無線網路安全因無線基地台(APs)的濫用或不當設定而備受挑戰，大部份的無線基地台曝露於公共場域而易於被入侵者而鎖定。入侵者常用的手法之一就是密碼竊取且能經由人為因素造成的低安全性來輕易達成。本研究提出三個方法評估無線網路安全，並指出公用無線網路的漏洞，依序為半自動擷取無線加密封包之手法、利用 GPU(顯卡)用於密碼分析及適切制宜密碼規則之運用；結合三者於資訊安全管理系統(ISMS)的基礎下來呈現無線網路之不安全。有別以往之研究，本研究利用真實街道 276 個樣本來實證公用無線網路的危險。於隨機樣本下，部份無線基地台的密碼可經由備配 GPU(顯卡)的雲端伺服器及因地制宜的密碼分析規則的運用，對密碼進行有效的分析，故無線網路的弱點因此明顯地被呈現出來。先前之研究並未將密碼分析的整個程序做詳細探討與串連，故本研究可視為類探索性之研究，所提出之整體性方法有超過 50%的無線加密封包擷取率、比現有文獻快 7.7 倍的密碼分析速度、比完全比對破解法簡省 62%~99%以上密碼組合之規則運用，並於街頭實證樣本中取得 56.52%的密碼破解率. 本研究呈現出經由人們-社會文化因素而致的弱密碼而產生的無線網路漏洞，以資安管理切入並藉由實證資料與分析對無線網路安全提出建議。

Wireless network security is a challenging issue as WiFi access points (APs) are often abused, misconfigured, or hacked. Indeed, most access points are exposed in public spaces and are exposed to being targeted by hackers. One of the most popular hacking strategies employed to crack passwords is easily performed due to human factors of low security. This study proposes three methods to evaluate the security level of wireless networks and demonstrates that the wireless networks set for daily usage are vulnerable. The proposed methods employed are; semi-automatic method of acquiring the encrypted WiFi password packets, GPUs for password analysis, rule-based password guessing, and the illustration of insecurity of the AP network under the specification for information security management system (ISMS). The wireless network is insecure in the public from the empirical 276 samples we collected. Part of the AP passwords can be cracked effectively from our cloud server which is equipped with GPUs, rule sets for certain areas, and executing password patterns analysis. The whole procedure of password analysis is not discussed in detail in previous studies so we regarded this as an exploratory study.
Thus, the vulnerability and weakness of wireless networks can be examined. The results of the experiments illustrate that more than 50% of semi-automatic capturing encrypted packets, 7.7 speedups of password analysis using GPU, 62%~99% fewer password candidates than full comparison, and achieve a 56.52% of password cracking rate on the streets. It shows that the lack of security caused by the socio-human elements which are classified as so-called “lazy" passwords. It reveals the true evidence of insecure wireless networks and gives suggestions on how to protect wireless networks in the management of information security.

