TELKOM
NIKA Indonesia
n
Journal of
Electrical En
gineering
Vol.12, No.6, Jun
e
201
4, pp. 4639 ~ 4
6
4
7
DOI: 10.115
9
1
/telkomni
ka.
v
12i6.544
6
4639
Re
cei
v
ed
De
cem
ber 2
9
, 2013; Re
vi
sed
March 1, 201
4; Acce
pted
March 18, 20
14
Wireless Network Risk Assessment Model and
Application
JianGan
g
Ta
ng
Yunnan Police
Officer Academy
W
uhua D
i
strict, Kunmin
g Cit
y
,
Yunn
an Prov
in
ce, Chin
a, +
86 137
00
600
07
6
email: 6
561
51
96@
qq.com
A
b
st
r
a
ct
W
i
reless n
e
tw
ork makes u
p
the w
i
red net
w
o
rk shor
tcomings. W
i
th the
pop
ular
ity of the W
i
F
i
termi
nal, the s
e
curity threats
are consta
ntly
upgra
d
i
ng, an
d the security
issues h
a
ve b
een p
l
a
gui
ng t
h
e
legitimate
user
. In this paper
we had
analy
z
ed the risks
mechanis
m
of
WLAN for
network resourc
e
s, and
desi
gne
d an a
ssessment mo
del of
sec
u
rity risk.
W
hen
t
h
e
inci
de
nts of n
e
tw
ork security
w
h
ich ca
use
d
for
vuln
erab
ility fa
ctors had
be
en
occurre
d, the
mo
de
l c
an be used
to asses
s
the
cons
eq
u
ences an
d
i
m
p
a
ct
on W
L
A
N
. T
h
e
mod
e
l
ach
i
ev
es the
n
e
tw
ork secur
i
ty e
a
rly
w
a
rning
a
nd c
ontrol
by
scie
n
t
ific meas
ure
m
en
t
and
eva
l
u
a
tion
of the WL
AN
security r
i
sks. Wireless
net
w
o
rk security i
s
not
only
w
i
th a
u
thentic
atio
n
,
encrypti
on, int
egrity testin
g and
ot
her tec
hno
logy-r
elat
e
d
, but als
o
n
eed i
n
trusi
on
detectio
n
systems
,
firew
a
lls an
d other techn
o
l
ogy
cooper
atio
n, so it
’
s
a multi-l
a
yered pr
obl
e
m
.
Ke
y
w
ords
:
w
i
reless
netw
o
rk, assess
me
nt mod
e
l
of s
e
curi
ty risk,
a
u
thentic
atio
n
mec
h
a
n
is
m, s
e
curity
policy
Copy
right
©
2014 In
stitu
t
e o
f
Ad
van
ced
En
g
i
n
eerin
g and
Scien
ce. All
rig
h
t
s reser
ve
d
.
1. Wireless
Net
w
o
r
k Se
c
u
rit
y
Risk Assessme
n
t M
odel
1.1. The Mec
h
anism of WLAN Se
curity
R
i
sk Model
Establishme
n
t
of a wireless n
e
two
r
k
secu
ri
ty risks
Mech
ani
sm is the study of the
premi
s
e
of WLAN
se
cu
ri
ty risk a
s
se
ssment. Ri
sk
refers to th
e
act or
event
uncertainty of
the
res
u
lts. WLA
N
se
cu
rity
ris
k
refe
rs to th
e se
cu
rity problem
s ca
used by WL
AN
system, or a
c
tual
events may cause threat.
WLAN
se
cu
ri
ty risks
con
s
t
i
tute divided into five fields: the sour
ce
of threat, the way of
threat, the incentives of threat, the victims of
threat and the co
nseque
nces of threat. The
so
urce
of threat is th
e initiator of the threat; Th
e way of
thre
at is the mea
n
s of the impl
ementation of
the
threat; Th
rea
t
induci
ng fa
ctor i
s
the
wea
k
n
e
ss
ex
ploited by th
reats,
calle
d
vulnera
b
ility or
vulnera
b
ilities; Threaten victims are thre
atened o
r
target object; Th
e con
s
eq
uen
ce
s of the threat
is due to the l
o
ss suffe
red
as a re
sult of
the threat situ
ation, also
kn
own h
a
zard
s
The
relatio
n
ship b
e
twe
e
n
threat
s
ca
n
be
expre
ssed a
s
th
e fo
llowing.
On
e
or mo
re
origin
s
of ri
sk, using
on
e o
r
mo
re of
wa
y,
damage
o
ne o
r
mo
re
n
e
twork
re
sou
r
ce
s, a
nd
ca
use
information system abnormalities or
crash. The source of threat
s uses the
vulnerabilities of
WLAN, threa
t
s netwo
rk
reso
urce
s, ca
use a ne
gati
v
e impact o
n
the WLAN, As shown in
Figure 1.
Figur
e 1.
Net
w
or
k R
e
s
o
u
r
c
e
S
e
cu
rit
y
Risk
s Me
cha
n
is
m
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 6, June 20
14: 4639 – 4
647
4640
1.2. Factor
s Consid
ered i
n
Risk Asse
ssment
I
n
t
he res
e
a
r
ch of
W
L
A
N
se
curit
y
ri
sk
as
se
ssm
ent
,
t
he net
wo
r
k
r
e
so
ur
ce
s,
t
h
e
t
h
reat
s,
the vulne
r
abi
lities, the
se
curity m
e
a
s
u
r
es,
th
ey all
are
the fa
ctors
whi
c
h
have
compl
e
x
interrelation
s
hips, a
s
sh
own in Table 1.
