Universiti Teknologi MARA MAC Layer Sniffer Using Spoof Detection Algorithm

Transcription

1 Universiti Teknologi MARA MAC Layer Sniffer Using Spoof Detection Algorithm Azwan Abdul Satar Thesis submitted in fulfillment of the requirements for Bachelor of Science (Hons) Information Technology Faculty of Information Technology And Quantitative Science MAY 2007

2 APPROVAL MAC LAYER SNIFFER USING SPOOF DETECTION ALGORITHM by AZWAN ABDUL SATAR This thesis project was prepared under the supervision of Final Year Project Coordinator, Puan Sofianita Mutalib and thesis supervisor, Puan Nik Mariza Nik Abdul Malik. It was submitted to the Faculty of Information Technology and Quantitative Science and was accepted in partial fulfillment of the requirements for the degree of Bachelor of Science. Approved by: NIK MARIZA NIK ABDUL MALIK Thesis Supervisor MAY 2007

3 DECLARATION I certify that this thesis and the research to which it refers are the product of my own work and that any ideas or quotation from the work of other people, published or otherwise arefiiuyacknowledged in accordance with the standard referring practices of the discipline MAY 15,2007 AZWAN ABDUL SATAR

4 ACKNOWLEDGEMENT First of all I thank almighty Allah whom through His grace and blessing has supported me during these times. I am greatly indebted to my supervisor, Puan Nik Mariza Nik Abdul Malik. This thesis would not have been completed without her attentive supports. I'm very thankful for her valuable guidance and comments. This research could not have been completed without the help and support of my housemate, Encik Aznor Zamhuri, Encik Faizul Nizam and Encik Rashidee Roslee in lending me their laptops for purpose of experimentation in this research. I am very grateful to all of them. I owe a lot to my parents, brothers and sisters for accepting my absence during my study. They have been a constant source of patience and encouragement. And finally I would like to express my gratitude to all lecturers of Faculty of Information Technology and Quantitative Science for who have inherit me their knowledge and to all my fellow fiiends who have been given me support directly or indirectly. Azwan Abdul Satar IV

5 TABLE OF CONTENTS CONTENT PAGE ACKNOWLEDGEMENT LIST OF TABLES LIST OF FIGURES LIST OF ABBREVIATIONS ABSTRACT iv viii ix x xi CHAPTER ONE: INTRODUCTION 1.0 Introduction Problem Statement Objectives Scope Significance of the Research 4 CHAPTER TWO: LITERATURE REVIEW 2.0 Introduction IEEE802.il IEEE Link Layer Frame [a] Management Frames [b] Control Frames [c] Data Frames Prism Monitor Header Sniffing Sniffer MAC Address Spoofing MAC Address Spoofing Attack [a] Deauthentication/Disassociation [b] Power Saving DoS [c] Rouge Access Points 17

6 2.3.2 MAC Address Spoofing Detection [a] Sequence Number-Based MAC Address Spoof Detection 18 CHAPTER THREE: METHODOLOGY 3.0 Introduction Project Methodology and Approaches Proj ect Planning Analysis [a] Controlled Experimentation [b] Result of Analysis Development Evaluation & Testing [a] Alpha Evaluation & Testing Report Writing and Documentation 47 CHAPTER FOUR: FINDINGS AND DISCUSSION 4.0 Introduction Testing the Wireless Sniffer from Live Packet Capture Testing of Sniffer against Simulation of Wireless Traffic Test Result of Sniffer under Normal Traffic [a] Frames Coming From an AP [b] Frames Coming From a Station Test Result of Sniffer with Spoofing Activity Test Result of Sniffer with AP Misconfiguration Test Result of Sniffer under High Loss and Retransmit Frames 58 CHAPTER FIVE: CONCLUSION AND RECOMMENDATION 5.0 Introduction Advantages Limitation 61 VI

7 5.3 Recommendation and Future Work 63 REFERENCES 64 APPENDIX A: Source Code 66 vu

