Hacking Wifi

Josua M Sinambela
Unit Sistem & Teknologi Informasi
Teknik Elektro UGM
josh at gadjahmada edu
http://joshstaffugma!id

Pembahasan
Wifi Today
Standard Keamanan Wireless (Wifi)
No ESSID ?
MA !ilterin" ?
ra#$in" WEP % WPA
&ots'ot ( a'ti)e Portal
Miss #onfi"*ration +arin"an Wifi
,o"*e AP
Denial of Ser)i#e
Kesim'*lan

Wifi Today
-arin"an di Kam'*s % Per$antoran (b(")
Antar ISP (a(b(")
Warnet.ISP (b(")
&ots'ot di &otel.hotel/ ,T(,W.net/
S0alayan/ S*'ermar$et/ offeeSho'
(b(")
A'arat Pemerintahan/ Ke'olisian dan
Militer (a(b(")

Standard Keamanan Wireless
(Wifi)
WEP
Al"oritma ,1 yan" lemah
,23 *nt*$ inte"ritas
K*n#i bersifat stati$
4m*mnya AP(ard(Dri)er s*''ort WEP
WPA (sol*si sementara 'en""anti WEP)
PSK 5 Al"oritma ,1 6 Tem'oral Key (TKIP)
,ADI4S 5 ,1 6 Tem'oral Key (TKIP) 6 7839:; 6
better I< (MI)
4m*mnya AP(ard s*dah mend*$*n"/ b*t*h *'"rade
a''li$asi/ dri)er ata* firm0are
WPA3 (,SN 7839::i)
Al"oritma en$ri'si AES dan TKIP
=*t*h hard0are bar* (hard0are $el*aran 3882.$ini)

7839blabla

No ESSID ?
Menyemb*nyi$an ESSID (hidden SSID)
> Tida$ menyerta$an ESSID 'ada bea#on
> Saat dea*th/ SSID 'asti a$an di broad#ast
ESSID yan" disemb*nyi$an da'at
den"an m*dah di#loa$ed (dib*$a)
Tools ?in*@5 air#ra#$/ air+a#$ % $ismet
Tools 0indo0s 5 airma"net/ airsnort
Demo

MA !ilterin" ?
!asilitas MA !ilterin" *m*mnya s*dah
disedia$an<endor A##ess Point(,o*ter
4seless/ $arena MA address san"at
m*dah di"anti ata* ditir* (s'oof)9
Tida$ ada istilah $onfli$ MA address
'ada Wifi
Demo

ra#$in" WEP % WPA
ra#$in" WEP
> Men"*m'*l$an I< yan" lemah sebanya$
m*n"$in (!MS atta#$ 5 Key S#hed*lin"
Al"orithm)9 San"at ber"ant*n" 'ada +*mlah
I< lemah yan" ditem*$an9
> Men"*m'*l$an I< yan" *niA*e (#ho''in"
atta#$)
> Mem'er#e'at 'roses 'en"*m'*lan I<
den"an men""*na$an trafi$ In+e#tion9

ra#$in" WEP % WPA
ra#$in" WPA (PSK)
> WPA da'at diseran" den"an men""*na$an
di#tionary ata* br*tefor#e atta#$9
> Men""*na$an $am*s $ata
> Da'at dila$*$an se#ara offline
Tools 5 Air#ra#$/ WEPlab/ Airsnort

&ots'ot ( a'ti)e Portal
&ots'ot *m*mnya diban"*n den"an
a'ti)e Portal
Btenti$asi berdasar *ser('ass0ord
Identifi$asi setelah menda'at otenti$asi/
men""*na$an MA dan IP Address
> MA dan IP da'at di s'oof
Trafi$ masih Plain Te@t
> Kom*ni$asi setelah otenti$asi da'at
disada'
Demo

Miss #onfi"*ration +arin"an Wifi
<endor *m*mnya menyedia$an defa*lt
$onfi"*rasi
> 4ser('ass0ord
> IP address
> SNMP enable/ 'ri)ate % '*bli# a##ess
> No En#ry'tion
Te$nisi(Admin +*st 'l*" n 'lay
Kesalahan $onfi"*rasi 'ada desi"n
&ots'ot(a'ti)e 'ortal
Kesalahan settin" fire0all

,o"*e AP
AP yan" ter'asan" se#ara ile"al 'ada area
tertent*
Di"*na$an oleh &a#$er *nt*$ men+eba$
tar"etnya9
> Men""*na$an ESSID yan" sama den"an AP real9
> Menda'at$an *ser('ass0ord 'ada hots'ot
> Membelo$$an $om*ni$asi data yan" ter+adi/
sehin""a mem*n"$in$an dila$*$an seran"an
MITM (Man In the Middle )
4m*mnya men""*na$an &ost AP (AP yan"
diban"*n men""*na$an Kart* Wireless lient)

Denial of Ser)i#es
Wireless san"at rentan den"an DoS
Interferen#e % -ammin"
Dea*th broad#ast
Tools 5 )oid::/ air+a#$/ air#ra#$

Kesim'*lan
Canti settin" defa*lt AP
> SSID/ IP Address/ ,emote Mana"eable/
4ser(Pass0ord
C*na$an $ombinasi bebera'a fit*r $eamanan
0ireless (tida$ men""*na$an sat* fit*r sa+a
> MA !ilterin"/ Disable ESSID/
> En$ri'si minim*m men""*na$an WPA(PSK)9
=atasi Transmit Po0er 'ada AP
The best sol*tion today 5 WPA3(,SN 7839::i
den"an m*t*alisme otenti$asi
Kone$si 0ireless tida$ reliable DD

P*sta$a
S9 !l*hrer:/ I9 Mantin3/ % A9 ShamirA*"/ 388:
htt'5((0009driEEle9#om(FGEaboba(IEEE(r#1H$sa'ro#9'df
htt'5((0009isaa#9#s9ber$eley9ed*(isaa#(0e'.faA9html
,obert Mos$o0itE De#ember :/ 3882
htt'5((0009i#salabs9#om(html(#omm*nities(W?AN(0'HssidHhidin"9'df
Ceor"e B*-*ne 3/ 388I htt'5((blo"s9Ednet9#om(B*(?'JKG
edri# =lan#her -*ne/ 388I
htt'5((sid9rsta#$9or"('res(8I8KH,e#onHWirelessIn+e#tion9'df
-o*ni Malinen/ &ost AP dri)er for Intersil Prism2/2.5/3/ hosta'd/ and
WPA S*''li#ant htt'5((hosta'9e'itest9fi(
htt'5((0009air#ra#$.n"9or"(
htt'5((0009$ismet0ireless9net(
htt'5((00090lse#9net()oid::(
htt'5((airsnort9shmoo9#om(
htt'5((so*r#efor"e9net('ro+e#ts(#o0'atty
htt'5((0009bla#$al#hemy9to('ro+e#t(fa$ea'(