Table 1. The
Relatio
n
ship betwe
en Ri
sk Fa
ctors an
d the Value of Risk A
s
sessme
nt
Relationship
F
a
ctor
s of r
i
sk assessment
Risk F
a
ctor
s
Risk asses
s
ment values
The value of net
w
o
rk resources
↗
↗
↘
↘
The numbe
r of th
reat sources
↗
↗
↘
↘
Vulner
ability
of networ
k r
e
sour
ces
↗
↗
↘
↘
The cost of secur
i
ty
m
easures
↗
↗
↘
↘
The pro
g
ress of
security
m
easure
s
↗
↗
↘
↘
The residual risk from securit
y
me
asures
↗
↗
↘
↘
1.3. The Mod
e
l for Calcul
ating th
e Ris
k
Ass
essme
n
t
In this se
ctio
n, we u
s
e the
probl
em of
WLAN, a
nd t
hen ba
se
on
the analysi
s
of the risk
factor th
eory
above, an
d e
s
tabli
s
h the
secu
rity risk
a
s
sessme
nt m
odel
whi
c
h i
s
use
d
to g
e
t the
safety grad
es of WLAN, sh
own in Fig
u
re
2.
Figure 2. Risk Asse
ssm
en
t M
odel of Ne
twork Re
so
urce
s
It can be ded
uce
d
from the
model diag
ra
m, Acco
rding
to Figure 2:
(
I
,
P
(W
,
T
))
Rf
f
（
H,
W
,T
）
=
0,
1
R
,
0,
1
P
.
R is the risk
of WLAN; N
is the network re
sources;
W is the vulnerability of
network
resou
r
ces; T is the threat to netwo
rk
re
sou
r
ces;
I is the impo
rtan
ce of the network a
s
sets; P
is
the prob
abilit
y of secu
rity incid
ents
whi
c
h will be ha
pp
ened.
1
f
s
I
I
,
1
f
s
PP
,
0,
1
f
I
,
0,
1
f
P
;
Subscri
p
t f indicate
s that the se
cu
rity incide
nt did not
occur; Sub
s
cript
s indi
cat
e
s that
the se
curity incid
ent ha
s o
c
curred.
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
Wirel
e
ss Network Ri
sk Asse
ssm
ent Mo
del and Appli
c
ation (Jia
nG
ang Tan
g
)
4641
The value of R is the security incidents a
nd their imp
a
c
t likelih
ood e
s
timation.
R=f
(the
imp
o
rtan
ce
of n
e
twork re
so
u
r
ce
s, th
e p
r
o
bability which may
be
h
appe
ned
s
e
c
u
rity iss
u
es
c
o
me into being.
11
1
1
f
fs
s
s
s
s
s
RI
P
I
P
I
P
I
P
;
The fact
s that cau
s
e ne
twork securit
y
incident
s are the vuln
erability of netwo
rk
resou
r
ces an
d the
thre
ats from
WLA
N
.
We
use
these
two
fa
ctors th
rou
g
h
a
re
asona
ble
algorith
m
in the risk a
s
sessment mo
del.
Definition 1. The
th
ree
fa
ctors whi
c
h
t
h
reate
n
n
e
twork security
are f
r
om th
e
Internet,
LAN threat, and vulne
r
ability of netwo
rk
re
source
s, give
n a finite set of items
12
,,,
x
Dd
d
d
. For example
,
if
3
x
then we d
edu
ced
12
3
,,
Dd
d
d
.
Definition 2. We give
diffe
rent
fa
ctors whi
c
h
th
reate
n
net
work a different weig
ht,
given
the finite
set
of weight
12
,,
,
y
Hh
h
h
, and
yx
. For exa
m
ple, if
3
x
then de
du
ced
3
y
and
12
3
,,
hh
h
h
.
Definition
3. In the a
s
sessment of the thr
eat level
of netwo
rk
re
source
s, we
made a
n
evaluation va
lue set a
s
12
,,
,
q
Gg
g
g
, G is the
set
whi
c
h expe
rts evaluate t
he ea
ch
element i
n
se
t D. For exam
ple, if
5
q
then
we ded
uced
1
2345
,,
,,
H
g
gg
gg
= {Very
Hi
gh,
High, Medi
u
m
, Low, Very Low}.
The memb
ership d
egree a
m
ong
i
d
and
j
g
is
,5
1,
1
1
ij
i
j
i
ij
i
Kc
t
.
The
ij
C
is assessment level
j
given by the experts fo
r th
e factor
of
i
,
t
is the weight
of factor of
i
.
Then the likel
ihood of secu
rity problem
s
is
35
11
T
si
i
j
j
ij
L
hk
g
H
K
G
.
The
K
is
the membership matrix,
T
G
is the transpo
sed ma
trix of G.
1.4. Computi
ng the Degre
e
of Importa
nce of
Net
w
ork Re
sourc
e
s
After the s
e
curity inc
i
dent
s
occu
rred, we can use the
impa
ct of
netwo
rk re
source to
asse
ss
the i
m
porta
nce of cyber
sou
r
ce
.
