3

I understand that there are many applications such as Snort that do the job for network layer 3 IDS.

From what I have researched, layer 2 wireless IDS seems like a field that is very slow in development? Snort-wireless and Openwids-ng seem like dead projects.

The most up-to-date and stable opensource software for WIDS that I can see is Kismet. But I still feels like it's not as good as it should be.

Questions: (Assuming that my previous statements are true)

  1. What are the causes that make wireless IDS to be under slow development generally? Is it a technological factor?

  2. What are possible attacks that wireless IDS these days can detect and prevent?

  3. If I'd like to develop a hobby project on an IDS, is it possible to still contribute to wireless layer 2 IDS development? How difficult is this going to be?

  4. Are there any other decent Wireless IDSs in the market/opensource communities?

Thank you.

|improve this question
  • 6
    Keep in mind that the barrier to entry for development for layer 3 is just having a network card and some software, whereas layer 2 for WiFi requires practically raw access to the 802.11 frames, which means specialised hardware and (usually) special SDR / RF sniffer gear. It's also a significantly younger technology compared to most layer 3 tech, and WiFi is still fast-evolving. – Polynomial Mar 16 '13 at 13:49
  • There are commercial layer 3 IDS's, but I honestly don't have much faith in them. Aruba's AP controller will have a rogue AP detector, as Cisco's does as well IIRC. There was a time where IPS was built in, but that violates FCC code on signal blocking. – g3k Mar 18 '13 at 14:01
  • i read cisco mse is PCI DSS compliant don't know if FCC is a problem. – Saladin Mar 18 '13 at 18:44
  • for your information spectrum intelligence works on physical layer at all RF ranges cisco include SI as a service in its attack mitigation and correlation and comes integerated with cisco ips. – Saladin Mar 18 '13 at 18:51
  • What has PCI DSS got to do with anything? – Polynomial Mar 18 '13 at 23:47
4

I'll answer this as best I can, since some of it is subjective or subject to change.

As I mentioned in a comment, the barrier to entry in terms of development is higher for layer 2 than it is layer 3, and cables are easier to interface with than radio waves. Most wireless technology involves firmware on a hardware device in order to translate the RF signals into data packets that can be interpreted by software drivers. In order to manage the full spectrum of wifi attacks, you need to be able to handle the full spectrum of communications.

This means that you probably need:

  • Some experience with 802.11 protocols, including the crypto side of things.
  • A wifi dongle that supports full promiscuous mode.
  • A wifi AP running an open framework such as DD-WRT.
  • A way to access the raw wireless frames (not just Ethernet frames) on the system. This means you'll probably need to have some kind of specialised wifi driver.
  • A way to test your code with corrupt signals and other tricks at the RF layer, which probably means you need an SDR that can handle 2.4GHz.

In general, right now the primary attacks that wifi IDS/IPS systems are looking at are based around detection and prevention of password cracking on the AP, but also detection of various deauth attacks. The biggest problem, though, is that most interesting wifi attacks are targeting clients rather than the AP. This means that building an IPS is near impossible, since you can't get inline with radio waves; the best you can do is detect that an attack is happening.

|improve this answer
  • Thank you for your answer. At the moment. I'm running OpenWrt on a router. I have installed kismet_drone on it. It's like this: drone captures 802.11 frames ----> linux server running kismet server and client ----> pass the captured packets to wireshark/snort ----> pcap files can be saved. The thing is I'd like to contribute building an IPS program to analyze and react to these captured 802.11 pcap packets. Is this possible with Python(or any recommended language)? Which library would you recommend? Thank you. – nixor01 Mar 19 '13 at 20:08
  • Also how do you think about using Genetic Algorithm approach to detect patterns? For the previous comment, I write roughly how it works on my blog here if you'd be so kind to check it out, thanks! nixorids.blogspot.com/2013/03/… – nixor01 Mar 19 '13 at 20:14
1

