CMU6XX

Ethical Hacking

Session 9: Wireless & Mobile Security

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Deconstruct IEEE 802.11 wireless standards and vulnerabilities.
  • Utilize the Aircrack-ng suite for packet capture and deauthentication.
  • Execute offline dictionary attacks against WPA2 handshakes.
  • Compare iOS and Android sandboxing and permission models.
  • Perform static analysis on decompiled APKs to extract hardcoded secrets.

Seminar Structure (3 Hours)

Part 1: Wireless Security (1.5 hrs)
  • WEP, WPA, and WPA2 Vulnerabilities
  • Deauthentication & Handshake Capturing
  • Task 1: WPA2 Handshake Cracking
Part 2: Mobile Application Security (1.5 hrs)
  • OS Sandboxing Architectures
  • Static Analysis & Reverse Engineering (APKTool)
  • Task 2: APK Static Analysis

Part 1: Wireless Security

Duration: 1.5 Hours

Evolution of Wireless Security

Wireless networks project data through walls, eliminating physical boundaries.

  • WEP (Wired Equivalent Privacy): Fatally flawed. Uses RC4 with weak Initialization Vectors (IVs). Can be cracked in seconds simply by collecting enough packets.
  • WPA2-PSK: The current standard. Uses AES encryption. Not mathematically broken, but vulnerable to offline dictionary attacks if the pre-shared key (password) is weak.
  • WPA3: Introduces SAE (Simultaneous Authentication of Equals) to prevent offline dictionary attacks, making passwords much harder to brute-force.

The WPA2 4-Way Handshake

When a client connects to a WPA2 network, it performs a 4-way handshake with the Access Point (AP) to establish encryption keys.

  • Crucially, the actual password is never sent over the air.
  • Instead, cryptographic hashes derived from the password are exchanged.
  • If an attacker captures this handshake, they can take it offline. They guess a password, perform the mathematical derivation, and see if the resulting hash matches the captured handshake.

Deauthentication Attacks

How do you capture a handshake if everyone is already connected?

  • The 802.11 protocol allows an AP to tell a client to disconnect (Deauth frame).
  • Because these management frames are unencrypted in WPA2, an attacker can spoof the MAC address of the AP and send a Deauth frame to a client.
  • The client disconnects. A moment later, it auto-reconnects, performing the 4-way handshake again.
  • The attacker, listening in monitor mode with airodump-ng, captures the handshake.
Practical Resource: Aircrack-ng Documentation

Introduction to Task 1

Capturing the handshake is the easy part. Cracking it requires massive computational power (GPUs) and excellent wordlists.

We will simulate the process of cracking a captured WPA2 handshake using Hashcat.

Task 1: WPA2 Handshake Cracking

Timing: 45 minutes

You have captured a handshake and converted it to the required format: target_network.hc22000. You have the `rockyou.txt` wordlist.

  1. Write the Hashcat command to crack this file utilizing a straight dictionary attack (Mode 22000).
  2. Assume the password is "P@ssw0rd123". Explain why this password might not be in the standard `rockyou.txt` file, and describe how you would use Hashcat "Rules" to mutate the wordlist to find it.
  3. Discuss why enterprise environments use WPA2-Enterprise (802.1X/RADIUS) instead of Pre-Shared Keys (PSK).

15 Minute Break

Please return promptly for Part 2.

Part 2: Mobile Application Security

Duration: 1.5 Hours

OS Sandboxing Architectures

Mobile OSs (iOS/Android) are fundamentally more secure than Desktop OSs due to Sandboxing.

  • Each app runs in its own isolated environment. App A cannot read the memory or file system of App B without explicit permission.
  • Jailbreaking/Rooting: Defeating this sandbox model to gain root access. Essential for deep mobile pentesting, but disastrous for user security.
  • Because the OS is secure, attackers focus on vulnerabilities within the applications themselves.

Static vs Dynamic Analysis

Two primary methods for testing mobile apps.

  • Static Analysis: Analyzing the code without running it. Decompiling an APK to read the source code, searching for hardcoded credentials, insecure crypto, and hidden API endpoints.
  • Dynamic Analysis: Running the app on a device or emulator and intercepting its network traffic using a proxy (Burp Suite). Identical to Web App testing.
Practical Resource: OWASP Mobile Security Testing Guide (MSTG)

Reverse Engineering Android

Android applications (.apk) are essentially zip files containing compiled Java code (Dalvik bytecode) and resources.

  • APKTool: Reverses the compiled resources (like `AndroidManifest.xml` and `strings.xml`) back to readable formats.
  • Jadx: Decompiles the `.dex` bytecode directly back into highly readable Java source code.
  • Developers often falsely believe compiled code is "hidden," leading them to hardcode AWS keys or database passwords directly into the app.

Introduction to Task 2

Hardcoded secrets are a massive problem in mobile development. An attacker can extract them in minutes.

We will simulate the static analysis of a decompiled Android application to find leaked credentials.

Task 2: APK Static Analysis

Timing: 50 minutes

You have run apktool d target_app.apk resulting in a folder structure.

  1. Write the Linux command (using grep or find) to recursively search the decompiled /res/values/strings.xml file for strings containing "API", "KEY", or "SECRET".
  2. You find an AWS Access Key. What is the immediate impact? (Hint: The app accesses an S3 bucket).
  3. Explain how the developer should properly manage API keys in a mobile application architecture without hardcoding them into the client.

Summary & Next Steps

  • WPA2 networks are only as strong as the password chosen. Complex passwords render offline cracking computationally impossible.
  • A mobile app is essentially public source code. Never trust the client with sensitive logic or secrets.
Next Week: Cloud & IoT Security (Modern Architectures)