The
impor
t
ance of the
conve
r
si
on o
f
asset
s
mainl
y
considers the three factors whi
c
h
are
the confidentiali
ty, integrity,
a
v
ailability. According to the
fuzzy
comp
re
hen
sive eval
uation m
e
th
od,
we d
e
fin
e
the
set
whi
c
h
contai
ns the
fact
ors
of important degree for as
sets
[1].
D
= {
Co
nfidenti
a
lity,Integrity,
Availabilit
y
} =
12
3
,,
dd
d
The e
a
ch
co
rre
sp
ondi
ng
weig
ht vecto
r
which
a
s
si
gned
to diffe
rent fa
ctor is varie
s
depe
nding o
n
the type of e
v
aluation sy
stem varie
s
.
Evaluation set
is
1
,
2,
3
,
4,
5
W
w
ww
ww
;
w1, w2,
w3, w4,
w5 repres
ent
the
five
levels of th
e
assig
n
ment
of co
nfidenti
a
lity, in
tegrity, assignm
ent
, assi
gnm
ent
availability. For
example, the five levels set
as Very
Hig
h
,
High, Mediu
m
, Low, and
Negli
g
ible [2].
Integrated e
v
aluation alg
o
rithm e
s
timates the total volume of information
assets,
cal
c
ulate
d
as
follows:
Initialize the o
r
iginal o
b
serv
ation matrix X, the following
is the formul
a:
11
1
1
n
mm
n
s
s
S
s
s
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 6, June 20
14: 4639 – 4
647
4642
m is the
nu
mber
of sa
m
p
les
(a
ssess the
numb
e
r of expert
s
),
n is the
nu
mber
of
variable
s
eval
uated.
Experts
s
e
t eac
h
fac
t
or
in
U
refe
ren
c
e
to
the evalu
a
tio
n
set V, which is the val
u
a
t
ion
of informat
ion asset
s
confidentiality,
integrity, availability. Transformi
ng the
origin
al ob
servation matrix S, can be de
rived from the fuzzy sub
s
et
E
.
11
1
1
1
1
2
1
3
1
4
1
5
2
1
22
23
24
25
1
3
13
2
3
33
4
3
5
n
mm
n
ee
e
e
e
e
e
E
ee
e
e
e
e
e
ee
ee
e
Then the de
g
r
ee of impo
rtance of network
re
sou
r
ces is
T
s
I
HE
W
.
1.5. Risk Gra
d
e Ev
aluation
Thro
ugh
cal
c
ulated ri
sk
se
t of R we
define the asse
ssment
set of
R
V
.
VR
(
%
)
0
20
40
60
80
100
Ab
s
o
l
u
t
e
l
y
sa
f
e
Sa
f
e
Low
R
i
s
k
Me
di
um
ri
s
k
Hi
g
h
-
r
i
s
k
Ve
r
y
h
i
g
h
ri
s
k
Ex
t
r
e
m
e
uns
a
f
e
VR
(
%
)
Figur
e 3.
Net
w
or
k R
e
s
o
u
r
c
e
S
e
cu
rit
y
Risk
s Me
cha
n
is
m
Gene
rally we
call that the
R
V
is greate
r
than 70% of high-
ri
sk i
s
high risk WLA
N
, as
shown in
Figure 3. It describes
the impl
ementation
of safety org
ani
zations
Capability Maturity is
not enou
gh. So it needs t
o
analyze the
main factor
s
cau
s
in
g the
large
r
value
s
of R, and thro
ugh
the
manag
em
ent an
d te
ch
nical
mea
n
s
to
redu
ce th
e
s
e
facto
r
s, a
nd the
n
a
s
se
ss the
R a
g
a
i
n
,
until to redu
ce the risk to a
n
accepta
b
le
degree for
WLAN.
2. Wireless
Net
w
o
r
k Se
c
u
rit
y
Risks Exist
Wireless
network
is
fac
e
d with
vario
u
s
ways
of intru
s
ion. T
o
solve these p
r
obl
ems, th
e
client u
s
e
r
s
must u
nde
rst
and the
hidd
en da
nge
rs
o
f
wirele
ss net
work. Safety probl
em
s fou
nd
are the follo
wing.
2.1. Net
w
o
r
k
Dev
i
ces
w
i
thout Secu
rity
Protection
Wirel
e
ss net
work u
s
e
r
s in
experie
nced
not to
modify the device p
a
r
amete
r
s,
co
ntinue to
use the d
e
fau
l
t settings whi
c
h come
s fro
m
the factor
y. If
the wireless
router is
not
s
e
t, hack
e
rs
in
the wi
rele
ss
netwo
rk cove
rage
can di
re
ctly inv
ade th
e wi
rele
ss ne
twork. In a
ddi
tion, Wind
ows,
Androi
d, IOS
and
other op
erating
sy
ste
m
s,
whi
c
h it
self
ha
s zero configur
ation wirel
e
ss network
function, can
automatically sea
r
ch for Wi
Fi
signal
s an
d automatic
conne
ction fun
c
tion.
2.2. WLAN Cov
e
rage too Wide
The a
d
mini
strator nee
ds to be
co
nsi
d
e
r
ed f
r
om
a gl
obal
se
cu
rity laid wi
rel
e
ss
netwo
rk
acce
ss
point,
so th
at sati
sfy the req
u
ire
m
ents
of
wi
re
less coverag
e
, do n
o
t bey
ond the
scop
e of
coverage.