8 LIST OF TABLES TABLE PAGE 2.1 IEEE802.il Standard Frame Type, Subtype and Flag Control Table Result Table for Frames ComingfromAP under Normal Condition Result Table for Frames Coming from Station under Normal Condition Result Table for Frames with Spoofing Activity Result Table with AP Misconfiguration Result Table under High Loss and Retransmitted Frames 59 viu

9 LIST OF FIGURES FIGURE PAGE Frame Structure Frame Sequence Control SMAC Graphical User Interface Graphical Depiction of the Deauthentication Attack Flowchart ofthe Methodology Used Raw Iee Capture Data Prism Header Frame Type, Subtype and Flag Control Source Mac Address Source Mac Address of Data Frame Sequence Number Distribution of Sequence Number Gap for Frames Coming From AP Distribution of Sequence Number Gap for Frames Coming From Station Spoofing Simulation of Frames Sequence Number Gap Distribution of Sequence Number Gap for AP Misconfiguration Distribution of Sequence Number Gap for High Retransmit and High Loss Distribution of Sequence Number Gap for Frames Coming From an AP Distribution of Sequence Number Gap for Frames Coming from Station Spoofing Simulation of Frames Sequence Number Gap Distribution of Sequence Number Gap for AP Misconfiguration Distribution of Sequence Number Gap for High Retransmit and High Loss 58 IX

10 LIST OF ABBREVIATIONS ACK AP BSS CTS IBSS IEEE LAN MAC OSI OUI RF RTS RSSI SDLC SNR SSID SQ WEP WLAN WPA Acknowledgement Access Point Basic Service Set Clear to Send Independent Basic Service Set Institute of Electrical and Electronics Engineers Local Area Network Media Access Control Open System Interconnection Organizational Unique Identifier Radio Frequency Request to Send Received Signal Strength Indication System Development Life Cycle Signal Noise Ratio Service Set Identifier Signal Quality Wireless Equivalent Privacy Wireless Local Area Network Wireless Protected Access

11 ABSTRACT The explosive growth of networks has coincided with increased presence of security treat to these networks. A large portion of these treats are in the form of spoof attacks. Spoof attacks involve with impersonation of authorized network client to access network resource or to launch malicious code. If security measures in wireless network are not without doubts, it is worsen by its performance. Radio interference, attenuation, channel overlapping, sharing of bandwidth and overhead of the wireless protocol are known to degrade wireless network performance. This paper present a wireless sniffer monitoring tool, as well as the analysis and development process of constructing it. The goal is to design a wireless sniffer that can automatically detect spoofing and provide simple network statistic. The wireless sniffer implements sequence number-based spoofing detection algorithm in its processing. The information provided on both security and connectivity problem of wireless network can be generated by sniffing real-time frames capture using wireless adaptor or automation of log analysis on static pcap file. The testing of the wireless sniffer prototype was evaluated against four wireless traffic simulations under normal, spoofing, AP misconfiguration, high loss and retransmitted fi-ames conditions. The result of these tests showed that the wireless sniffer was able to identify all normal gap, spoofing, high gap between successive frames, out of order and retransmit frames. Furthermore, at the end of its execution, the sniffer provide simple network statistic allowing user to detect abnormal fraffic such as high gap between successive frames sequence number or high percentage of retransmitted frames send by a source. This indicates that the wireless network may have been misconfigured or some station may suffer from availability and connectivity issues. These characteristics of the wireless sniffer, provides a foundation for development of more advance monitoring tool that explicitly leveraging on the sequence number field in IEEE MAC header. XI

12 CHAPTER ONE INTRODUCTION 1.0 Introduction The development of wireless networks migrate connectivity into the era of mobile computing. Enterprises, small businesses, and even homes have been deploying wireless networking into their computing environment. Unfortunately, the migration to wireless networks suffers a downside as consumers overlooked the drawback of wireless networks with wired networks. Manufacturer advertised speed of wireless product and promise of mobility is not without a catch. Being a shared medium network, all traffic transmitted on the network passes through public airwaves. Because of this, the built-in security of wired networks, that is the inaccessibility of the transmission medium itself; the physical wires, is no more available in wireless networks. Furthermore in wireless networks, eavesdropping by unauthorized users is virtually impossible to be detected because Radio Frequency (RF) that emit beyond the physical boundary. If security measures in wireless network are not without doubts, it is worsen by its performance. Radio interference, attenuation, channel overlapping, sharing of bandwidth and overhead of the tireless protocol are known to degrade wireless network performance.

