shipping if you get multiples.
Just a tip!
Seth "
(Read More... | Score: 0)
SSID Cloaking actually reduces your WIFI security
Posted by boss on Monday, 05 March 2007 @ 21:40:31 EST (1643 reads)
Topic Wireless Vulnerability
Here is a repost of a great post from my friend Joshua Wright on the wifi security mailing list.
While many networks use SSID cloaking as a mechanism to improve the security of the network, I believe it actually reduces the security of the network substantially.
I wrote an article for Network World that was posted today about this issue:
http://www.networkworld.com/columnists/2007/030507-wireless-security.html
The most significant issue is that with the recent Windows XP SP2 hotfix KB917021, the preferred network list for WZC allows users to specify "Connect even if this network is not broadcasting". When this option is selected (not the default), stations will look for the network with directed probe requests (disclosing the SSID's in the PNL, and exposing the station to KARMA and Hotspotter attacks).
When the option is not on, the station will only connect when it observes the SSID in beacons and from responses following a broadcast probe request frame. Of course, if the SSID is cloaked, the station will be unable to connect, forcing them to use the "Connect even if ..."
option, and exposing them to KARMA attacks.
This hotfix has not yet been distributed as part of the automatic update service from Microsoft. Several other facets of WZC has changed with this update, including how ad-hoc networks are started to mitigate the spread of the "Free Public WiFi" phenomenon. If you are responsible for Windows XP wireless stations, and you haven't read up on this hotfix yet, take a few minutes to do so: http://support.microsoft.com/kb/917021.
On an unrelated note, dragorn and I will be presenting at Shmoocon this year about LORCON, our framework for experimentation in wireless networks. If anyone is going to be at Shmoocon and wants to grab a drink or something, drop me a note.
- -Josh
"
(Read More... | Score: 0)
WCCD Vulnerability Update (10 August 2006)
Posted by boss on Friday, 11 August 2006 @ 09:50:01 EDT (1320 reads)
Topic Wireless Vulnerability
Latest Intel chipset IntelR PRO/Wireless 2200BG driver version 9.0.4.17 (dated 26 June 2006) downloaded off Intel's website is STILL affected by the WEP Client Communications Dumbdown vulnerability.
Tested using Windows XP SP2 zeroconfig.
More details at: http://securitystartshere.net/page-vulns-wccd.htm "
(Read More... | Score: 0)
Webcast Featuring Josha Wright
Posted by boss on Friday, 09 June 2006 @ 10:29:26 EDT (1857 reads)
Topic Wireless Vulnerability
A great webcast you do not want to miss. My friend Joshua Wright will be talking about emerging wireless attack. Joshua is god at finding wireless vulnerability. A webcast worth watching for sure. Here is Josh email about it followed by the formal announcement:
I'm participating in a webcast next week to talk about some research I've been doing on emerging 802.11 attacks with colleagues from Juniper and IGX.
The marketing people at Aruba say I have to spend a few slides talking about our products, but then my material is all wireless-attacks, I promise. :)
Specifically, I'm going to talk about attacking preferred network lists with KARMA, hotspot injection attacks with AirPWN and 802.11 protocol fuzzing research.
I've also seen the slides from Bob Spognardi at Juniper and I'm personally excited to hear what he has to say about federal data privacy requirements and wireless networking.
If you are interested in catching the webcast, you can sign up at www.ihavebeenhacked.com (no, really).
Thanks, Josh
Here is the formal announcement:
Please join your peers and the members of igxglobal, Aruba and Juniper Networks for a Live Lunch and Learn Webinar:
* igxglobal will discuss identification and mitigation ofvulnerabilities over the air and best practices.* Juniper Networks will talk about their Funk Software Product securing wireless LAN and Data Privacy.
* Aruba will talk about Emerging 802.11 Attacks. Mr. Barry Johnson, igxglobal's Director of Threat Mitigation, will share his extensive 15 year experience in assisting major corporations as well as the government sector in developing, implementing and educating clients on security risks, compliance and regulatory standards such as GLBA, HIPAA, SOX, PCI and others to assist in securing their IT environments.
