5.4 Wireless Security (802.11) & VoIP Assessment

5.4 Wireless Security (802.11) & VoIP Assessment

Wireless Local Area Networks (WLANs) and Voice over IP (VoIP) telephony extend enterprise network perimeters beyond physical walls and structured cabling. Because radio frequency signals propagate freely across office boundaries, and telephony protocols frequently operate across shared converged infrastructures, these technologies introduce unique assessment challenges. For the CREST Practitioner Security Analyst (CPSA) examination, candidates must understand 802.11 frame architectures, the mathematical and operational flaws in legacy and modern wireless encryption standards, and the attack vectors targeting enterprise voice infrastructure.

---

1. IEEE 802.11 Wireless Architecture

The IEEE 802.11 standard defines the physical layer and medium access control (MAC) sublayer for wireless communications.

+-----------------------------------------------------------------------------------+
|                             802.11 FRAME CLASSIFICATION                           |
+-----------------------------------------------------------------------------------+
| 1. MANAGEMENT FRAMES:  Establish and maintain radio connectivity.                 |
|                        - Beacon, Probe Request, Probe Response                    |
|                        - Authentication, Deauthentication                         |
|                        - Association Request, Association Response, Disassociation|
+-----------------------------------------------------------------------------------+
| 2. CONTROL FRAMES:     Coordinate medium access, clear channels, and acknowledge. |
|                        - Request to Send (RTS), Clear to Send (CTS)               |
|                        - Acknowledgment (ACK)                                     |
+-----------------------------------------------------------------------------------+
| 3. DATA FRAMES:        Encapsulate upper-layer payloads (IP datagrams, TLS, etc.) |
+-----------------------------------------------------------------------------------+

SSIDs, BSSIDs, and Hidden Network Fallacies

• Service Set Identifier (SSID): A human-readable text string (up to 32 octets) identifying the logical wireless network.
• Basic Service Set Identifier (BSSID): The 48-bit physical MAC address of the radio interface of the Access Point (AP) servicing the BSS.
• Hidden SSIDs (Cloaked Networks): An administrator can configure an AP to suppress broadcasting its SSID by setting the SSID field in periodic Beacon frames to null (zero length or whitespace). Many administrators mistakenly believe this provides security.
  • The Security Fallacy: Hiding the SSID provides zero cryptographic protection and constitutes ineffective Security through Obscurity. The moment a legitimate client connects to the network, the SSID is broadcast in cleartext within the client's Probe Request or Association Request frames. A passive listener running airodump-ng will uncloak the hidden SSID immediately upon observing client traffic.

---

2. Wireless Encryption Standards & Vulnerabilities

+---------------------------------------------------------------------------------------------------+
|                                 802.11 ENCRYPTION EVOLUTION SUMMARY                               |
+---------------------------------------------------------------------------------------------------+
| Standard   | Cipher Algorithm         | Integrity Mechanism | IV / Nonce Length | Security Status |
+------------+--------------------------+---------------------+-------------------+-----------------+
| WEP        | RC4 (Stream)             | CRC-32 (ICV)        | 24 bits           | Completely broken
| WPA        | TKIP (RC4 Stream)        | Michael MIC (64-bit)| 48 bits           | Deprecated/Broken
| WPA2       | CCMP (AES-128 Block)     | CBC-MAC             | 48 bits (PN)      | Vulnerable to PSK
| WPA3       | SAE (Dragonfly) + AES-GCM| PMF (BIP / GMAC)    | 96 / 128 bits     | Secure (Current) 
+---------------------------------------------------------------------------------------------------+

1. Wired Equivalent Privacy (WEP)

Adopted in the original 1997 standard, WEP attempted to provide wireless networks with security equivalent to a physical Ethernet cable:

• Cryptographic Engine: Uses the RC4 stream cipher with a static pre-shared key (40-bit or 104-bit) concatenated with a 24-bit Initialization Vector (IV) to form the RC4 key seed.
• Integrity: Appends a 32-bit CRC-32 checksum known as the Integrity Check Value (ICV).
• Fatal Vulnerabilities:
  1. Short IV Space: A 24-bit IV provides only $2^{24} \approx 16.7 \times 10^6$ unique values. On an active network, IVs repeat within hours, leading to keystream reuse ($C_1 \oplus C_2 = P_1 \oplus P_2$).
  2. Weak Key Scheduling (FMS / KoreK / PTW Attacks): In early bytes of the RC4 keystream, the first bytes strongly correlate with key bytes. The Fluhrer, Mantin, and Shamir (FMS) attack, refined by the PTW (Pyshkin, Tews, Weinmann) algorithm, recovers the secret WEP key by capturing approximately 20,000 to 50,000 packets containing weak IVs.
  3. ARP Replay Amplification: Attackers do not wait for organic traffic; using aireplay-ng -3, they capture a single broadcast ARP request and replay it back to the AP thousands of times per second, forcing the AP to emit fresh IVs and allowing key cracking in under two minutes via aircrack-ng.

