A quick guide to hacking wireless networks

LAN jacking (hacking wireless area networks) has gained huge popularity in recent years, especially as wireless networks have gained popularity amongst domestic users. LAN jacking is still in the grey area of legality: it is unlikely (though not certain!) that you would be pursued for “borrowing” your neighbour’s unsecured internet access for simply checking your emails, but cracking passwords, or using heavy bandwidth could land you in court!

There are many free wireless access points which you can access legally, but for those who wish to find other ways of securing free internet access, here is my quick guide.

Contents:

1. What you will need
2. Break into a WLAN which doesn’t authenticate users
3. Hijack a WLAN using WEP
4. Bypassing WPA Authentication
5. Further information

What you will need

• A laptop (or if you are at home, a PC will do!)
• A built in Wireless NIC (network interface card) or free PCMIA slot and 802.11b-compliant wireless Ethernet card
• Software for detecting wireless networks

Break into a WLAN which doesn’t authenticate users

Many WLAN users have no authentication on their network (particularly home users), and these are the easiest to break into. Simply configure your NIC to automatically set up its IP address, gateway and DNS servers; then, use the software that came with your NIC to automatically detect and get you online. Many new PC’s and laptops already have software set up to detect any WLAN’s within range and will ask if you would like to join these networks (Apple’s MacBook is a good example).

If your computer doesn’t already have such software, you may like to use Netstumbler as a faster program for detecting WLAN’s within your range.

Hijack a WLAN using WEP

Wired Equivalent Privacy is a common method of WLAN authentication, but it is not particularly secure and may be cracked in seconds by a computer with a reasonably high CPU (however, it must be said that using WEP is better than using nothing at all!). Some Wi-Fi hardware (especially the cheaper brands) are incompatible with better ways of authentication than WEP, so there are many such networks around (and many hackers using them!)

Airsnort is an example of a program which can be used to crack WEP keys; it operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered.

Bypassing WPA Authentication

WPA (Wi-Fi Protected Access) is the toughest WLAN authentication to bypass. By increasing the size of the keys and IVs, reducing the number of packets sent with related keys, and adding a secure message verification system, WPA makes breaking into a Wireless LAN far more difficult.

Many home and small office based WLAN’s use the WPA-PSK (Pre-Shared Key) protocol in which the same pass phrase is used by all users of the wireless access point. CowPatty uses brute force dictionary attacks to gain access to WPA-PSK authenticated networks until the correct pass phrase is found.

WPA2 authentications are of a much higher standard as each user has their own pass phrase. These are mostly used in offices and company networks where strong encryption is a necessity. Although there are programs available to be able to access such networks, I wouldn’t recommend trying it, as you are much more likely to be discovered as an “alien user” and be charged with hacking into the network! See here for an example.

Further information:

• Wardriving.com
• The Happy Hacker
• The Ethical Hacker
• Church of WiFi