When de
sig
n
a WLAN,
wirel
e
ss AP sh
ould
be cho
o
se a
c
cordi
ng to th
e actual n
eed
s,
if blindly select wireless A
P
wh
ich tran
smit po
wer
a
nd anten
na
gain is to
o la
rge, altho
ugh
it
increa
se
s the
cove
rag
e
, a
nd en
han
ce
the
signal
st
rength, but it
increa
se th
e
oppo
rtunitie
s
of
informatio
n le
aka
ge.
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
Wirel
e
ss Network Ri
sk Asse
ssm
ent Mo
del and Appli
c
ation (Jia
nG
ang Tan
g
)
4643
2.3. Factor
s w
i
thin the
Net
w
o
r
k Term
inal
Many fa
ctors
enda
nge
r n
e
twork security, co
mpute
r
virus, T
r
oja
n
i
s
t
he m
o
st
harm
f
ul and
extensive
effect o
n
the
net
work, follo
we
d by the
de
ni
al of
servi
c
e
attack.
Wh
en
a terminal
which
had be
en infe
cted with viru
s and T
r
ojan
con
n
e
c
ted to
the netwo
rk, the termin
al will send a la
rg
e
numbe
r of invalid data or b
r
oad
ca
st, occupied n
e
t
w
o
r
k co
nne
ct
ion
s
,
caus
es n
e
t
w
ork
con
g
e
s
t
i
o
n
,
and cau
s
e ot
her u
s
e
r
s
can
not use the n
e
twork.
2.4. The Existenc
e of Netw
o
r
k Monito
ring Technol
og
y
Network m
o
nitoring
tech
nology
wa
s origi
nally
desi
gne
d to
monito
r th
e data
comm
uni
cati
on, so that th
e admini
s
trat
ors
co
nv
enie
n
t and efficie
n
t find netwo
rk a
nomali
e
s
and
inse
cu
rity. It’s used by illegal intru
d
e
r
s a
s
an effective and p
o
we
rful mea
n
s of steali
n
g
informatio
n. Run in p
r
om
iscuou
s mo
d
e
wirele
ss
NIC can
com
p
lete the net
work mo
nitoring
function.
2.5. The Har
d
w
a
re is Embedded Mo
n
i
toring Modu
le
Global
netwo
rk e
quip
m
ent
manufa
c
ture
rs h
a
ve Ci
sco, Motorol
a
, SMC, IPCOM
,
D-Lin
k
,
Hua
W
ei, ZTE
etc., Genera
lly spea
king,
the manufa
c
ture
rs of eq
ui
pment is to meet the cu
rrent
need
s of n
e
twork a
ppli
c
ati
on an
d the ef
fective real
i
z
ation of the n
e
twork
con
n
e
c
tion, en
su
re
the
stability and
secu
rity of net
work. But for
the nation
a
l strategic ne
ed
s, so
me
cou
n
t
ries i
n
orde
r
to
steal
co
nfide
n
tial informati
on from the
o
t
her
co
u
n
trie
s, the gove
r
n
m
ent o
r
de
rs
manufa
c
turers to
install o
r
eve
n
embe
d mo
nitoring m
odu
le on it
s net
work
equi
pmen
t, and ordin
a
ry users
cann
ot
be aware of its existen
c
e.
2.6. Early
WiFi Standard i
s
Imperfec
t
Wirel
e
ss net
work en
cryption method
s
are WEP, WPA and
WPA2. Beca
use the
mech
ani
sm o
f
wirele
ss net
work
se
cu
rity may be defe
c
tive, wirel
e
ss net
work
sta
ndards
nee
d
to
be pe
rfecte
d
grad
ually. Ha
ckers u
s
e
spe
c
ial te
chnolo
g
ies, to
ols, software
to invade
and
enda
nge
r the
safety of WLAN.
WEP (Wired
Equivalent
Privacy) is
Wire
d
Eq
uivalent Priva
c
y
protocol. WEP is the
origin
ally sta
ndard protocol of
802.11
b
defined by wirele
ss
allian
c
e. Becau
s
e
WEP uses 6
4
bit
or 12
8 bit e
n
c
ryption
key
encryption al
gorithm
RC4,
a few yea
r
s
ago, rese
archers an
d ha
ckers
have bee
n ab
le to decip
her the WEP standard.
WPA (Wi
Fi Protecte
d Access) i
s
a wi
re
less se
cu
rity proto
c
ol in
ste
ad of WEP, whi
c
h is
mainly
u
s
e
d
i
n
wi
rel
e
ss ne
twork with hi
gh se
cu
rity
level. Because
it uses is
still
rel
a
tively weak
RC4 en
crypti
on algo
rithm,
so the illeg
a
l
intrude
rs li
st
ening e
nou
gh
data pa
cket, then usi
ng hi
gh
perfo
rman
ce
comp
uting eq
uipment, eve
n
if t
he WPA
has TKIP prot
ection may b
e
cra
c
ked.
WPA ce
rtifica
t
ion has t
w
o
kind
s, one
ki
nd is
to a
dopt
802.1x+EAP
mode, the cli
ent use
r
only nee
d to
provide
certification
do
cum
ents,
su
ch a
s
the a
c
count
name, p
a
ssword
and
othe
r
informatio
n, certification th
r
ough the
RA
DIUS auth
ent
ication
se
rver. Another wa
y is WPA Pre
-
Shared Key (WPA-PSK)
mode, it dose not equip
with a professi
onal authentication
serv
er
.WPA-PSK is mainly used
for the appli
c
ation wh
i
c
h
contains a sm
all number of users.
