FIELD OF THE INVENTION

The present invention relates to Wi-Fi network security.

BACKGROUND OF THE INVENTION

In today's world people regularly log on to Wi-Fi networks—in hotels, restaurants, airports, shopping malls, coffee shops, and many other places, in order to access their e-mail, web sites, Internet applications, remote data, and for other needs. People connect to public Wi-Fi networks, which may be password-protected or unprotected, and to private Wi-Fi networks, which may be password-protected or unprotected.

Reference is made toFIG. 1, which is a prior art diagram of a Wi-Fi Network100. A Wi-Fi network is a wireless network that is based on the IEEE 802.11 standard for wireless networks. The IEEE 802.11 standard includes a series of technological advances, each defined by an amendment to the standard that is identified by a one or two-character suffice to “802.11”; e.g., 802.11a, 802.11b. The Wi-Fi network shown inFIG. 1includes laptop computers110, smartphones120, tablet computers130, Internet of Things (IoT) devices140, and W-Fi access points150. Also shown inFIG. 1is an attacker200, whose actions are described below.

The 802.11 security is based on standard protocols including inter alia Wire Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access II (WPA2), as well as new protocols upcoming and yet to be developed. These protocols enable establishing encrypted communication between all W-Fi network nodes, stations and access points.

The 802.11 standard includes control frames, management frames and data frames. Control frames facilitate exchange of data frames between stations. Management frames, generally not authenticated, enable establishing, maintaining or discontinuing communication. Data frames generally include data and statuses.

Examples of 802.11 management frames include inter alia:ActionAuthenticationAssociationBeaconDe-authenticationDisassociationProbeReassociation.
Management frames enable a station to communicate with an access point, and vice versa enable association and establishment/management of an encrypted communication channel between them. Once a communication is established, data is exchanged in an encrypted form as agreed to by the two sides during an authentication phase.

A Wi-Fi network attack is a cyber-attack within the vicinity of a Wi-Fi network, that uses the 802.11 protocol and frames to attack stations and access points within the Wi-Fi network. A first type of Wi-Fi network attack is a Rogue Access Point (RAP) attack. In a RAP attack, an attacker uses De-authentication frames to force a victim station to disconnect from a current access point and to reconnect to a RAP established by the attacker, from which the victim's data is decrypted and stolen.

Reference is made toFIG. 2, which is a prior art diagram of hijacking a Wi-Fi network by an attacker. As shown inFIG. 2, the hijacking is carried out in five steps. At a first step, an attacker's station acts as an SSID 1 access point. At a second step, attacker200generates a Disassociation frame, in response to which smartphone120disconnects from its legitimate access point150. At a third step, smartphone120stops communicating with access point150. At a fourth step, attacker200generates a Re-associate frame, in response to which smartphone120connects to attacker200access point. At a fifth step, attacker200access point goes to the Internet via a regular access point, and all of the victim's data is fully exposed to attacker200.

A second type of Wi-Fi network attack is a password attack. In a password attack, attacker200first sniffs a WPA 4-way handshake; namely, the frames that are sent back and forth during an authentication phase, in order to mount a brute-force or dictionary-based WPA password cracking attack on a Wi-Fi user with WPA or WPA2 enabled. A user is elicited to provide the 4-way handshake information by first forcing the user offline with a De-authentication attack. In a similar phishing-style attack without password cracking, Wifiphisher, a known attacker's tool that can be downloaded from the Internet, starts with a De-authentication attack to disconnect the user from his legitimate access point, and then mounts a man-in-the-middle attack to collect passwords supplied by an unwitting user.

A third type of Wi-Fi network attack is a Key Reinstallation Attack (KRACK). A KRACK attack is a severe Wi-Fi attack that requires a great deal of time and effort to prevent smartphones and computing devices from being exposed to the attack. A KRACK attack, published in October 2017, may be the worst Wi-Fi attack in the world. In a KRACK attack, an attacker repeatedly resets the “nonce” transmitted in the third frame of the WPA2 handshake, to gradually match encrypted packets seen earlier, and learn the full keychain used to encrypt the traffic. As such, all traffic to and from a victim's smartphone120or other computing device is fully exposed to the attacker, while the victim believes he is protected within an encrypted Wi-Fi environment. Since a cure to this attack requires updating all Wi-Fi interfaces, devices and routers in the world, the KRACK attack will likely remain available to hackers for years to come.

A fourth type of Wi-Fi network attack is a sniffing attack. In a sniffing attack, attacker200sniffs data of every user station of a Wi-Fi network. If the Wi-Fi network is encrypted, attacker200obtains a connection password from a Wi-Fi owner.

