Types of Wireless Attacks

Standard wireless communication occurs when the end user and the wireless access point are able to communication on a point-to-point basis without interruptions. There are many attack variations in existence against wireless networks that breaks the standard communication format. These attacks includes the denial of service attacks, the man in the middle attacks and the WEP key-cracking attack to name a few and are described below.

Denial of Service (DoS) attacks
The objective of a Denial of Service (DoS) attack is to prevent authorized users access to legitimate network resources by denying them service. A DoS occurs when the malicious attacker sends an abundant of garbage data to the wireless access point choking all other communications to legitimate users.

Man-in-the-middle attacks
A man-in-the-middle attack consists of a malicious user (hacker) inserting themselves into the data path between the client and the AP. In such a position, the malicious attacker can delete, add, or modify data. The man-in-the middle attack also enables the malicious attacker access to sensitive information about legitimate users such as username and passwords, credit card numbers and social security.

War driving
Wardriving is the mapping of wireless access points (WAP) by driving or walking through populated areas carrying wireless equipment such as a laptop or a PDA to detect active wireless access points. The tools used for this are available freely off the Internet in the form of Netstumbler and Ministumbler (http://www.netstumbler.com/). Once the malicious attacker located vulnerable wireless access points, they are able to mount attacks to other locations under the cover the compromised network.


Wired Equivalent Privacy (WEP)
The Wired Equivalent Privacy (WEP) authentication consists of each frame being encrypted as it is transmitted to the wireless access point. WEP possess many deficiencies such as the ability to be compromised within a short period of time. Hackers can fairly easily decode WEP-encrypted information after monitoring an active network for less than one day. An application such as WEPCrack (wepcrack.sourceforge.net/) is a freely available tool often used to implement such an attack.

CWSP - Certified Wireless Security Professional

The CWSP exam is an advanced level wireless LAN certification developed by Planet3 Wireless. This exam is a part of the Certified Wireless Network Program (CWNP). The exam tests your ability on how well you are able to protect your company’s valuable data from hackers. For anyone desiring a career in IT or Security this is a certification you cannot afford to be without.

The CWSP is the first nationally recognized wireless security exam offering in the United States. While this exam is has been around for several years, it is probably one of the best kept secrets. However when securing employment with major corporations in the area of wireless security, you will find that employers are looking for this certification.

One of the great fears around wireless is security. The one thing that beats fear is education. I applaud Planet3 Wireless on the job they have done in providing an exam that is both comprehensive and accurate. This vendor neutral exam really outlines the security solutions that are available today and more importantly how the solution should be utilized. The exam looks at the customer’s infrastructure and not the vendor’s product. You will find that the exam leaves no stone unturned.

Test Preparation:
The best study material to date other than real world experience is a combination of the following

1. CWSP Instructor-led Training
2. CWSP Study Guide
3. Practice Test

Ideally, your chances are better for passing the exam when you combined all three of these methods. However, money and time constraints sometimes prevent this from happening.

Exam Prerequisites:
There is only one prerequisite. Individuals attempting to take this exam must be CWNA certified. (Certified Wireless Network Administrator (CWNA) is another wireless certification through Planet3 Wireless which deals with wireless administration). While not a requirement, it is recommended that testers have their Security+ and/or SCP certification.


Exam Registration #:
PW0-200


Exam Cost:
The exam can be purchased for $175.00 USD.


Exam Format:
The CWSP exam is a 90 minute timed exam which consists of 60 scenario based questions. You are required to obtain a passing score of 70%. Should you have an interests in being an instructor, the passing score requirements are a little more stringent. A passing score of 80% is required.


Exam Content
You will find that the exam covers three basic areas; Wireless LAN Security Solutions, Wireless LAN Intrusion, and Wireless LAN Security Policies. The exam goes into deeper detail by highlighting the topic below:

* Wireless Security Principles
* Intrusion Techniques
* How Networks are Compromised
* Intrusion Detection Systems
* Layer 2 Wireless VPNs
* SOHO/SMB 802.1X/EAP Security
* Enterprise Wireless Gateways
* Secure Wireless Bridging
* Wireless LAN Switching
* Wireless VLANs and EAP Types
* Secure Wireless LAN Management
* Wireless VPN Routers


Exam Location:
The exam is nationally recognized and can be taken through any Authorized Thompson Prometric Testing Center. For locations in your area, check out http://www.2test.com.

I highly recommend anyone who is going into the field of security wired or wireless to take this exam.