Mr. Bob Spognardi, Northeast Sales Manager from Juniper Networks brings an extensive background in the Security Arena now passionately representing Funk Software. Mr. Spognardi worked in sales for information security companies for the past 10 years. Since 2002, has been the northeast sales manager for Funk Software (now Juniper Networks). Before Funk, worked in sales for Sonicwall, Netscreen and RSA Security.
Mr. Josh Wright is a Senior Security Architect for Aruba Networks and the author of several open-source wireless security assessment tools designed to illustrate and raise awareness of common vulnerabilities in wireless networks. His current assignment includes research into new techniques used by attackers to compromise the security of wireless networks including IEEE 802.11 and Bluetooth LANs. When not breaking wireless networks, he practices Aiki-Jutsu, where he tries not to break things.
About igxglobal: Go to www.igxglobal.com
About Juniper Networks: Go to www.juniper.net
About Aruba: Go to www.arubanetworks.com
If you have any questions please contact: Katarina Almqvist at:
Phone: 201-615-3458
E-mail: kalmqvist@igxglobal.com or
Website: www.ihavebeenhacked.com
When: Wednesday June 14th, 12.00 - 1.00pm
Attendees will have the chance to win a free external scan for up to 6 ip-addresses, iPod or a $200 American Express Gift Certificate at the end of the Q/A Session.
Agenda: 12.00 pm - 12.05 pm
Webinar Introduction by Victor Machado, Security Sales Professional,
igxglobal. 12.05 pm - 12.20 pm
Identity & Information Theft over the Air and Best Practices.
Speaker: Barry Johnson, Director of Threat Mitigation, igxglobal.
12.20 pm - 12.35 pm
Secure Wireless Lan Authentication and Data Privacy.
Speaker: Bob Spognardi, Northeast Regional Sales Manager Juniper Networks.
12.35 pm - 12.55 pm
Emerging 802.11 Attacks.
Speaker: Josh Wright, Senior Security Architect for Aruba Networks.
12.55 pm - 01.00 pm
Questions & Answers with Victor Machado, igxglobal, Juniper and Aruba. "
(Read More... | Score: 0)
NIST Guide to IEEE 802.11i Robust Security Networks
Posted by boss on Tuesday, 06 June 2006 @ 09:03:48 EDT (1224 reads)
Topic Wireless Vulnerability
NIST Draft Special Publication 800-97
Guide to IEEE 802.11i: Robust Security Networks Adobe
PDF<http://csrc.nist.gov/publications/drafts/Draft-SP800-97.pdf> (4.52 MB)
Zipped Adobe PDF<http://csrc.nist.gov/publications/drafts/Draft-SP800-97_pdf.zip> (3.52 MB)
NIST is pleased to announce the release of draft Special Publication (SP) 800-97, Guide to IEEE 802.11i: Robust Security Networks.
SP 800-97 provides detailed information on the Institute of Electrical and Electronics Engineers (IEEE) 802.11i standard for wireless local area network (WLAN) security.
IEEE 802.11i provides security enhancements over the previous 802.11 security method, Wired Equivalent Privacy (WEP), which has several well-documented security deficiencies.
IEEE 802.11i introduces a range of new security features that are designed to overcome the shortcomings of WEP. This document explains these security features and provides specific recommendations to ensure the security of the WLAN operating environment. It gives extensive guidance on protecting the confidentiality and integrity of WLAN communications, authenticating users and devices using several methods, and incorporating WLAN security considerations into each phase of the WLAN life cycle.
The document complements, and does not replace, NIST SP 800-48, Wireless Network Security: 802.11, Bluetooth and Handheld Devices.
NIST requests comments on NIST SP 800-97 by July 7, 2006.
Please submit comments to :
800-97comments@nist.gov with "Comments SP800-97/802.11i" in the subject line"
(Read More... | Score: 0)
Practical Wireless Deployment Methodology (PWDM)
Posted by boss on Thursday, 19 January 2006 @ 08:22:32 EST (1342 reads)
Topic Wireless Vulnerability
We've launched a hardware-neutral wireless deployment/upgrading methodology at http://www.pwdm.net and would like some feedback on whether it is useful to you and how we can make it more so.