A fifth type of attack is an Evil Twin attack. In an Evil Twin attack attacker200sets up a station that publishes itself as an access point. The attacker's access point name may be similar to the SSID name of an existing access point, diverting other Wi-Fi stations to connect to it, instead of to the existing SSID, or simply luring Wi Fi stations to connect and gain a free Internet connection. In an Evil Twin attack attacker200spoofs the MAC address of the original access point. A common way to allow Wi-Fi stations to connect to a public access point is by publishing a “splash screen”. This is the case, for example, when a guest connects to a hotel Wi-Fi network and a splash screen, which is an HTML page sent from a local access point, requests the room number and family name of the user. In other cases, such as an airport Wi-Fi network, the splash screen asks a user to approve an end user license agreement. In such cases the user station is not yet connected to the Internet and therefore it cannot use a virtual private network (VPN) service, since it has no access to the VPN server via the Internet. Attacker200spoofs the splash screen and sends to the user station a same-looking HTML page, but the attacker's page has malware, a trojan horse or another malicious payload embedded therein. An Evil Twin attack extends the scope of the attack well beyond the local Wi-Fi network, and keeps the user station infected for a long period after leaving the attacker's Wi-Fi network.

The above types of Wi-Fi network attacks involve techniques whereby attacker200gains access to the traffic of a specific station or of a few stations within a Wi-Fi network, while the users of these stations are clueless as to what is happening.

Once attacker200gains access to network traffic, attacker200can inflict damage such as (i) data leaks, whereby attacker200obtains access to a victim's data on his device and on the cloud; (ii) phishing attack, whereby a user logs in with his credentials to a fake web service and from then on attacker200has the user's credentials; (iii) installing malware, whereby attacker200injects content into the user's device, such as a virus, a Trojan horse or other malware that gains for attacker200full access to the device content; and (iv) installing ransomware, whereby attacker200injects a Ransomware to encrypt the user's device content, which is only released upon paying a ransom to attacker200.

There are many other ways for attacker200to exploit the 802.11 protocol, to hijack communication, to deliver an attack payload that is of benefit to attacker200, and to damage a user's station.

As such, it would be of great advantage to have a device that monitors Wi-Fi network traffic to identify 802.11 frames and communication content used by attacker200to attack user stations.

SUMMARY

Embodiments of the present invention provide inter alia a small external mobile device, referred to herein as a WifiWall, including hardware and software, that constantly monitors Wi-Fi network traffic to identify 802.11 frames and communication content used by an attacker to attack one or more user stations. Of significance, embodiments of the present invention require no changes in the protocol or software on the user stations or on Wi-Fi access points.

The WifiWall includes an interrogator that executes a specific set of actions corresponding to each specific type of attack, each action being a set of queries. The investigator may query access points, an access control system and/or a Security Information and Event Manager (SIEM) for the Wi-Fi network. The investigator may query a file server, a directory server and/or any other entity in the Wi-Fi network. The investigator may query a victim station. The investigator may collect Wi-Fi frames logged before, during and after an attack.

The WifiWall obtains updates, via update servers and via the Internet, to learn new attack techniques, to ensure that the WifiWall is always up-to-date with the latest Wi-Fi network attacks.

There is thus provided in accordance with an embodiment of the present invention a hardware device with embedded software, for detecting Wi-Fi network attacks, including random access memory storing operating software for the device, Flash or EEPROM memory storing Wi-Fi network attack rules and attack data, a Wi-Fi interface monitoring and intercepting Wi-Fi packets and Wi-Fi frames transmitted to and from a mobile station being protected by the device, embedded operating software analyzing sequences of Wi-Fi packets and frames intercepted by the Wi-Fi interface to detect an attempted Wi-Fi network attack, based on the attack rules and the attack data stored in the Flash or EEPROM memory, and sending a notification message to the mobile station when an attempted Wi-Fi network attack is detected, a processor running the embedded operating software, and a power supply supplying power to the processor, to the random access memory, to the Flash or EEPROM memory, and to the Wi-Fi interface.

There is additionally provided in accordance with an embodiment of the present invention a method for detecting Wi-Fi network attacks, including monitoring, by a hardware device external to a mobile device, 802.11 frames that are transmitted to and from the mobile device over a Wi-Fi network to which the mobile device is connected, searching, by the hardware device, for 802.11 management frames that indicate an attempt by an attacker to hijack connection of the mobile device, comparing, by the hardware device, a sequence of the monitored frames to pre-defined attack rule sequences, detecting, by the hardware device, a sequence of frames that corresponds to an attack, based on the comparing, and sending, by the hardware device, a notification message regarding the attack detected by the detecting, via an out-of-band channel, to the mobile device.

