Automa utomation tion of of Mit MitM M Attac Attack k on on - PowerPoint PPT Presentation

Automa utomation tion of of Mit MitM M Attac Attack k on on WiFi iFi Netw Networ orks ks Martin Vondráček Author: Supervisor: Ing. Jan Pluskal Foreign supervisor: Dr Johann A. Briffa ) ) ) ) ) ) ) ) ) wifimitm Brno University of Technology University of Malta

Available Tools for Specific Phases of the MitM Attack on Wireless Networks • Accessing wireless network • airmon-ng , airodump-ng , aircrack-ng, aireplay-ng , wifite, upc_keys , wifiphisher , Reaver Open Source, wpaclean , netctl • Tampering network topology • Framework for Man-In-The-Middle attacks , Scapy, dsniff, arpspoof, Yersinia • Capturing network traffic • Dumpcap 2017-04-22 Automation of MitM Attack on WiFi Networks 2/13

Wi-Fi Machine-in-the-Middle • Python package wifimitm • Attack data for repetitive attacks • Captured traffic 2017-04-22 Automation of MitM Attack on WiFi Networks 3/13

Wi-Fi Machine-in-the-Middle • Python package wifimitm • Attack data for repetitive attacks • Captured traffic • CLI tool wifimitmcli 2017-04-22 Automation of MitM Attack on WiFi Networks 3/13

Wi-Fi Machine-in-the-Middle • Python package wifimitm • Attack data for repetitive attacks • Captured traffic • CLI tool wifimitmcli • Installation scripts • Requirements check • Python package setup • Documentation, man page 2017-04-22 Automation of MitM Attack on WiFi Networks 3/13

Accessing wireless network Internet Scan Crack Connect AP Impersonate (phishing) STA wifimitm 2017-04-22 Automation of MitM Attack on WiFi Networks 4/13

Accessing wireless network Internet Scan Crack Connect AP Impersonate (phishing) STA wifimitm 2017-04-22 Automation of MitM Attack on WiFi Networks 4/13

Tampering network topology Internet Tampering network topology stop AP STA wifimitm 2017-04-22 Automation of MitM Attack on WiFi Networks 5/13

Tampering network topology Internet Tampering network topology stop AP STA wifimitm 2017-04-22 Automation of MitM Attack on WiFi Networks 5/13

Capturing network traffic Internet Capturing network traffic stop AP STA wifimitm 2017-04-22 Automation of MitM Attack on WiFi Networks 6/13

Capturing network traffic Internet Capturing network traffic stop AP STA wifimitm 2017-04-22 Automation of MitM Attack on WiFi Networks 6/13

Performance testing • 1 STA and 1 AP connected to the Internet • The performance impact is not critical. • Users of the network had no suspicion. • 8 STAs and 1 AP connected to the Internet • The performance impact is more severe. • Despite the performance impact, users had no suspicion. 2017-04-22 Automation of MitM Attack on WiFi Networks 7/13

Internet R1 AP STA 1 wifimitm

RTT STA1 – R1 10000 ms 1000 ms 100 ms 10 ms 1 ms 0 200 400 usual communication MitM

Internet STA 1 STA 5 R1 STA 2 STA 6 AP STA 3 STA 7 STA 4 wifimitm STA 8

RTT STA1 – R1 10000 ms 1000 ms 100 ms 10 ms 1 ms 0 200 400 usual communication MitM

Utilization Automate WLAN test Penetration tester . Automation of MitM Attack on WiFi Networks 12/13 2017-04-22

Utilization Automate WLAN test Demonstrate danger of MitM Penetration tester . Automation of MitM Attack on WiFi Networks 12/13 2017-04-22

Utilization Automate WLAN test Demonstrate danger of MitM Penetration tester Develop using wifimitm Developer . Automation of MitM Attack on WiFi Networks 12/13 2017-04-22

Utilization Automate WLAN test Demonstrate danger of MitM Penetration tester Develop using wifimitm Capture traffic Developer Forensic researcher . Automation of MitM Attack on WiFi Networks 12/13 2017-04-22

Conc Conclusion lusion • Research published as bachelor’s thesis and software product in NES@FIT research group in May 2016. • Author received dean’s award and rector’s award in 2016. • Wi-Fi Machine-in-the-Middle (open-source) • Penetration testing, forensic investigation 2017-04-22 Automation of MitM Attack on WiFi Networks 13/13