Detecting all type of illegal Access Points on enterprise networks
No ratings
Presented at Grehack 2018 by
BYOD(Bring Your Own Device) is becoming popular now, If a company does not provide a Wi-Fi network, employees may use their Wi-Fi adapter(soft AP) or router to set up unauthorized wireless access point on office networks. However, it's a challenge to detect a layer3 AP with WPA/WPA2 protected. The layer3 AP usually comes with NAT(network address translation), which allows multiple local clients to use a same public IP address to access the external network, and the local networks are not visible to external. Existing solutions, such as detecting base the wired and wireless MAC address with the difference of +1/-1, blocking all Wi-Fi access points except whitelist, have much false positive and false negative. In this talk, I will introduce some new method to detect them. It will first inject special packets into a target. If it is an AP device, some of the packets would be successfully transmitted to the wireless medium. Then the packets can be detected by our wireless sniffers. Advantages: * Works for any NAT and Bridge APs, including Soft APs, Router APs, WISP mode APs.* Works for different types of encryption, such as WPA2+AES, WPA2+TKIP, WPA+AES, WPA+TKIP, OPEN.* Can get detailed information about AP’s SSID, Wired and Wireless MAC address, Vendor, etc.* Can get information about the associated wireless clients.* Have none false positive and have few false negatives.