13 Growth in wireless network development has been directed toward better infrastructure with strong emphasis on security. However, deployment of wireless network put more burdens to administrator on the assessment on the security threats and reliability of their wireless network. This paper presented a wireless sniffer monitoring tool, as well as the analysis and development process of constructing it. The goal is to design a wireless sniffer that can automatically detect spoofing and provide simple network statistic. The wireless sniffer implements sequence number-based spoofing detection algorithm in its processing. The information provided on both security and connectivity problem of wireless network can be generated by sniffing real-time frames capture using wireless adaptor or automation of log analysis on static pcap file. 1.1 Problem Statement The security threat of wireless network is overwhelming although vendors and standardised bodies are working rigorously to deploy more advanced security measures and newer wireless standard to bring sort of peace to the consumers. For network administrator, maintaining a wireless network would mean offering moreflexibilityto their network user in term of mobile freedom. However, the part where security is a crucial priority remains a cumbersome task. The fact is worsening by the complexity of deploying and maintaining wireless network to provide the freedom of mobility without compromising connectivity. It is without a doubt that network administrators are equipped with arsenal of monitoring software to measure both security and performance of their wireless network. Ranging from off the shelves utility, regardless whether it

14 is open source or proprietary products, it is up to the network administrator to develop the fundamental knowledge of how to treat the vast information from those software on their wireless network for better security and availability. The particular issues of security and connectivity of wireless network discussed in this research is MAC address spoofing and high loss and retransmitframes.mac address spoofing in wireless network that exploit the link layer vulnerability is common attack of impersonating authenticated station to gain access to the network. The implementation of sequence number-based spoofing detection algorithm in a wireless sniffer tries to accomplish the goal of an automated monitoring tool for network administrator to detect spoofing activity. In addition, the wireless sniffer can provide more reliable percentage of duplicate frames over total frames send per source station as part of it network statistic gathering. High percentage of retransmitted frames indicates that the station may suffer connectivity problem. The purpose of this paper is to enrich the repository of wireless tools available to network administrators using manipulation of data link layerframeswith combination of sequence number analysis technique. 1.2 Objectives The objectives of this research are: To conduct a study on underlying data link layer frames for frame sniffing analysis. To experiment on set of wireless frames traffic transactions that can be applied to MAC address sequence number spoofing analysis. To develop a tool that can identify spoofing and provide simple network statistic using sequence number analysis in wireless environment.

15 1.3 Scope The scope of this project is to conduct a study of how data link layer frames can be processed using sequence number analysis to identify spoofing and gather information about a wireless network. With the attained knowledge and understanding, a wireless sniffer tool is developed to automate spoofing detection and provide simple network analysis. 1.4 Significance of the Research The significance of the research is to provide understanding of how data link layer frames can be manipulated allowing spoofing detection mechanism and network information gathering using sequence number analysis. With this imderstanding, the tool developed is hope will be able to compliment the repository of network monitoring software and reduces dependencies on of-the-shelves software especially proprietary software that do not provide source code. As the tool was developed using Perl programming language, it will allow modification that can offer more flexibility in its processing.