Interesting discussion about the wireless infrastructure. The best way (and also one of the question you posted) is how the vendors such as cisco and others are doing to provide features that addresses some of the problems you listed with wireless technology. I'm hoping that by knowing and understanding the BIG vendors prescriptive you can perhaps revise your current assumptions about the actual attacks and problems faced in regard to WIDS. Following is my analysis:-

BACKGROUND & LIMITATIONS

(citations excerpted from a Cisco whitepaper)

  1. Current IDS/IPS systems cannot detect access points running with proprietary extensions such as Super G (from Atheros). These readily available devices go undetected. Additionally, it’s possible for a hacker to take standard Wi-Fi equipment (for example, running Linux) and modify it to operate on nonstandard channels or with other nonstandard modulation schemes. These extended or modified devices can be detected only if you analyze the RF physical layer. As Beyond Wi-Fi devices, many other types of non-Wi-Fi equipment - including Bluetooth access points, access points running older standards such as 802.11FH, and proprietary wireless bridges - can also be used to open up holes in the network
  2. They do not detect RF layer DoS attacks that can be implemented through jammer devices or Wi-Fi devices that have been set in a diagnostic jamming mode.
  3. At a fundamental level, a standard Wi-Fi chipset has limited ability to implement Spectrum Intelligence. The reason is that Wi-Fi chipsets are specifically designed to receive Wi-Fi signals only - they do not recognize other types of signals. Standard chipsets are not even designed to pass up enough information for SI to occur at higher levels of software. And there is no ability for software to access the actual data received from the burst for further analysis

SOLUTION

Cisco has created an integrated solution with patented chips and software that has been specifically designed to analyze and classify all RF activity. Cisco Spectrum Analysis Engine (SAgE) hardware core, which has been integrated directly into Wi-Fi chipset.

TECHNOLOGY OFFERED

Spectrum intelligence (SI) is data about RF spectrum activity derived from advanced interference identification algorithms similar to those used in the military.For every device operating in the unlicensed band, SI reveals : What is it? Where is it? How is it impacting the Wi-Fi network? Cisco has taken the bold step of integrating SI directly into the chipset of new access points.

Using clean-pipe & MSE (mobility security engine) coupled provides physical location of wireless interferes, context aware software,rogue device, wire devices.

The security services it provides the following advantages:-

  1. Location,correlation,history / with forensic context based for clean spectrum intelligence
  2. Context-aware software for locating wireless devices.
  3. Adaptive ips Full range of 802.11 attacks and threats against network rogue access points and clients , network recognizance , eavesdropping , authentication and encryption cracking , MITM , Wireless dos, day 0 attacks.

EXAMPLE of AIPS

Network Reconnaissance and Profiling Detection Analyzes traffic behavior and performs pattern matching to detect tools and techniques such as Netstumbler, Wellenreiter, Kismet, honeypot access points, and other methods, providing an early alert that a hacker is looking for avenues of attack

Authentication and Encryption Cracking Detection Analyzes traffic behavior and performs pattern matching to detect tools and techniques such as AirSnarf, AirCrack, ASLEAP, Chop-Chop, and other methods, providing an alert of potential or attempted data theft

|improve this answer
  • 2
    That's a lot of quotes of buzzwords and marketspeak. The rest is barely grammatical English. How about providing some useful, original content? – Gilles 'SO- stop being evil' Mar 18 '13 at 23:38
  • all the content is hyperlinked. You can go read this if you want. Its english from what i was able to take from OP post he wanted commercial reference. Its not buzzwords its 25 patents for this technology? Thanks:-) – Saladin Mar 19 '13 at 4:20
  • It isn't enough to link to the text you copied, you must also make it clear that you copied from it (as I did, by using quote markup and stating the origin of the quoted material). – Gilles 'SO- stop being evil' Mar 19 '13 at 12:57
  • thank you gilles but i always hyperlink thinking the OP would understand it better in that way. I will follow your style in future? ok – Saladin Mar 19 '13 at 13:27
  • Thank you for your answer, I think general points of view from vendors can be foods for thought as well. – nixor01 Mar 19 '13 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.