WPA2 is the
second g
e
n
e
ration of
WPA. It
’s the se
curity sol
u
tions Wi
Fi Alliance
launched a revised based on the latest I
EEE 802.11i standard. WPA2 uses AES encrypti
on
follows the (U.S.) National I
n
stitute of St
anda
rd
s an
d
Tech
nolo
g
y (NIST) FIPS1
40-2
and
802
.1x
authenti
c
atio
n.
3. Wireless
Net
w
o
r
k In
tr
usion Proce
ss Analy
s
is
WPA
en
cryption system h
a
s no
fla
w
s can
be
explo
i
ted currently, so
can
not
gain th
e
password by
colle
cting
suff
icient d
a
ta pa
cket
and
anal
yzing e
n
crypti
on alg
o
rithm
s
. The only
wa
y
to cra
c
k WP
A passwords
is to u
s
e a di
ctiona
ry
to attack. Ho
weve
r, some of the
equipm
ent can
be cracke
d b
y
using WPS
encryption se
curity vu
lne
r
a
b
ilities, and th
erefo
r
e it can
be invade
d.
3.1 Crac
k WEP Encr
y
p
tion
802.11
had
defined th
e
WEP algo
rith
m for d
a
ta
encryption p
r
oce
s
s, as shown in
Figure 4.
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 6, June 20
14: 4639 – 4
647
4644
Figure 4. WE
P Encryption
Process
IV is
initializ
a
tion vec
t
or, P
ASSWORD is
the enc
r
yption password
of the AP, KSA=
IV+
PASSWORD, DATA is
not enc
r
ypte
d data, CRC-32
is
the integr
ity c
h
eck
value, PRGA
=
RC4
(KSA),gain E
N
CRYPTED
DATA by XOR, IV+
E
N
CRYPTED DATA is
s
ent out through WiFi.
Upo
n
receivin
g the d
e
crypti
on p
r
o
c
e
s
s of
termin
al, it a
d
opts the m
e
thod to
gen
e
rate the
same
encryp
t
ion and de
cryption key, then ma
ke
th
e ciph
ertext and de
crypti
on key XO
R and
cal
c
ulate
d
a
new
CRC-R, If the en
cry
p
tion key an
d de
cryptio
n
key i
s
the
sa
me an
d
CRC-R
equal
s the o
r
iginal
CRC3
2, it i
ndicates the receiver had al
rea
d
y got the o
r
iginal plai
ntext,
conve
r
sely decryptio
n failed.
WEP encryp
t
ion invasio
n
pro
c
e
ss i
s
as follo
ws:
Firstly, need
to obtain the target
netwo
rk information by
scannin
g
Wi
Fi, as th
e Fi
g
u
re 5
sho
w
s.
Then
gra
b
I
V
s pa
cket, when
acce
ss to e
n
ough
num
ber of pa
ck
et
dat
a,
you can ob
tain
the WEP
en
crypted
p
a
ssword, as
the
Figure 6 sh
o
w
s.
Figure 5. Sca
nning
WEP
Figure 6. Get the WiFi Password
3.2 Crac
k WPA Encr
y
p
tion
Crack
WPA-PSK need to
get a ha
ndshake
packet called 4-way-
handshake, as
shown i
n
Figure 7. WPA-PSK s
e
curity s
y
s
t
em
is
a
s
e
c
u
re
encryption mec
h
anis
m. At pres
ent only
the
probable
way
us
es
pas
s
word dic
t
io
nary to attac
k
.
In the s
e
c
u
rity s
ystem of WPA-PSK joined the
unspo
ken
rul
e
agai
nst th
em. Beca
use the p
a
cke
t
of 4-way-h
and
sha
k
e
co
ntains
co
nta
c
t
informatio
n a
nd pa
sswo
rd
s, so ha
ckers rely on th
is informatio
n a
nd use pa
ssword dictio
na
ry to
attack wi
rele
ss n
e
two
r
k. T
h
e main
data t
r
an
sf
ers
by 4
-
way
han
dsh
a
ke
are the f
o
llowin
g
: SSID,
AP_MAC, STATION_MA
C, Snonce,
Anonce, 802.1x
data an
d MIC.
We
all kn
ow that MIC
an
d
password whi
c
h only ha
s a
relation
ship. By
pdkdf2_S
HA1, SHA1_
P
RF, HMAC_
M
D5 alg
o
rith
m
finally gen
era
t
es MI
C-1,
when
a p
a
ssword
is foun
d
i
n
the
dictio
na
ry which MIC-1 i
s
equ
al to
the
MIC, then the
hacker h
ad found the p
a
ssword.
Figure 7. 4-way Hand
sh
ake
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
Wirel
e
ss Network Ri
sk Asse
ssm
ent Mo
del and Appli
c
ation (Jia
nG
ang Tan
g
)
4645
3.3. Crack
WiFi
w
i
th a Pa
ss
w
o
r
d
Dicti
onar
y
This meth
od
is suitable f
o
r all types of
encryptio
n
network, for example the WEP
encryption, th
e WPA
en
cry
p
tion, the
WP
A2 en
cryp
tio
n
. Its p
r
in
cipl
e is through
t
he
kno
w
n
st
ring
one
by on
e t
o
verify the
p
a
ssword
di
ctionary
whi
c
h
t
he h
a
cke
r
m
ade, to
dete
r
mine
wheth
e
r the
password is
corre
c
t to the
target wi
rele
ss
netwo
rk. Password
dicti
onary h
a
s th
e followin
g
th
ree
kind
s of
cat
e
gorie
s.