2. Wi-Fi Protected Access (WPA)

Introduced as a transitional standard to replace WEP without requiring new hardware:

• TKIP (Temporal Key Integrity Protocol): Wraps RC4 in a per-packet key-mixing algorithm, increases the IV to 48 bits (preventing IV exhaustion), and introduces the Michael 64-bit Message Integrity Check (MIC).
• Weaknesses: Vulnerable to Beck-Tews and Ohigashi-Morii keystream recovery attacks. Furthermore, if an AP detects two invalid Michael MIC calculations within 60 seconds, it shuts down all radio operations for 60 seconds (Michael Countermeasure), creating a denial-of-service vector.

3. WPA2 & The 4-Way Handshake Attack

WPA2 (IEEE 802.11i) mandates the Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP), which utilizes AES-128 for confidentiality and CBC-MAC for integrity.

+-----------------------------------------------------------------------------------+
|                         WPA/WPA2 4-WAY HANDSHAKE (EAPOL)                          |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  Wireless Client (Station)                                Access Point (AP)       |
|            |                                                      |               |
|            | <--- Message 1: ANonce (AP Nonce) ------------------ |               |
|            |                                                      |               |
|   [ Computes PTK from PMK, ]                                      |               |
|   [ ANonce, SNonce, MACs   ]                                      |               |
|            |                                                      |               |
|            | ---- Message 2: SNonce (Station Nonce) + MIC ------> |               |
|            |                                                      |               |
|            |                                             [ Computes PTK, ]        |
|            |                                             [ Verifies MIC  ]        |
|            |                                                      |               |
|            | <--- Message 3: GTK (Group Key) + Install PTK + MIC- |               |
|            |                                                      |               |
|            | ---- Message 4: Acknowledgment (ACK) + MIC --------> |               |
+-----------------------------------------------------------------------------------+

While the AES cipher itself is unbreakable via direct cryptanalysis, WPA2-Personal (Pre-Shared Key / PSK) is vulnerable to offline dictionary attacks targeting the 4-Way Handshake:

1. The Pre-Shared Key is converted into a 256-bit Pairwise Master Key (PMK) using PBKDF2: $\text{PMK} = \text{PBKDF2}(\text{Passphrase}, \text{SSID}, 4096, 256)$.
2. During authentication, the AP and client exchange four EAPOL frames to derive the Pairwise Transient Key (PTK) from the PMK, client/AP MACs, and random nonces (ANonce and SNonce).
3. The Deauthentication Attack: Because 802.11 management frames are unencrypted in legacy networks, an attacker spoofs the AP's MAC address and transmits forged deauthentication frames (aireplay-ng -0 5 -a <BSSID> -c <Client_MAC> wlan0mon) to disconnect the victim.
4. When the victim reconnects, the attacker captures the 4-Way Handshake in Wireshark or airodump-ng.
5. The attacker takes the capture offline and executes a dictionary or brute-force attack against the PMK using tools like Hashcat (hashcat -m 22000 capture.hc22000 wordlist.txt) without interacting with the live network.

4. WPA3: Simultaneous Authentication of Equals (SAE)

WPA3 resolves the vulnerabilities of WPA2:

• SAE (Dragonfly Handshake): Replaces the static PSK 4-way exchange with a password-authenticated key exchange based on zero-knowledge proofs (RFC 7664). Attackers observing the handshake gain no mathematical ability to perform offline dictionary cracking; an adversary must interact online with the AP for every single guess.
• Forward Secrecy: Even if a password is compromised in the future, past captured traffic cannot be decrypted.
• Protected Management Frames (PMF / IEEE 802.11w): WPA3 mandates PMF, which cryptographically signs and encrypts unicast and broadcast management frames (such as Deauthentication and Disassociation), rendering deauthentication attacks entirely ineffective.

5. Enterprise Wireless (IEEE 802.1X / EAP)

WPA/WPA2/WPA3-Enterprise replaces pre-shared keys with individualized user authentication backed by a centralized RADIUS server.

Rogue AP / Evil Twin Attacks Against PEAP

In environments deploying PEAPv0 with EAP-MSCHAPv2:

• An attacker sets up a rogue Access Point broadcasting the corporate SSID using tools like hostapd-wpe or EAP-Hammer.
• If corporate endpoint devices are misconfigured (e.g., "Validate server certificate" is disabled in Windows/macOS network profiles), the endpoint connects to the rogue AP.
• The rogue AP presents an untrusted TLS certificate. The victim machine automatically accepts it and sends its MSCHAPv2 challenge-response hash inside the tunnel.
• The attacker captures the hash (username:$NETNTLM$...) and cracks it offline using Hashcat (hashcat -m 5500) to recover the user's plaintext Active Directory password.

