Forum

Hi folks,
I get the impression that most APs don't support VPN connections from clients, however I think that support seems to be in process. I noticed that, for example, even inexpensive APs (SOHO routers) like the Linksys WRVS4400N now have this capability.

From a security perspective, wouldn't the use of a VPN from your WLAN clients to your AP (Router) be the best security currently possible? Even by using WPA2, either "personal" or "enterprise", you're still slightly exposed to brute force programs like coWPAtty. However, with a VPN, I'm guessing the VPN would be established even before any frames are exposed and all but eliminating any potential exposure.

Especially for the SOHO users, man...I've got to think this would be the way to go.

Is my thinking off base? Comments? Suggestions?

Thank you,
Craig

WPA personal can be cracked with coWPAtty so I agree that it should not be used in the enterprise. Actually, its not cracking the PSK that bothers me its the fact that if there is one social engineering attack that reveals the PSK then the entire network is done.

WPA2 enterprise however uses 802.1X/EAP authentication with AES encryption. There are some weak versions of EAP (MD5, LEAP) but the good versions (TLS, TTLS, PEAP etc.) are just as secure as a VPN without the additional overhead and cost.

For SOHO users WPA-PSK authentication with a non-default SSID is extremely strong when using a strong passphrase. Even new versions of coWPAtty can't crack a long passphrase very quickly. Even if it could the dictionary file would have to be 10TB+ in size to find a strong PSK.

Another weakness with VPN over wireless is the vulnerability of hijacking (evil twin) attacks that are eliminated with 802.1X/EAP solutions.

VPN's have their place, but not for "in house" WiFi security.

Hmmm. O.K., you've got my curiosity; why would a VPN over wireless be susceptible to an evil twin attack?

Thank you,
Craig

It is susceptible because the evil twin attack takes place at layer 2 without regard to anything at layer 3.

802.1X/EAP is a layer 2 authentication mechanism and will prevent evil twin attacks if the client STA is only allowed to connect to an 802.11i compliant network.

I know that is the short answer and I'm not an expert at hacking VPN's. However, with a VPN as your only security method I can establish a valid layer 2 connection (hijack) with you and probably layer 3 by distributing a valid IP address via DHCP. None of this can happen with 802.11i compliant networks.

Hmmm, O.K. So you think for the SOHO user, WPA2-PSK would be better than a device (like the Linksys) that supports a VPN connection between my home PCs and the AP (Router)?

With the SOHO, obviously, 802.1X/EAP isn't going to be an option (at least as far as I know).

I just worry about coWPAtty, because they now have a "Uber coWPAtty lookup tables." "The resulting list is ~1,000,000 words for a total of approximatly 40GB of hash tables for the top 1000 SSID's", and it blows through keys at 18,000 per second! Whew!

:-)

Thank you,
Craig

If it is using a VPN only, it would be easy to hijack that connection, much easier than cracking WPA-PSK with the new coWPAtty. So how many keys per second can coWPAtty do if your SSID isn't one of the 1000?

I don't want you to think that I am in love with WPA-PSK but for the SOHO environment with a long complex passphrase it would take an extremely long time to crack or to create the rainbow tables for the new coWPAtty.

Do you realize how few 1,000,000 words actually are? Do the math sometime as to how many combinations there are with 8 character (only) uppercase, lowercase, and simple keyboard symbols. Terabytes baby... :)

Oh, I agree. You make some valid points.

CoWPAtty is pretty interesting; I was at DefCon last year, and "if" I recall correctly, the "tables" they put together were from some of their buddies who somehow scraped some XXX sites passwords (along with others) to compile what were some obscure variations on regular dictionary words.

Thanks for your comments!

:-)

Craig,
I'm not sure I have conviced you. What is your final conclusion?

Oh, I'm sure you're correct.

I guess in my mind I'm thinking that once a VPN is established between client and AP, the entire authentication process wouldn't even be "visible" to a potential hacker. Also, wouldn't the VPN technically be established before any authentication / association?

Ultimately, I'll have to set up both scenarios in a lab environment (which I have access to) and set up a sniffer. I would find the traffic interesting and educational.

:-)

Craig

You are correct, once the VPN is established the authentication traffic would be encrypted.

The VPN cannot be established before 802.11 authentication and association. That is like saying that a VPN could be established before plugging into Ethernet.

The first thing I recommend is to learn how to pull off a hijacking attack. Then establish a hijacking attack against your laptop that is running a VPN. If done correctly the attacking laptop will have layer three access to the device attempting the VPN. I'm not saying that we can break VPN, but with L3 access we are in a good position to fool the end user into thinking they have a VPN connection.

Then try to pull off the hijacking attack against even some simple 802.11i security like WPA/PSK and TKIP (WPA-Personal). You will find that the client device will associate but never be able to pass any frames other than EAP. Remember, 802.11i security takes place after 802.11 authentication and association so you will see 802.11 authentication and association frames.