مقاله انگلیسی رایگان در مورد حسابرسی امنیتی بی سیم: مسیر های حمله – الزویر 2017

In state of affairs, where wired security systems are not a feasible choice, wireless security devices are the most first-rated choice of an attacker to compromise. The dawn of wireless era based on cloud computing over IoT enabled devices has also set its security threats for a massive boost in enabling attack vectors. Security is now an essential element that forms the keystone of every corporate network and are considered for auditing. But educational institutions ignore the need for wireless security audit and it paves the way for leakage of humongous amount of sensitive and confidential data that are never noticed by the victim. So we have audited the wireless network of one such educational institution which spreads over 400 acre of university grounds and has roughly around 800 wireless access points connected to a radius server used by approximately 6000 individuals. This proposed model is an initial test run to deploy wireless security auditing to act as a point of reference for educational institutions which are not strictly bounded with IT audit polices. It is mysterious to watch the progression of wireless technology over the past decade. IEEE 802.11i for Wi-Fi offers strong authentication and encryption possibilities to protect networks and various enterprises have adopted this technology. At the same time, attackers are becoming more knowledgeable and significant system breaches are happening more often. Majority of payment cards attacks starts via POS terminals with a simple wireless exploit publicly available over the internet. Other wireless protocols have also contributed to wireless security namely WiMAX, DECT, Bluetooth, RFID, ZigBee and in recent times with NFC. Securing Wi-Fi connection is an important part of securing the sensitive user credentials. Security over Wi-Fi is achieved via WEP, WPA and WPA2 protocol standards. Wired Equivalent Privacy (WEP) is the oldest protocol and are no more put into practice as they are proven to be broken.WEP keys does not avail an endto-end encryption as they are not hashed, but simply concatenated to Initialization Vector (IV). RC4 encryption algorithm is used in WEP standard and several successful attacks has been discovered based on this algorithm. The flaws that are recognized in WEP such as lack of proper authentication, vulnerabilities in header and so on. Many obsolete wireless devices still uses WEP, but it is strongly suggested to avoid using WEP due to its open vulnerabilities. Several modifications are made to align WPA towards secure wireless communication. Temporal Key Integrity Protocol (TKIP) is used for encryption process. It requires a key to connect and access the network by authentication process of a typical four way handshake. Wi-Fi Alliance delivered this protocol as two variants, namely in WPA-PSK and WPA-Enterprise mode. WPA-PSK connects the access point by entering a password to be an authorized user. WPA Enterprise uses an additional Remote Authentication Dial-In-User Service (RADIUS) server for larger infrastructure. The Access Point (AP) and other authentication server authenticates end devices over this RADIUS protocol. 802.11 is developed to authenticate users wirelessly to connect to a wired network. It relies on the Extensible Authenticating Protocol (EAP) to send messages between the authenticated server and the client. There are different kinds of EAP which offers authentication options such as EAP-LEAP, EAP-FAST, PEAP, EAP-TLS, and EAP-TTLS. Among that, PEAP is the most recent and also the exceedingly used authentication protocol. It sets up TLS tunnel between client and server and then sends username and password through the tunnel. WPA is also proven to be vulnerable to some of the attacks. To overcome the flaws in WPA, an extension protocol was formulated in the name of WPA2. It works similar to WPA with modifications to patch the existing vulnerabilities. WPA is secure than employing WEP, but it is still vulnerable and are patched by WPA2. Currently WPA2 is considered as the most secure wireless authentication protocol put into practice and also commonly referred to as Robust Security Network (RSN).