---

3. Voice over IP (VoIP) Assessment

Voice over IP architectures split telephone communications into two distinct protocols:

1. Call Signaling (Setup & Teardown): Governed by the Session Initiation Protocol (SIP).
2. Media Streaming (Audio & Video Payload): Governed by the Real-time Transport Protocol (RTP).

+-----------------------------------------------------------------------------------+
|                              VOIP CALL ARCHITECTURE                               |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|    Caller Phone (IP: 10.1.1.50)                           Callee Phone (IP: 10.1.1.60)
|         |                                                             |           |
|         | --- 1. SIP INVITE (UDP 5060) ----> [ SIP PBX Server ]       |           |
|         |                                           |                 |           |
|         |                                           | --- INVITE ---> |           |
|         | <--- 2. SIP 200 OK (SDP Negotiated) <---- | <--- 200 OK --- |           |
|         |                                                             |           |
|         | =========================================================== |           |
|         |       3. RTP AUDIO STREAM (Direct UDP: Ports 16384-32767)   |           |
|         |          (Two-way G.711 / G.729 Cleartext Audio)            |           |
|         | =========================================================== |           |
|         |                                                             |           |
|         | --- 4. SIP BYE (Call Teardown) --> [ SIP PBX Server ]       |           |
+-----------------------------------------------------------------------------------+

Session Initiation Protocol (SIP)

SIP, defined in RFC 3261, is an ASCII, text-based signaling protocol modeled directly after HTTP:

• Ports: Operates unencrypted over UDP or TCP port 5060, or encrypted via TLS over TCP port 5061 (SIPS).
• Core Methods: INVITE (initiates call), ACK (confirms response), BYE (terminates call), CANCEL (aborts pending call), REGISTER (registers client location with SIP registrar), OPTIONS (queries server capabilities).
• User Enumeration Attacks: Attackers use tools from the SIPvicious suite (svmap, svwar, svcrack) to enumerate valid user extensions:
  • svwar sends a barrage of REGISTER or INVITE messages targeting numeric extensions (e.g., 100 to 999).
  • The PBX responds with distinct status codes: 200 OK or 401 Unauthorized for valid extensions versus 404 Not Found for non-existent extensions, leaking valid employee extension numbers.
  • svcrack then performs password dictionary attacks against identified extensions to hijack phone lines for Toll Fraud (placing unauthorized international or premium-rate calls billed to the target company).

# Mapping SIP PBX endpoints using svmap
svmap 192.168.1.0/24

# Enumerating active SIP extensions between 100 and 500 using svwar
svwar -e 100-500 192.168.1.15

Real-time Transport Protocol (RTP) & Eavesdropping

Once SIP establishes a call via the Session Description Protocol (SDP), the audio stream is transmitted directly between endpoints using Real-time Transport Protocol (RTP, RFC 3550):

• Ports: Runs over dynamic, negotiated UDP ports (typically within the range 16384 to 32767).
• Eavesdropping Risk: Standard RTP packets are completely unencrypted. Voice payloads are encoded using standard audio codecs such as G.711 $\mu$-law (PCMU), G.711 A-law (PCMA), or G.729.
• If an attacker gains access to the voice VLAN (or executes an ARP spoofing attack between an IP phone and the gateway), they can capture network traffic using Wireshark.
• Using Wireshark's built-in analysis tool (Telephony $\rightarrow$ VoIP Calls $\rightarrow$ Play Streams), the attacker can reconstruct the voice conversation in real time and listen to the audio with crystal-clear fidelity.

Secure RTP (SRTP) & Key Exchange Pitfalls

To protect call confidentiality and integrity, organizations deploy Secure RTP (SRTP, RFC 3711):

• Cryptographic Engine: Uses AES-128 in Counter Mode (CTR) to encrypt audio payloads and HMAC-SHA1 to provide message authentication.
• The SDES Vulnerability: In legacy implementations, SRTP keys are negotiated using SDES (Session Description Protocol Security Descriptions, RFC 4568).
  • SDES transmits the SRTP master cryptographic key as a base64 string directly inside the body of the SIP signaling message.
  • If SIP signaling is transmitted over unencrypted UDP port 5060, the attacker sniffs the cleartext SIP INVITE packet, extracts the base64 SRTP key, and uses it to decrypt the SRTP voice stream.
  • Remediation: Enforce TLS for SIP signaling (TCP port 5061), or deploy DTLS-SRTP (RFC 5763) or ZRTP (RFC 6189), which perform authenticated Diffie-Hellman key exchanges directly across the media channel.