Wea
k
pa
ssword
dictio
nary is likely to
be fo
u
nd a
n
d
cra
c
ked
by ha
ckers. Th
e strong
password ha
d been exp
o
s
ed. So
cial e
ngine
erin
g p
a
ssword
whi
c
h ha
s a rel
a
tionship wit
h
the
individual info
rmation, such
as the birt
hd
ay of client, cell phon
e nu
mbers, etc.
3.4. Use the Vulnerabilities of WPS
WPS (WiFi
Protected Setup) i
s
the
Wi-Fi a
lliance certification
pr
ogram, is not a new
safety perfo
rmance, the p
u
rpo
s
e i
s
to
simplify
the wirel
e
ss LA
N configu
r
atio
n. By the end of
2011, se
curit
y
rese
arch
er Stefan
Viehb
ock ha
d publi
s
he
d the
WPS exists secu
rity flaws in
h
i
s
blog, an
d m
a
ny manufa
c
tu
rers
have thi
s
p
r
obl
em fo
r wirele
ss dev
ice
s
. Thi
s
d
e
fect
cau
s
e
s
th
e
PIN of WPS become mo
re
likely to be found by trying each PIN Method.
Mainly thre
e
rea
s
on
s
WP
S can
be
cra
c
ked. Th
e first, PIN cod
e
is the only
req
u
irem
ent
for network e
quipme
n
t to acq
u
ire a
c
ce
ss, an
d do n
o
t need the
other
way of identifying. The
se
con
d
, WPS
PIN code
of
the Eighth
di
gits i
s
a
checksum, so the
hacke
rs only
need
sim
p
ly to
cal
c
ulate th
e
first 7 digit
s
. The third, Viehbo
ck
fo
und
whe
n
PIN aut
hentication
conne
ction fail
ed,
wirel
e
ss AP will send a message call
ed EAP-NACK
back to the client, t
he attacker
will be
able
to determi
ne
the PIN fro
n
t or b
a
ck p
a
rt
is
corr
e
c
t through th
e respon
se info
rm
ation, therefo
r
e,
the ha
ckers
need
only fin
d
a 4
digit P
I
N and
a 3
di
git PIN fro
m
the 7 di
git PIN, that is the
possibility onl
y has 1000
0 and1
000 tim
e
s [3]. In the actual cra
c
k attempt, Only a maximum o
f
test 1100
0 times, an ave
r
age of abo
ut 5500 time
s to cra
c
k WPS.
WPS encrypti
on wirele
ss n
e
twork in
trusi
on pro
c
e
s
s is as follows:
First
step i
s
t
o
scan
an
d o
b
tain the ta
rg
et AP inform
ation. The
n
i
nput the
para
meter of
reave
r
co
mm
and, beg
an t
o
exhau
stive PIN cod
e
.
When this PIN
and AP wirel
e
ss PIN co
de
is
con
s
i
s
tent to
the target d
e
vice,
WPA/PWA2 en
c
r
y
p
t
ed pa
s
s
w
o
r
d
,
com
p
let
e
cra
c
k,
t
h
e
re
sult
s
are sho
w
n in
Figure 8.
Figure 8. Obtain WPA/WP
A2 Passwo
rd
s
4. Wireless
Net
w
o
r
k Se
c
urit
y
Problems Coping Strategies
Becau
s
e th
e wirel
e
ss
com
m
unication m
ode dete
r
min
e
s a
s
long
a
s
it is in the
wirel
e
ss
netwo
rk sign
al
coverage
data comm
u
n
icatio
n withi
n
a
re
gion
a
r
e likely to
be
listeni
ng,
ste
a
l or
modify, and
the appli
c
atio
n of wi
rele
ss netwo
rk is
a se
rio
u
s th
reat. In ord
e
r to en
sure t
h
e
s
e
c
u
rity of wireless
communic
a
tion, the nec
ess
a
ry s
a
fety s
t
rategy s
hall be adopted.
4.1. Disable the DHCP Se
r
v
er [4]
When the cli
ents
access
to the
wireless ne
t
w
ork, wirel
e
ss router will autom
a
tically
assign an IP addre
s
s to the client, su
ch as t
he IP
address, su
b
n
et mask, DNS and gate
w
ay
informatio
n, this put the wirel
e
ss ro
uter be
expo
sed, therefo
r
e
,
in this way should th
ro
ugh
assign
static IP addre
s
s
to the us
er t
o
avoid this
situation. In
orde
r to imp
r
ove the net
work
se
curity p
e
rf
orma
nce, di
sable th
e wi
re
less rout
er
DH
C
P
s
e
r
v
ice to
a
v
o
i
d
the le
ak
a
g
e
o
f
th
e
related parameters
of DHCP s
e
rver net
work configu
r
ation.
