CEH Wireless Network Hacking 1 — Questions and Answers
Question 1: Which fundamental cryptographic weakness in WEP makes it vulnerable to key recovery attacks?
- Use of static IV values that never change
- Reuse of short 24-bit Initialization Vectors leading to keystream collisions (Correct answer)
- Lack of any encryption algorithm
- Use of RSA public-key encryption
Correct answer: Reuse of short 24-bit Initialization Vectors leading to keystream collisions
WEP uses a 24-bit IV that cycles rapidly in busy networks, causing IV reuse and allowing attackers to recover the RC4 keystream and decrypt traffic.
Question 2: During a WPA2-Personal attack, an attacker captures the four-way handshake. What is the attacker's next step to crack the passphrase?
- Exploit a buffer overflow in the access point firmware
- Perform a dictionary or brute-force attack against the captured EAPOL handshake offline (Correct answer)
- Send deauthentication frames continuously to the client
- Inject ARP packets to generate traffic
Correct answer: Perform a dictionary or brute-force attack against the captured EAPOL handshake offline
The captured four-way handshake contains enough information to perform an offline dictionary or brute-force attack to guess the pre-shared key without further interaction with the network.
Question 3: An attacker sets up an access point with the same SSID as a legitimate network and a stronger signal to lure victims. This attack is called a(n):
- Deauthentication attack
- Rogue AP / Evil Twin attack (Correct answer)
- Bluejacking attack
- WPS Pixie Dust attack
Correct answer: Rogue AP / Evil Twin attack
An Evil Twin (or Rogue AP) attack involves creating a fraudulent access point that mimics a legitimate one, causing clients to connect to it instead and enabling traffic interception.
Question 4: Which tool is most commonly used in CEH scenarios to capture WPA/WPA2 handshakes and crack wireless keys using wordlists?
- Wireshark
- Aircrack-ng (Correct answer)
- Metasploit
- Nessus
Correct answer: Aircrack-ng
Aircrack-ng is the standard wireless security auditing suite that includes tools for capturing handshakes (airodump-ng) and cracking them (aircrack-ng) using dictionary attacks.
Question 5: What is the primary vulnerability exploited by the WPS PIN attack (Reaver)?
- WPS PIN is transmitted in plaintext over the air
- The WPS PIN is split into two halves that can be brute-forced independently, reducing combinations from 10^8 to ~11,000 (Correct answer)
- WPS uses MD5 hashing which has known collisions
- WPS PINs are always 4 digits
Correct answer: The WPS PIN is split into two halves that can be brute-forced independently, reducing combinations from 10^8 to ~11,000
The WPS protocol verifies the two halves of the 8-digit PIN separately, reducing the brute-force search space from 100 million to about 11,000 combinations.
Question 6: An attacker sends spoofed 802.11 management frames with reason code 7 to disconnect clients from their access point. This technique is known as:
- ARP poisoning
- Deauthentication (deauth) attack (Correct answer)
- Beacon flooding
- PMKID attack
Correct answer: Deauthentication (deauth) attack
A deauthentication attack floods the target with forged deauth management frames, forcing clients to disconnect and re-authenticate, allowing the attacker to capture the WPA handshake.
Question 7: Which wireless encryption standard introduced CCMP (Counter Mode with CBC-MAC Protocol) based on AES to replace the insecure TKIP?
- WEP
- WPA (WPA1)
- WPA2 (Correct answer)
- WPS
Correct answer: WPA2
WPA2 (IEEE 802.11i) mandated the use of CCMP/AES as its primary encryption method, providing much stronger security than WPA's TKIP or WEP's RC4.
CEH Wireless Network Hacking 1
Which fundamental cryptographic weakness in WEP makes it vulnerable to key recovery attacks?