16 CHAPTER TWO LITERATURE REVIEW 2.0 Introduction This chapter concern about the subject matter and issues concerning the research. This chapter will attempt to define and explain IEEE frames, network sniffing, MAC address spoofing and spoofing detection using sequence number algorithm. 2.1 IEEE is an industry standard developed by the Institute of Electrical and Electronics Engineers (IEEE) for Wireless Local Area Networks (WLANs). The original standard was defined in 1997, followed by a and b in 1999 and the latest Ig in These standards operate in the Industrial, Scientific, and Medical (ISM) frequency bands. Please refer Table 2.1. IEEE Standard a b Ig Data Rate (Speed) Radio Frequency Band 1-2 Mbps 2.4 GHz Up to 54 Mbps 5.8 GHz Mbps 2.4 GHz Up to 54 Mbps 2.4 GHz Table 2.1 : IEEE Standard

17 The IEEE standard allows for two different ways to configure a wireless network, that are ad hoc and infrastructure. In ad hoc mode, stations commimicate directly with each other on a peer-to-peer level, sharing a given cell coverage area. This type of network is often formed on a temporary basis, and is commonly referred to as an ad hoc network or Independent Basic Service Set (IBSS). In most deployment, the nodes are cormected to an access point (AP) or also known as infrastructure. These network access points are sometimes connected to landlines to widen the LAN's capability by bridging wireless nodes to other wired nodes. When an AP is present, stations do not communicate on a peer-to-peer basis. All communications between stations or between a station and a wired network client go through the AP. A BSS in this configuration is said to be operating in the infrastructure mode. IEEE applies at the lowest two layers of the Open System Interconnection (OSI) protocol stack, namely the physical layer and the data link layer. The physical layer standard specifies the signalling techniques used and the implementation of media specific fiinctions. The data link layer defines the frame transmission structure for control, data and management messages and the architecture for data transmission across a WLAN (IEEE, 1999).

18 2.1.1 IEEE Link Layer Frame The IEEE standard (IEEE, 1999) defines three frame types of both wireless adaptors and access points used for communications. The three frames types are: Management Frame Control Frame Data Frame Every frame regardless of its frame type has a control field that contains the protocol version, frame type and indicator of security features mechanism of WEP or WPA is enabled or not. In all frames contain MAC address of the source, destination station and the access point, frame sequence number, frame body and frame check sequence for error detection. The framestructure is illustrated in Figure 2.1. Octets; Frame Control Duration/ ID Address 1 Address 2 Address 3 Sequence Control Address 4 Frame Body FCS MAC Header Figure 2.1: Frame Structure Particular important part of the IEEE link layer with respect to this research is the frame sequence control. The 16 bit field is used for both defragmentation and discarding duplicate frames. It is composed of a 4 bit fragment number field and a 12 bit sequence number field. Fragment number is used for fragmented frames numbering starting from one with the next fragmented frame increments by one. Sequence number of frame is used to for reassembly of MAC layer frames. IEEE standard requires that the sequence number of each frame is assigned from a counter variable of modulo Successive frame is incremented by one while when a frame is retransmitted, the sequence number is not change. Please refer to Figure 2.2 for framesequence control structure.

19 2 bytes Frame Duraliun Control ID Address 1 (receiver) Address 2 (sender) Address 3 (filtering) Seqcil Address 4 (optional) Frame body FCS ^ ^""^ 12 bits ^ \ Fragmenl Number Sequence Number Figure 2.2 : Frame Sequence Control [a] Management Frames IEEE (1999) defined that management frames enable stations to establish and maintain communications. The following are common management frame subtypes: Authentication frame: authentication is a process whereby the access point either accepts or rejects the identity of a wireless adaptor. The wireless adaptor begins the process by sending an authentication frame containing its identity to the access point. With open system authentication, the wireless station sends only one authentication frame, and the access point responds with an authentication frame as a response indicating acceptance. With the optional shared key authentication, the radio wireless adaptor sends an initial authentication frame, and the access point responds with an authentication frame containing challenge text. The wireless station must send an encrypted version of the challenge text using its WEP key in an authentication frame back to the access point. The access point ensures that the wireless station has the correct WEP key by