The PWDM (Practical Wireless Deployment Methodology) is a practical, vendor-independent, high-level framework/methodology which is intended to help people who are tasked with deploying, upgrading, maintaining & securing 802.11-based WLANs, irrespective of whether they are private (SOHO, enterprise, home) or public (hotspots) in nature.
The methodology comprises the following steps:
* Deployment Analysis
* Contractual Negotiation
* Deployment Tactical Planning
* Deployment Procedural Rollout
* Supporting Infrastructure Rollout
* AP Security Issues
* Layer 3 Mitigation Strategies
* Management Overlay
* Gateway Security
* UAT & Commissioning
If you're interested in taking a look, you can download the current version of the PWDM (ver 1.4) at http://www.pwdm.net"
(Read More... | Score: 0)
WEP Client Communication Dumbdown (WCCD) Vulnerability
Posted by boss on Monday, 16 January 2006 @ 16:54:13 EST (1763 reads)
Topic Wireless Vulnerability
More details including mitigation actions are available at our website at:
http://www.securitystartshere.net/page-vulns-wccd.htm
### Vulnerability Name ###
WEP-Client-Communication-Dumbdown (WCCD) Vulnerability
### Vulnerability Description ###
ThinkSECURE has discovered that certain well-known wireless chipsets, using vulnerable drivers under the Windows XP operating system and when configured to use WEP with Open Authentication, can be tricked by a 802.11-based wireless client adapter operating in master mode ("the attacker") to discard the WEP settings and negotiate a post-association conection with the attacker in the clear.
We have named this vulnerability as the "WEP-client-communication-dumbdown" (wccd) vulnerability.
This vulnerability is apparently not due to Windows itself but due to the operation of the drivers for the affected wireless cards. However, this does not discount a situation where a patch could be released by Microsoft to deal with the problem on the chipset makers' behalf.
Again, this is apparently NOT a Windows problem but a wireless chipset driver-related one.
End-users of the system would not notice any difference about the clear connection that was being established. Although WPA/2 & WPA-PSK have been out for some time now, in our experience there is still a large installed client base who are still using WEP-enabled Access Points and thus have WEP-enabled profiles setup in their laptops. This installed base is vulnerable.
### Vulnerability Impact ###
The vulnerability was observed in a Windows XP wireless client configuration with the vulnerable drivers and with the following setups:
1. Profile configured using Windows XP zero configuration as well as using the vulnerable drivers' bundled wireless client managers;
2. Profile configured to use WEP with static WEP key & Open Authentication.
Using ThinkSECURE's recently-released security auditor's tool - probemapper - one can remotely evaluate the SSID and capabilities of wireless profiles from probe requests and assess whether the subject is probing for any Open-Authentication-WEP-encryption-enabled wireless networks.
When a Windows XP client using a vulnerable chipset driver is configured as outlined above via their wireless profiles ("the victim"), the victim will send out probe requests bearing the SSID configured in the wireless profile.
An attacker who detects the probe request frames coming from the configured profile can configure a master-mode-enabled wireless card with the detected SSID of the probe request frames and, using Open Authentication with no-encryption, send probe responses to the victim.
The victim will then initiate authentication and association, sending an association request frame with the Privacy Bit set to 1 (AP/STA can support WEP).
The attacker returns an association response frame with Privacy Bit set to 0 (AP/STA cannot support WEP).
Although the correct behavior should be to not establish any communication due to the difference between association request and response Privacy Bits, the victim "dumbs-down" and establishes an un-encrypted communications session to match the attacker's Privacy Bit setting of 0, thus ignoring the WEP settings as configured in the client's profile. All traffic to & from this connection will be sent in the clear.
A victim who has a vulnerable wireless network at home and brings a laptop bearing the profile of said home wireless network to his/her organization and plugs in using a wired connection may be attacked in this manner and used as a conduit by the attacker, through the bridging of the laptop's wireless interface to the wired interface, to the victim's organization's wired network, thus bypassing corporate perimeter defences. It is irrelevant that the organization does not use wireless or has a no-wireless policy if that policy is not strictly enforced through proactive checking.
