CWSP-207 Questions and Answers

Man-in-the-Middle

Wi-Fi phishing

Management interface exploits

UDP port redirection

IGMP snooping

Intruders may obtain the passphrase with an offline dictionary attack and gain network access, but will be unable to decrypt the data traffic of other users.

A successful attack against all unicast traffic on the network would require a weak passphrase dictionary attack and the capture of the latest 4-Way Handshake for each client.

An unauthorized wireless client device cannot associate, but can eavesdrop on some data because WPA2-Personal does not encrypt multicast or broadcast traffic.

An unauthorized WLAN user with a protocol analyzer can decode data frames of authorized users if he captures the BSSID, client MAC address, and a user’s 4-Way Handshake.

Because WPA2-Personal uses Open System authentication followed by a 4-Way Handshake, hijacking attacks are easily performed.

Management interface exploit attacks are attacks that use social engineering to gain credentials from managers.

Zero-day attacks are always authentication or encryption cracking attacks.

RF DoS attacks prevent successful wireless communication on a specific frequency or frequency range.

Hijacking attacks interrupt a user’s legitimate connection and introduce a new connection with an evil twin AP.

Social engineering attacks are performed to collect sensitive information from unsuspecting users

Association flood attacks are Layer 3 DoS attacks performed against authenticated client stations

Require Port Address Translation (PAT) on each laptop.

Require secure applications such as POP, HTTP, and SSH.

Require VPN software for connectivity to the corporate network.

Require WPA2-Enterprise as the minimal WLAN security solution.

The username is needed for Personal Access Credential (PAC) and X.509 certificate validation.

The username is an input to the LEAP challenge/response hash that is exploited, so the username must be known to conduct authentication cracking.

4-Way Handshake nonces are based on the username in WPA and WPA2 authentication.

The username can be looked up in a dictionary file that lists common username/password combinations.

Transmitting a deauthentication frame to disconnect a user from the AP.

Auditing the configuration and functionality of a WIPS by simulating common attack sequences

Probing the RADIUS server and authenticator to expose the RADIUS shared secret

Cracking the authentication or encryption processes implemented poorly in some WLANs

When the RF signal between a client and an access point is disrupted for more than a few seconds, the client device will attempt to associate to an access point with better signal quality.

When the RF signal between a client and an access point is lost, the client will not seek to reassociate with another access point until the 120 second hold down timer has expired.

After the initial association and 4-way handshake, client stations and access points do not need to perform another 4-way handshake, even if connectivity is lost.

As specified by the Wi-Fi Alliance, clients using Open System authentication must allow direct client-to-client connections, even in an infrastructure BSS.

Client drivers scan for and connect to access points in the 2.4 GHz band before scanning the 5 GHz band.

All WLAN clients will reassociate to the consultant’s software AP if the consultant’s software AP provides the same SSID on any channel with a 10 dB SNR improvement over the authorized AP.

A higher SSID priority value configured in the Beacon frames of the consultant’s software AP will take priority over the SSID in the authorized AP, causing the clients to reassociate.

When the RF signal between the clients and the authorized AP is temporarily disrupted and the consultant’s software AP is using the same SSID on a different channel than the authorized AP, the clients will reassociate to the software AP.

If the consultant’s software AP broadcasts Beacon frames that advertise 802.11g data rates that are faster rates than XYZ’s current 802.11b data rates, all WLAN clients will reassociate to the faster AP.

WPA-Enterprise

802.1X/EAP-PEAP

WPA2-Enterprise

WPA2-Personal

Man-in-the-middle

Hijacking

ASLEAP

DoS

Phase Shift Key (PSK)

Group Master Key (GMK)

Pairwise Master Key (PMK)

Group Temporal Key (GTK)

PeerKey (PK)

Key Confirmation Key (KCK)

Fragmentation threshold

Administrative password

Output power

Cell radius

The PTK is a type of master key used as an input to the GMK, which is used for encrypting multicast data frames.

The PTK contains keys that are used to encrypt unicast data frames that traverse the wireless medium.

The PTK is XOR'd with the PSK on the Authentication Server to create the AAA key.

The PTK is used to encrypt the Pairwise Master Key (PMK) for distribution to the 802.1X Authenticator prior to the 4-Way Handshake.

Authorized PEAP usernames must be added to the WIPS server’s user database.

WLAN devices that are discovered must be classified (rogue, authorized, neighbor, etc.) and a WLAN policy must define how to classify new devices.

Separate security profiles must be defined for network operation in different regulatory domains

Upstream and downstream throughput thresholds must be specified to ensure that service-level agreements are being met.

WEP-128

WPA2-Personal

EAP-TLS

WPA-Enterprise

802.1X/LEAP

Identify the IP subnet information for each network segment.

Identify the manufacturer of the wireless intrusion prevention system.

Identify the skill level of the wireless network security administrator(s).

Identify the manufacturer of the wireless infrastructure hardware.

Identify the wireless security solution(s) currently in use.

SSID

IP Address

BSSID

Signal strength

RSN IE

Noise floor

AKM Suite List

Group Cipher Suite

RSN Capabilities

Pairwise Cipher Suite List

Time Difference of Arrival (TDoA)

Angle of Arrival (AoA)

Trilateration of RSSI measurements

GPS Positioning

RF Fingerprinting

The WLAN system may be open to RF Denial-of-Service attacks

WIPS may not classify authorized, rogue, and neighbor APs accurately

Authentication cracking of 64-bit Hex WPA-Personal PSK

Management interface exploits due to the use of default usernames and passwords for AP management

AES-CCMP encryption keys may be decrypted

A spectrum analyzer, because it can show the energy footprint of a device using WPA differently from a device using WPA2.

A spectrum analyzer, because it can decode the PHY preamble of a non-compliant device.

A protocol analyzer, because it can be used to view the spectrum energy of non-compliant 802.11 devices, which is always different from compliant devices.

A protocol analyzer, because it can be used to report on security settings and regulatory or rule compliance

MAC Spoofing

Eavesdropping

Hot-spotter

Soft AP

Deauthentication flood

EAP flood