4.2. Using Ph
y
s
ical Address (M
AC) Fi
ltering
Each
wi
rele
ss
client
ada
p
t
er h
a
s a
uni
que
48-bit ph
ysical
ad
dre
s
s
(MAC), in
orde
r to
achi
eve the goal that only allow legitim
a
te user
s NI
C acce
ss AP, the netwo
rk a
d
m
inistrators can
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 6, June 20
14: 4639 – 4
647
4646
set u
p
i
n
AP
MAC ad
dre
s
s filteri
ng ta
b
l
e. Its effici
en
cy will
d
e
cre
a
se
with
the
increa
se
in t
h
e
numbe
r of te
rminal. sin
c
e il
legal u
s
e
r
s th
roug
h
the n
e
twork li
stene
r
can
get valid
MAC ad
dre
ss
table, and
NIC's
MAC a
d
d
re
ss i
s
al
so
not difficult
to modify[5],so that the Il
legal u
s
e
r
s
can
misap
p
ropri
a
tion legitimate
user's MA
C , therefor
e,
MAC add
re
ss filtering is
not very effective
authenti
c
atio
n method
s.
4.3. Use Netw
o
r
k Communication
s
Encr
y
p
tion Technolog
y
Wheth
e
r the
wirel
e
ss rout
er or
wirele
ss AP,
its settings a
r
e p
r
ovid
ed wi
rele
ss e
n
cryptio
n
option
s
. Whe
n
a wirel
e
ss
netwo
rk e
n
cryption, t
he client must use
the corre
c
t password b
e
fo
re
acce
ss the
WiFi.
Wirel
e
ss n
e
two
r
k de
vices typi
call
y provide
the
en
cryption
settings
are
WEP,
WPA/WPA2 and WPA-PS
K/W
PA2-PSK several
models
, because the of
congenital defect
s of
WEP encrypt
ion method
whi
c
h exist
s
in the des
i
gn,
WEP password o
r
co
mm
unication is v
e
ry
easy to b
e
ill
egally obtai
n
ed, so
it is n
e
ce
ssar
y to
adopt a
high
er
se
curity le
vel encryptio
n to
prote
c
t the co
mmuni
cation.
4.4. Use Fire
w
a
lls, Intr
usi
on De
tec
t
ion
Sy
stems
Becau
s
e the
r
e did not set
the nece
s
sa
ry se
cu
rity p
o
licy in the p
r
ocess of bui
lding a
wirel
e
ss network,
so the users w
ill
be very unsafe in t
he course of
using the network. In order to
prote
c
t the
secu
rity of lo
cal data, it i
s
need
ed u
s
in
g the
softwa
r
e and
ha
rd
ware fi
rewalls
and
intrusi
on dete
c
tion sy
stem
s, etc, to achie
v
e the purpo
se of network i
n
trusi
on defe
n
se.
4.5. Set High
Intensit
y
Login Pass
w
o
r
d
The users m
u
st ch
ang
e the default ad
ministrato
r na
me, login pa
ssword of the
wirel
e
ss
route
r
, wirele
ss AP. Password mu
st u
s
e the
Comb
ination of up
perca
se a
nd
lowe
rcase letters
and num
be
rs,
and ch
ang
e them re
gula
r
ly.
4.6. Hide or Turn Off SSID Bro
a
dca
s
t
SSID (Service Set Identifier)
is the na
me of
a LAN. A WLAN can
be divided in
to several
sub
nets which requi
red dif
f
erent authe
n
t
ication,
so th
e comp
uters only with the same SSID can
comm
uni
cate
with
ea
ch
o
t
her, u
nauth
o
r
ize
d
users
can n
o
t a
c
cess thi
s
network. Usu
a
lly th
e
wirel
e
ss
equi
pment of th
e
same
ma
nufa
c
ture
r
ha
s a
same
o
r
simil
a
r SSID
nam
e. Ha
ckers
u
s
ed
to try all
kn
own
SSID
name
to
co
nne
ct the
n
e
twork, It i
s
po
ssi
ble to
esta
blish d
a
ta
comm
uni
cati
on lin
k, and t
h
reat to
other use
r
s in
the
WLAN.
Wirel
e
ss devi
c
e
s
n
eed to m
odify its
SSID identifies
and
re
co
mmend
ed to
clo
s
e th
e S
S
ID broad
ca
sting to
prevent illegal
u
s
ers
throug
h SSID to direct the
sea
r
ch to the target network.
4.7. Solutions for WPS Vulnerabilit
y
There i
s
not
a good
sol
u
tion to
resolve WPS
vulnerabilities at present. Most
wirel
e
ss
route
r
s
do n
o
t
limit the times of
wrong
password
inp
u
t, they are n
a
ke
d an
d ex
posed to atta
cks
by ha
ckers. I
n
orde
r to
avoid b
e
ing
attacked
from
h
a
ckers,
peopl
e ne
ed to
tim
e
ly clo
s
e
WP
S,
but most peo
ple pro
bably
don't re
alize it is serio
u
s.
Before the ne
twork pa
sswo
rd ha
s not be
en
attacked an
d
found, the sugge
stion i
s
immediat
ely d
i
sabl
e WPS
on still in u
s
e WPS wirel
e
ss
encryption eq
uipment, and
use the more se
cure
WP
A2 encryptio
n method
s, and also disa
b
l
e
Universal Plu
g
and Play function.
4.8. Timely
U
pgrade
the S
o
ft
w
a
re o
f
Equipment
W
i
r
e
less
netw
ork
devic
e
s us
ually have s
e
cu
rity configuration
option
s
, the netwo
rk
admini
s
trato
r
can
set accordin
g to thei
r own nee
ds.