Also, firewalling on the victim's laptop might not guarantee safety in certain cases: e.g. the attacker issues an IP address and gateway address to the victim in response to the victim's typical DHCP request upon association so as to fool the victim's machine into forwarding all traffic to the attacker's machine. The result is that, when the victim opens up a web browser for example, he will see a crafted page bearing malicious code on the attacker's machine which runs exploit code on the victim's machine (a good example being the recent WMF vulnerability) to give the attacker a reverse shell into the victim, where the attacker can then do the bridging of the interface or anything else he wants.
### Vulnerability Cause ###
In our testing, we have narrowed down the cause of the problem to stem from the way certain chipset manufacturer drivers deployed for the Windows platform operate in handling an association.
Affected chipset manufacturer(s) have been notified via their website contact addresses.
In the interests of responsible disclosure, we will not be stating which chipset drivers which we tested as vulnerable for a minimum period of 14 days after this vulnerability advisory, thus giving time for the notified vendors to issue non-vulnerable drivers. (dated 16 Jan 2006)
### Vulnerability Discovery Acknowledgment ###
Christopher Low & Julian Ho of ThinkSECURE Pte Ltd discovered and researched this vulnerability from Dec 2005 to 15 Jan 2006."
"
(Read More... | Score: 0)
Our Sponsors
Login
Latest Windows Tools
Latest Linux Tools
Virtual Machines VM's
IBM Virtualization
MS Virtual Server
Parallels Software
Virtual Box
Virtual Iron Inc.
Virtuozzo
VMWare Server
VMWare Player
VMWare Appliances
XEN
------------------------
Download VM's
------------------------
Enspeed Collection
Linhost VM Collection
VirtualAppliances.Net
VMPlanet.Net
VMWare.Com
ThoughtPolice
Hacker's Magazine
Web & Apps Security
Scanning Service
AlertSite
Counterpane
Critical Watch
Qualys
SecureWorks
SecuritySpace
VSS
OFFLINE SCANNERS
Acunetix
ISS/IBM Scanner
Nessus
Retina
Saint
Reverse Engineering
- ARTeam
- OpenRCE
- RC Videos
- Hex Blog
- LostScrews
- Mbed
- Reversing Everything
MALWARE ANALYSIS
- Malware Intelligence
Vulnerabilities Research
Big Story of Today
Old Articles
| Monday, June 27 | |
| · | WLAN Session Containment DoS |
| Tuesday, March 08 | |
| · | Bluesnarfer - A Bluesnarfing Utility |
| Friday, November 12 | |
| · | Offline WPA-PSK auditing tool (coWPAtty) |
| Wednesday, April 14 | |
| · | Asleap -- Cisco LEAP attack tool |
| Monday, April 12 | |
| · | Hotspotter tool has been released |
Wi-Fi Security
You can syndicate our news using the file backend.php or ultramode.txt
All logos and trademarks in this site are property of their respective owner. The comments are property of their posters, all the rest © 2003-2008 by Clement Dupuis and Nathalie Lambert (Site Maintainers).
- Home Page
- TRAINING
- Network Penetration Testing and Ethical Hacking (GPEN)
- Network Penetration Testing: Maximizing the Effectiveness of Reports, Exploits, and Command Shells
- Hacker Techniques, Exploits & Incident Handling (GCIH)
- Defending Web Applications Security Essentials
- Security Essentials Course (GSEC) Bootcamp Style
- Wireless Ethical Hacking, Penetration Testing, and Defenses (GAWN)
- Reverse-Engineering Malware: Malware Analysis Tools and Techniques (GREM)
- Computer Forensic Essentials
- Computer Forensics, Investigation, and Response (GCFA)
- Essential Secure Coding in Java/JEE
- Start Here First
- GSEC
- FOR MEMBERS
- GPEN
- CONTRIBUTE
- GCIH
- CONFERENCES
- CEH Certification
- TOOLS
- CONTACT US
- Security+ CompTIA
Page Generation: 0.99 Seconds