Systems and methods for wireless vulnerability analysis

• US 7,577,424 B2
• Filed: 12/19/2005
• Issued: 08/18/2009
• Est. Priority Date: 12/19/2005
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Inventors: Sinha, Amit, Darrow, Nicholas John
• Primary Examiner(s): Corsaro; Nick
• Assistant Examiner(s): BROOKS, SHANNON
• Application Number:
  US11/312,042
• Publication Number:
  US 20070142030A1
• Time in Patent Office: 1,338 Days
• Field of Search: 455/410, 455/423, 455/67.14, 726/25, 379/189
• US Class Current: 455/410
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Security vulnerability assessment for wireless networks is provided. Systems and methods for security vulnerability assessment simulate an attack upon the wireless network, capture the response from the wireless network, and identify a vulnerability associated with the wireless network after analyzing the response from the wireless network.

Claims

1. A system for identifying security vulnerabilities in a wireless network, the system comprising:

a system data store configured to store a plurality of wireless attack patterns, network default data associated with the wireless network, and responses received from the wireless network in response to simulated wireless attacks using one or more of the plurality of wireless attack patterns;

a wireless radio in communication with the system data store; and

a control engine comprising one or more processing elements, wherein the control engine is in communication with the system data store and the wireless radio, and wherein the control engine is configured to perform the steps comprising of;

performing a sequence of wireless tracks comprising the simulated wireless attacks on the wireless network by communicating with at least one wireless device on the wireless network, wherein each wireless track of the sequence of wireless tracks comprises one of a wireless transmit track and a wireless receive track, and wherein each wireless track of the sequence of wireless tracks is performed responsive to previous wireless tracks in the sequence and with assimilated wireless frame parameters from previous wireless receive tracks;

receiving a response to the simulated wireless attack from the wireless network;

analyzing the response of the wireless network to the simulated wireless attacks to identify a vulnerability of the wireless network; and

determining which of the wireless attacks is most probable to occur based on the analyzed vulnerability, such that steps may be taken to mitigate the analyzed vulnerability.

2. The system of claim 1, wherein the control engine is further configured to perform the step of providing a report of the security vulnerabilities in the wireless network.

3. The system of claim 1, wherein the control engine is further configured to perform the step of obtaining network default data from the wireless network and a wired network coupled to the wireless network, wherein the network default data comprises operating system version, installed applications, patch levels, wireless network configuration, and authorized devices.

4. The system of claim 1, wherein the control engine is further configured to perform the step of updating the system data store with the responses received from the wireless network in response to the simulated wireless attack.

5. The system of claim 1, wherein the plurality of wireless attack patterns used for the simulated attacks comprise at least one of:

a reconnaissance attack comprising a wireless device gathering network information from the wireless network;

a sniffing attack comprising gathering data transmitted on the wireless network;

an injection attack comprising injection of data on the wireless network configured to generate excess traffic on the wireless network;

a denial-of-service attack configured to prevent the operation of the wireless network; and

combinations thereof.

6. The system of claim 5, wherein the plurality of wireless attack patterns comprise a custom attack pattern.

7. The system of claim 1, wherein the system comprises means to update the system data store with a custom attack pattern.

8. The system of claim 1, wherein each of the wireless tracks of the sequence of wireless tracks comprises a timeout value which passes control to a next wireless track in the sequence if nothing happens.

9. The system of claim 8, wherein a wireless receive track comprises the steps of:

receiving data from at least one wireless radio on the wireless network;

analyzing a wireless frame header from the received data;

matching the wireless frame header to conditions;

storing the data in the system data store if the conditions are satisfied; and

determining a next wireless track responsive to the matching step.

10. The system of claim 9, wherein the step of matching the wireless frame header to conditions comprises matching at least one of frame type, channel ID, transmission rate, frame count, frame delay, frame ID, source MAC address, destination MAC address, BSSID MAC address, source/destination/BSSID MAC address, SSID, and timeout value.

11. The system of claim 8, wherein a wireless transmit track comprises the steps of:

determining a frame type to transmit, wherein the frame type comprises one of a raw frame and a template frame derived from the assimilated frame parameters; and

transmitting the frame type configured to generate a response from the wireless network.

12. The system of claim 11, wherein the template frame is determined based on the responses of the wireless network.

13. The system of claim 8, wherein a wireless transmit track comprises the step of transmitting raw generated data configured to generate a response from the wireless network.

14. The system of claim 1, wherein the wireless device comprises at least one of a wireless Access Point (AP) and a wireless client card;

and wherein the control engine is further configured to perform the steps comprising of;

adjusting wireless settings responsive to the analyzed vulnerability.

15. The system of claim 1, wherein the system data store and the control engine comprise software embodied in system-readable storage.

16. The system of claim 15, wherein the software is configured to operate on a single computer comprising a wireless client card.

17. The system of claim 15, wherein the software is configured to operate on a distributed computer system and network.

18. The system of claim 17, wherein the distributed computer system comprise more than one of a server, a client, a laptop, a workstation, and an appliance.

19. The system of claim 18, wherein the network comprises a plurality of wireless devices and a plurality of wired devices.

20. A method for identifying security vulnerabilities in a wireless network, the method comprising the steps of:

initiating a simulated attack comprising a sequence of wireless tracks on the wireless network based upon stored wireless attack patterns, wherein each wireless track of the sequence of wireless tracks comprises one of a wireless transmit track and a wireless receive track, and wherein each wireless track of the sequence of wireless tracks is performed responsive to previous wireless tracks in the sequence and with assimilated wireless frame parameters from previous wireless receive tracks;

scanning a plurality of wireless devices coupled to the wireless network for responses from the plurality of wireless devices;

analyzing the responses of the wireless devices to the simulated attack;

identifying a security vulnerability based upon the analysis; and

adapting the wireless devices to mitigate the security vulnerability based upon the responses, wherein the adapting step comprises adjusting wireless settings of the wireless devices.

21. The method of claim 20, further comprising the step of providing a report of the security vulnerabilities in the wireless network to a system administrator.

22. The method of claim 20, further comprising the step of obtaining network default data from the wireless network and a wired network coupled to the wireless network, wherein the network default data comprises operating system version, installed applications, patch levels, wireless network configuration, and authorized devices.

23. The method of claim 20, further comprising the step of updating the simulated attack based on the responses of the wireless devices.

24. Computer readable media comprising instructions that upon execution by a processor cause the processor to perform the method of claim 20.

25. The method of claim 20, wherein the simulated attack is initiated automatically.

26. The method of claim 20, wherein the simulated attack is initiated manually.