Are you HIPPA / PCI Compliant?

 

Cyber-security is becoming a serious concern for small-business owners who maintain electronic medical records and/or customer payment information.

An area where a small business owners can become vulnerable is with regard to their 802.11 WiFi.

And so I decided to investigate.

The first thing I did was to research tools for wireless cracking. I started out by reading a couple books. The first book I read was entitled Cryptography: A Short Introduction by Fred Piper & Sean Murphy (in order to get a good refresher on the principles of cryptography). I also read Wireless Hacking Exposed by Johnny Cache. These two books gave me enough of the “basics” to point me in the right direction for Internet-resources on required software and hardware.

Next, I decided what kind of wireless network I wanted to crack. There are several authentication / encryption methods deployed in wireless networks today such as WEP, WPA/WPA2 Pre-Shared Key, WPA2 Dynamic-Shared Key, and WPA2 Enterprise (802.1x). Everybody says WEP is easy to crack so I thought I would start with that. However, I discovered that while the actual encryption key is in fact easier to crack than WPA/WPA2, the preparation is a little more involved – the amount of captured traffic to perform the brute-force attack (20K-90K packets) on the WEP key is dramatically more than that of WPA/WPA2. So in the interest of time and also because WPA2 it is more common, I decided to crack WPA/WPA2 Pre-Shared Key.

Next, I had to acquire the necessary hardware and software. Because of the number of variables, this task alone consumes hours upon hours of time (in total I probably had to invest 40 hours of time). There are many other blog posts written about this and so I won’t re-iterate what has already been written. With regard to software, I decided to use Kali Linux and aircrack-ng.

Next, I set up a lab environment. I wanted to setup a lab that would be as close to real world as possible (I even “Googled” most popular WiFi passwords of 2013). And so I decided to use the Verizon Actiontec router that is supplied with almost every FIOS installation out there. I setup the router for 802.11G, WPA2 Pre-Shared Key…

Next, I associated my test laptop with this new wireless SSID…

I also decided to start a continuous ping to the Verizon wireless router on my test laptop. I then started up my cracking hardware / software and began the attack. I noticed on my test laptop packet-loss during the aircrack-ng deauth phase of the attack…

Afterwards I took a look at the resulting PCAP file in Wireshark to verify the WPA2 4-Way authentication handshake between my test laptop and wireless router.

Capturing the traffic is one thing. Once you have successfully captured the authentication between the wireless client and router, you now have to have a way to try every possible password until you find a match. Modern CPU’s generally process about 100K passwords per second. With the gazillion possibilities this makes normal CPU’s a poor choice for discovering a password.

That is why modern systems replace CPUs with Graphical Processing Units (GPU) that are scaled together for distributed compute power when brute-force cracking passwords. This allows us to compress years of compute time into minutes or hours or days. Thankfully, we can rent compute power today such as Amazon’s Web Services (AWS) or we can use a cloud-based service. I decided to use a cloud-based service and logged into www.cloudcracker.com and uploaded my PCAP file for their analysis. They charge me a $17 fee but it is way worth it.

So once I paid the fee they sent me an e-mail confirmation…

… and then another e-mail confirmation when they get started…

… and then another e-mail after they’ve cracked the password for you…

So basically the brute-force part of this attack took about 108 seconds to crack the most popular wireless password used in 2013.

IP Flow to the Rescue

 

So a retail store calls today complaining of slow network connections.

So I change a few routes in the stores local router to give them a faster pipe (I was initially thinking that poor local broadband service was the root cause).

They called back complaining again.

So I poke around a little…

show processes cpu (no problemo)

show int | i mfr1.100 | drop | runt | err | fail | coll | carr (no problemo)

So I ping across the WAN <-> WAN and there is in fact high-latency right on the WAN interface of the stores router.

Time to pull out Netflow…

(config)# ip cef
(config-if)# ip flow ingress
(config-if)# ip route-cache
(config)# ip flow-top-talkers
(config-flow-top-talkers)# top 20
(config-flow-top-talkers)# sort-by bytes
(config-flow-top-talkers)# match input-interface <int>

# show ip flow top-talkers (identify source-IP)

Oh ya… we got issues.

Turns out one PC was saturating the WAN with an unusually high amount of traffic to a variety of public IPs. Coincidence I ask?!? I think not!!!

So I ping the PC, acquire the MAC, ssh into the switching infrastructure, narrow down the port the MAC is being learned on, and shutdown the port.

Bingo! All network performance goes back to normal.

Need to scan this machine for malware.

Cisco SSL (AnyConnect) Certificate Installation

 

If you need to deploy Cisco’s AnyConnect VPN client to a larger number of users, the success of rolling it out goes dramatically smoother if you first install a public SSL certificate from a Certificate Authority (Digicert, Godaddy, etc.). The advantage of this this is… A) the AnyConnect client automatically downloads / installs without any user intervention and B) the end-user does not have to constantly click “Continue” at the variety of pop-ups and prompts warning the user of untrusted SSL connectivity.

For around $30 per year, GoDaddy will issue public identity certificates for you Cisco ASA Firewall / VPN appliance and so the procedure below shows how to do this with GoDaddy…

The procedure below assumes 1) you have CLI access to your ASA appliance and 2) you have already configured / verified AnyConnect operation on your Firewall.