Even low-e
n
d
SOHO
(Sm
a
ll Office Ho
me
Office) wi
rel
e
ss route
r
now, also provid
e
s
"softwa
r
e u
pdate" functio
n
. In order to
make wi
rele
ss
netwo
rks m
o
re
se
cure, th
e network a
d
minist
ra
tors need to
up
grad
e the
sy
stem
softwa
r
e of
netwo
rk e
qui
pment re
gula
r
ly
4.9. Using Next Ge
nera
ti
on 802.11i
Wireless Ne
t
w
orking Stand
a
rd
In order to further enhance t
he security of
wireless
networ
k
and ensure th
e compatibility
betwe
en diffe
rent ma
nufa
c
ture
rs
of wirel
e
ss se
curity tech
nolo
g
y, the IEEE802.11 wo
rki
ng g
r
o
up
developed a new safety
standards of
IEEE802.11i,
it can provide
securi
ty protection of
government
level [6]. It
compl
e
tely solves
the
security probl
ems of IEEE 802.11, T
h
e
IEEE802.11i stand
ard
to solve
the se
cu
rity
flaws
of 8
02.11, in
crea
se
s t
he t
e
ch
n
o
logy in
clud
e
s
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
Wirel
e
ss Network Ri
sk Asse
ssm
ent Mo
del and Appli
c
ation (Jia
nG
ang Tan
g
)
4647
identity authenticatio
n, integrity verification,
data encryption, key negotiatio
n
. Theoretically
spe
a
ki
ng, thi
s
p
r
oto
c
ol
ca
n solve the
secu
rity proble
m
of
wirel
e
ss network, a
n
d
appli
c
a
b
le to
all
wirel
e
ss net
work d
eploym
e
nt
5. Summar
y
Usi
ng
wireless te
chnol
ogy
to repl
ace th
e wi
red
medi
um wi
rele
ss
netwo
rk in th
e area of
netwo
rk
co
n
s
tru
c
tion a
n
d
data tran
smissi
on, wi
re
less net
work has o
b
viou
s adva
n
tage
s in
pra
c
ticality, convenie
n
ce
e
t
c,
on the oth
e
r ha
nd, se
curity threats
are al
way
s
g
o
hand i
n
ha
nd.
Authenticatio
n, encryptio
n
,
int
egrity detection an
d other related
aspe
cts of
wirel
e
ss net
work
se
curity, al
so
need
s IDS, f
i
rewall techn
o
logy, it
is a
multi-level p
r
oblem
s. We
need to
use t
h
e
techn
o
logy a
nd stan
da
rd
WiFi Allian
c
e
launc
hed to
enhan
ce th
e wirele
ss n
e
twork
se
curity
manag
eme
n
t,
in
o
r
d
e
r
to
desi
gn a wireless network with
hi
gh secu
rity.
In
th
e
u
s
e of wire
less
netwo
rk, it ne
ed the network admini
s
trator use of a
ll kinds of securi
ty technology
effectively, also
the u
s
ers nee
ds to
st
ren
g
th
en the
p
r
eve
n
tion
con
s
cio
u
sn
ess
and
a
w
arene
ss of
netwo
rk secu
rity
of their own.
Referen
ces
[1]
W
u
-
y
u
a
n
Jia
n
g
,
Z
hou-j
un Y
a
n
g
. T
he Phas
e-typ
e
Risk M
ode
l Pertur
bed
b
y
Diffusio
n
u
n
d
e
r
a T
h
resho
l
d
Divid
en
d Strateg
y
.
Acta Mathematica
e
Appl
i
c
atae Sin
i
ca (E
nglis
h Seri
es
). 201
3; 01; 216-
224.
[2]
Xi
e Ji
e-h
ua, Z
ou W
e
i, W
a
ng
De-h
ui. On th
e E
x
p
e
cted Pr
esent V
a
lu
e of
T
o
tal Divid
en
ds in
a
Ri
s
k
Mode
l
w
i
t
h
P
o
tentia
ll
y
Del
a
ye
d C
l
aims.
Co
mmu
n
ic
ations
i
n
Mathe
m
atical
Rese
arch
.
201
3; 10;
19
2-
202.
[3]
JunT
an F
ang,
Z
h
iQian
g
Xu,
Chu
n
Min Y
e
.
W
i
-F
i W
PS Securit
y
A
n
a
l
ysis.
Netinfo S
e
cur
i
ty
. 2013; 0
1
:
84-8
5
.
[4]
Z
hang
Xi
ao-mi
ng. Rese
arch
of securit
y
Str
a
teg
y
in W
i
re
le
ss Net
w
o
r
k.
Jo
urna
l of T
a
iyua
n Univ
ersity.
201
3; 14; 135-
137.
[5]
JianH
ui L
a
i.
Stud
y
o
n
the constructi
on an
d sec
u
rit
y
of
w
i
rel
e
ss net
w
o
rk.
Chin
a New
T
e
leco
mmunic
a
tions.
20
13; 1
0
; 80.
[6]
LiMin Z
h
ang. S
e
curit
y
t
e
chn
o
l
o
g
y
of
w
i
re
less
net
w
o
rk.
F
u
jia
n Co
mp
uter.
2009.
Evaluation Warning : The document was created with Spire.PDF for Python.