20 seeing whether the challenge text recovered after decryption is the same with what was sent previously. Deauthentication frame: A station sends a deauthentication frame to another station if it wishes to terminate secure communications. Association requestframe: association enables the access point to allocate resources and synchronize with a wireless station. A wireless station begins the association process by sending an association request to an access point. This frame carries information about the wireless station, such as supported data rates and the SSID of the network it wishes to associate with. After receiving the association request, the wireless station is considered associating with access point. Association response frame: An access point sends an association response frame containing an acceptance or rejection notice to the wireless station requesting association. If the access point accepts the wireless station, the frame includes information regarding the association, such as association ID and supported data rates. If the association is accepted by the access point, the wireless station can utilize the access point to communicate with other wireless stations on the network and the resource of the network such as wired LAN or Internet access connected to the access point. Reassociation request frame: If a wireless station roams away from the currently associated access point and finds another access point having a stronger beacon signal, the wireless station sends a reassociation frame to the new access point. The new access point then coordinates the forwarding of dataframesthat may still be in the buffer of the previous access point waiting for transmission to the wireless station.

21 Reassociation response frame: An access point sends a reassociation response frame containing an acceptance or rejection notice to the wireless station requesting reassociation. Similar to the association process, the frame includes information regarding the association, such as association ID and supported data rates. Disassociation frame: A station sends a disassociation frame to another station if it wishes to terminate the association. For example, a wireless station that is shut down gracefully can send a disassociation frame to alert the access point that the station is powering off The access point can then renounce memory allocations and remove the wireless stationfromthe association table. Beacon frame: The access point periodically sends a beacon frame to annoimce its presence and relay information, such as timestamp, SSID, and other parameters regarding the access point to wireless stations that are within range. Wireless station continually scan all radio channels and listen to beacons as the basis for choosing which access point is best to associate with. Probe request frame: A station sends a probe request frame when it needs to obtain information from another station. For example, a wireless station would send a probe request to determine which access points are within range. Probe response frame: A station will respond with a probe response frame, containing capability information, supported data rates, after it receives a probe request frame. 10

22 2.2.1 [b] Control Frames IEEE (1999) defined that control frames assist in the delivery of data frames between stations. The following are common control frame subtypes: Request to Send (RTS) frame: The RTS/CTS function is optional and reduces frame collisions when hidden stations have associations with the same access point. A station sends a RTS frame to another station as the first phase of a two-way handshake necessary before sending a data frame. Clear to Send (CTS) frame: A station responds to a RTS with a CTS frame, providing clearance for the requesting station to send a data frame. The CTS includes a time value that causes all other stations to hold off transmission of frames for a time period necessary for the requesting station to send its frame. This minimizes collisions among hidden stations, which can result in higher throughput if properly implemented. Acknowledgement (ACK) frame: After receiving a data frame, the receiving station will utilize an error checking processes to detect the presence of errors. The receiving station will send an ACK frame to the sending station if no errors are found. If the sending station doesn't receive an ACK after a period of time, the sending station will retransmit the frame. 11

23 2.2.1 [c] Data Frames data frames carry protocols and data from higher layers within the frame body. A data frame, for example, could be carrying the HTML code from a Web page. Data frame carries packets from higher layers within the body of the frame Prism Monitor Header Prism monitor header is not a part of IEEE frame header, but is generated by the firmware of the receiving card. The header includes usefiil physical layer information, such as MAC Time, Received Signal Strength Indication (RSSI), Signal Quality (SQ), Signal sfrength. Noise, Signal Noise Ratio (SNR) and data rate. All signal and noise information are in manufacture-specific units. However, they can be used for relative comparison. (Jihwang et al., 2004) 12

24 2.3 Sniffing Sankar et al. (2005) refer sniffing as eavesdropping packets or irames on any medium, in related to this research, the air medium. Air medium provide the best environments for sniffing as it is imdetectable. Sniffing is done as the best way to figure out what is happening on the network. The result of sniffing would yield information about the network in the form of packet or fi"ame capture. However, the packets orfi-amesare required to be analyzed in order to better understand what information it carries Sniffer Howlett (2004) stated that sniffers are generally specific to the type of network they work on. This understanding establishes that type of sniffer is associated with the type of protocol it can analyze. Sniffer enables network traffic to be analysed for specific patterns, troubleshoot specific problems, spot suspicious behaviour and even being abused in reconnaissance of a network before launching attacks. Sniffers operate at the lower levels of the OSI model, the physical and data link layers. 13