STEP#0: Make preparations.

- Create an “A” or “CNAME” record in your public DNS zone to make it easier for your end users to open their web-browser and navigate to the Firewall. This is also important for CA signing of your identity certificate (the FQDN needs to match the public DNS record for trust purposes). I recommend an easy name like “VPN.YOURCOMPANYDNS.COM”

- Make sure you set the ASA’s domain-name to match the public DNS domain (if it is set to something like “yourcompany.local”, change it to “yourcompany.com”

(config)# domain-name yourcompany.com <enter>

- I recommend also setting the Firewall’s hostname to match the public hostname

(config)# hostname vpn <enter>

STEP#1: Obtain a CA/root cert before requesting an identity (ID) cert from the CA.

- Navigate to https://certs.godaddy.com/repository, click on “GoDaddy Certificate Chain, and download a compatible (I used the last link). This will download a file entitled  “gd_bundle-g2-g1.crt”

- The Cisco ASA only supports a Base64 format so you must convert the format of this certificate before it can be pasted into the ASA CLI. You can convert the CA’s root certificate in Windows by right-clicking on the cert file and opening in Windows Crypto Shell Extensions…

- Next, click on the “Details” tab… then click “Copy to File”…

- Next, select “Base-64 encoded X.509 (.CER)” and save the file calling it something like “godaddy-root-cert.cer”.

- Now it’s time to create a Trustpoint and install this Godaddy root certificate (NOTE: THESE COMMANDS ASSUME YOU ARE IN GLOBAL CONFIGURATION MODE).

crypto ca trustpoint TP_1
enrollment terminal
crypto ca authenticate TP_1
-- COPY / PASTE THE CONTEXT OF “godaddy-root-cert.cer” --
quit
do you accept? yes

STEP#2: Generate New RSA Kepair

crypto key generate rsa label <godaddy.key> modulas 2048

STEP#3: Request a singing request certificate to send the the CA (which they will use to generate a publicly signed identity certificate for you to important).

crypto ca trustpoint TP_1
keypair <godaddy.key>
id-usage ssl-ipsec
no fqdn
subject-name CN=<VPN.YOURCOMPANY.COM>
crypto ca enroll TP_1
include device s/n in name yes
display request cert yes

- Next, save the encrypted context of what you see in the CLI (including “-----BEGIN CERTIFICATE REQUEST-----“ and “-----END CERTIFICATE REQUEST-----“) into a TXT file on your computer (I recommend naming it “GODADDY-SIGNING-REQUEST.txt”)

- Next, login in to your GoDaddy web-portal, navigate to the appropriate location, and upload and/or paste the encrypted contents where appropriate.

STEP#4: Receive / Import the public identification certificate. After a very short period of time (less than 5 minutes usually), you will receive (or have available in the web-portal the identification certificate.

- Download the public identity certificate (i.e., “2b1f2bbaaae955.crt”).

- As in Step#1, the ASA only supports a base64 format you you must convert the public identity certificate into “Base-64 encoded X.509 (.CER)” and save the file calling it something like “godaddy-identity-cert.cer”.

- Next, re-enter the Trustpoint and import the public identity certificate…

crypto ca trustpoint TP_1
crypto ca import TP_1 certificate
-- COPY / PASTE THE CONTEXT OF “godaddy-identity-cert.cer” --
quit

STEP#5: Once you have successfully installed the CA’s publically signed identity certificate, you must apply the associate Trustpoint to the WAN interface.

ssl trust-point TP_1 <outside>

STEP#6: Last, from an outside web-browser connection, navigate to the Firewall and verify the web-browser does not prompt you with a certificate security warning.

HTTPS://VPN.YOURCOMPANY.COM

Cisco AnyConnect VPN

 

A lot of folks are still using the old IPSEC-based Cisco VPN Client…

But Cisco has dropped support for this VPN software client in favor of the new SSL / DTLS VPN software called “Cisco AnyConnect Secure Mobility Client”.

It takes a little bit to program the firewall to get this new client to work right. I’m amazed at how expensive Cisco Press books like Cisco ASA, All-in-One Firewall, IPS, and VPN Adaptive Security Appliance, Third Edition don’t even get it exactly right.

Today I set this up with LDAP (Windows AD) integration so as to minimize the requirement for end-users to maintain two separate sets of passwords.

What are the benefits of this new client?

A) The old Cisco VPN Client is obsolete and required a registry hack to make it work on Win8 (and even then sometimes it's buggy). For new versions of Windows currently in development, the old Cisco client will not work at all.

B) Deployment of the software client does not require manual distribution (it's automatically downloaded from the Firewall).

C) For customers that have Windows AD you can integrate the Firewall with AD / LDAP and they we don't need to maintain two sets of passwords anymore (of course this could also be done with IPSEC VPN Client).

D) There is a free iPAD app / VPN client in the iTunes app store.

WiFi Packet Capturing

 

Just got my new Wireshark compatible AirPcap adapter by Riverbed…

With a simple Wireshark capture filter and adding columns for Channel, Channel Type, Speed, and SNR I was able to walk around the office and identify AP locations (11) AP’s scattered abroad…