Cybersecurity Chapter 7: Remote Targeting Part One

Chapter 7: Phase III: Remote Targeting - Part One

• Remote targeting is the core of this phase, allowing attackers to maintain anonymity while targeting wireless systems.
• Wireless systems are ubiquitous, enabling attackers to remain anonymous.
• Initial reconnaissance involves determining if there are any relationships between target employees that would enable spearphishing.

Remote Targeting Introduction

• Identifying and targeting wireless systems is the central focus.
• Maintaining important criteria for advanced persistent threats (APTs) is achieved through targeting wireless systems.
• Wireless reconnaissance is the next step, aiming to compromise any identified wireless networks after target relationships are evaluated.
• Compromised wireless networks are exploited by targeting key vulnerabilities.
• If wireless network compromise fails, wireless client services become the target.

Remote Presence Reconnaissance

• Gathering detailed information on targeted employees and the target organization is crucial.
• This involves examining remote worker policies available through public resources.
• Locating employee home addresses using online services like Spokeo and Intelinus is a common practice
• Employee office locations and lunch locations are also valuable.

Social Spear Phishing

• Social engineering plays a critical role.
• Attacking target employee family members is a method to gather more information.
• Email accounts of family members can provide crucial information about the targeted employee.
• Compromising target employee home systems allows for pivoting to directly attack their computers.

Wireless Phases

• Wireless systems and vulnerabilities are targeted in a specific order.

• Wireless reconnaissance is prioritized.

• Compromising wireless access points is the next step.

• Wireless clients are the final target.

• Time constraints (e.g., 45 minutes in a coffee shop) must be considered.

• Wireless clients become a target even if the wireless network itself is not vulnerable.

Remote Edge Access Points

• Remote access points (APs) receive configuration from a central wireless controller at a headquarters.
• VPNs (Virtual Private Networks) are likely part of the communication system.
• This diagram illustrates the configuration.

APT Wireless Tools

• Beyond a laptop and wireless network card, various tools are necessary.

• Specific features of wireless network cards are important, including supported standards, antenna types, and connection types..

• Laptop capabilities, and power/chipset should be considered.

Wireless Technologies

• USB connection is valued because of its flexibility for positioning adapter and antenna.

• The typical PCMCIA card type for laptops is listed as a common option.

• Important wireless technologies like 802.11b/g/n, 802.11a are mentioned as critical considerations.

• Newer technologies may not use WEP (Wired Equivalent Privacy), but still often use other protocols.

Raspberry Pi Microcomputer

• Low-cost microcomputers (like the Raspberry Pi) can be used.
• These machines are suited for tasks requiring various features and tools.
• The cost is relatively inexpensive, under $150.

Wireless Antennas

• Antenna quality and the ability to use external antennas are crucial decisions for wireless cards.

• A wireless antenna improves both transmit and receive radiofrequency signals.

• The gain of an antenna is measured in dBi (decibels isotropic).

• Directional antennas (Yagi-Uda antennas) are targeted to a specific area, while omni-directional antennas transmit in all directions.

• The longer the cable connecting the antenna to the wireless radio, the more signal loss will occur.

Power

• Power, measured in dBm or watts, affects the transmission strength. Not the receiving strength.

• Power limitations and restrictions related to specific countries are different.

• A maximum output power of 30 dBm (1 watt) in some US cases is listed.

• Adding a 6-dBi-gain antenna can improve performance.

Chipset

• Choosing a card and chipset is vital to supporting specific channels and features.
• Various Linux drivers support different radio chips (e.g., PRISM, Atheros, MadWifi, Mac802.11).
• Employ commands like "iw list" to view card capabilities.
• Ideally, the driver should handle passive and monitor modes.

Wireless Reconnaissance

• Discovering network topology, clients, and remote workers is necessary
• Active reconnaissance is difficult because many activities are observable and detectable.

Internet Wireless Reconnaissance

• A preliminary stage in wireless reconnaissance should identify basic aspects like wired and wireless capabilities, guest wireless, and access points.

Active Wireless Recon

• Before identifying the most effective wireless attack, determine the best access points to target.

• Two-step process: finding access points and then specific client devices of interest.

• Understanding existence and capabilities of wireless networks is a priority.

• Beacon frames are used to periodically announce network information.

• Data rates and timing are examples of this information.

Active Wireless Recon Tools

• Kismet, Airodump, and Android apps are primary tools for active reconnaissance.
• Kismet is popular for encompassing wireless enumeration, particularly suitable for war driving.
• Airodump is useful for information gathering about networks and client devices.

Active Wireless Recon, Kali Linux

• In Kali Linux, Kismet is pre-installed and ready to use.

• Using terminal command "kismet" triggers the graphical application.

• Kismet uses a client-server model, allowing remote capture sources if necessary, but primarily utilizes local sources.

• Airodump is part of the aircrack suite and can be used for reconnaissance.

• airodump-ng -w out mon0 is a command example to start listening on interface mon0 and save to the file out.

Active Wireless Recon, Android Apps

• Using different Android apps for recon—like "wardrive" or "WiGLE Wifi Wardriving"—is recommended.
• These apps display locations of wireless access points on a map, leveraging GPS features.
• "War Driving" is used when a building and physical access is unavailable.

Explore Chapter 7 of your cybersecurity text, focusing on the critical phase of remote targeting. Learn how attackers maintain anonymity while exploiting wireless systems and the importance of reconnaissance in identifying target relationships. Dive into methodologies for compromising wireless networks and the tactics used when initial attempts fail.