學位論審定書…………………………………………………………………………i
摘要 .............................................................................................................................. ii
Abstract ........................................................................................................................ iii
Chapter 1 Introduction ............................................................................................... 1
1.1 Background ...................................................................................................... 1
1.2 The Insecurity of Wireless Network ................................................................ 2
1.3 The Weakness of Wireless Network in Reality ............................................... 4
1.4 Information Security Management System ..................................................... 6
1.5 Proposed Method and Evaluation for Secure Wireless Network .................... 7
1.6 Research Limitations ..................................................................................... 10
1.7 Research Methodology .................................................................................. 10
1.8 Contributions ................................................................................................. 13
Chapter 2 Related Work ........................................................................................... 15
2.1 Semi-Auto IDM in Capturing the AP Encrypted Packets ............................. 16
2.1.1 Adversity in Catching the Encrypted WiFi password packets ................ 16
2.1.2 Typical of Wireless Attacks in Active and Passive Ways ........................ 17
2.1.3 The Connections of the Received Signal Strength Index and the Wireless Attacks......................... 18
2.1.4 The Air Denial of Service-deauthentication and Passwords ................... 19
2.2 Password analysis in GPUs ........................................................................... 22
2.2.1 Progress and Status of WPA & WPA2 in GPU ....................................... 22
2.2.2 Computing in Cluster and the Protocol of WPA & WPA2 ...................... 24
2.2.3 The Advantage and Efficacy of Parallel Computing (GPUs) ................. 27
2.3 Rule-Based Password analysis of Wireless Network .................................... 28
2.3.1 Dictionary and Brute force Attacks in Password Analysis of WPA & WPA2 ....................... 30
2.3.2 The Complication of WPA & WPA2 Password analysis in Password Candidates ....................... 31
2.3.3 The Socio Culture Elements of Password Analysis ................................... 33
2.4 ISMS .............................................................................................................. 36
Chapter 3 The Efficient Method and Evaluation of Semi-Auto Capturing the AP Encrypted Packets.............. 39
3.1 The Design and Procedures of IDM (Intelligent Air Denial of Service-deauthentication Method) ................... 39
3.1.1 The Extra Antenna and Wireless Card Mounted and Target Scanning ... 40
3.1.2 Observe the Scanning and choose the target and dump the packets ....... 40
3.1.3 Air Denial of Service-deauthentication (DoS attack) and Observation …… 41
3.1.4 Extraction of the Encrypted Password Packets ....................................... 42
3.2 The Evaluation of IDM (Intelligent Air Denial of Service-Deauthentication Method) ............................. 43
3.2.1 The Importance and Advantage of Capturing the encrypted WiFi password packets in Password analysis ............ 43
3.2.2 The Comparison of Fully-Auto and the Proposed Methods in Catching the encrypted WiFi password packets .............. 45
3.2.3 The Comparison of Manual and the Proposed Methods in Catching the encrypted WiFi password packets ............... 46
3.3 The Locations Capturing the encrypted WiFi password packets and Passwords (KH) .......................... 51
Chapter 4 The Method and Evaluation of Password analysis in GPUs ................ 56
4.1 The Design and Procedures of Password analysis in GPUs .......................... 56
4.1.1 The Advance of WPA & WPA2 in GPU ................................................ 56
4.1.2 Speedy Password Analysis of WPA & WPA2 Protocol .......................... 62
4.2 The Evaluation of Password analysis in Wireless Network using GPUs ...... 65
4.2.1 The Importance and Advantage of Speed in Password analysis Opting … 65
4.2.2 The Comparison of Diverse Speed in the Time of Password analysis .... 67
Chapter 5 The Efficient Method and Evaluation of Rule-based Password Analysis ............................... 71
5.1 The Design and Procedures of Rule-based Password Analysis ..................... 71
5.1.1 Rule-based Password Analysis ................................................................ 71
5.1.2 The Inbuilt lists of password analysis ..................................................... 73
5.1.3 Replaceable Symbol of Mask Attack using Alphabetic and Digital Candidates ................. 74
5.1.4 The Variant Rules of Mask Attack, the Hybrid Combinations ................ 76
5.1.5 The Real Situations of the Encrypted Wireless Packets.......................... 88
5.2 The Evaluation of Rule-Based Password analysis of Wireless Network ...... 89
5.2.1 The Importance and Advantage of the Specific Rules in Password analysis…………….…....89
5.2.2 The Comparison of Dictionary Files and the Proposed Method ............. 91
5.3 Pattern Analysis of Cracked Passwords ......................................................... 97
Chapter 6 Conclusion ............................................................................................ 102
6.1 To Capture the AP Encrypted Packets Efficiently is Critical and Vulnerable to Wireless Network Security. ................ 103
6.2 Parallel-Computing in GPUs of the Password Cracking is Critical and Vulnerable to Wireless Network Security................ 104
6.3 Efficient Password analysis is Practical and Critical and Vulnerable to Wireless Network Security. .................. 105
Chapter 7 Limitations and Future Research .......................................................... 108
References ................................................................................................................. 111

[1] “Statistic Chart,” 2018. [Online]. Available: https://wigle.net/graph-large.html. [Accessed: 01-Dec-2018].
[2] www.statista.com, “Connected IoT,” 2019. [Online]. Available: https://www.statista.com.
[3] “802.11 IEEE wireless LAN standards,” 2020. [Online]. Available: https://www.webopedia.com/TERM/8/802_11.html.
[4] H. A. Fatani, I. F. Zamzami, and M. Aliyu, “Awareness toward wireless security policy: Case study of International Islamic University Malaysia,” in Proceedings of the 5th International Conference on Information and Communication Technology for the Muslim World (ICT4M), 2013, pp. 1–5.
[5] D. Luminita, “Wireless LAN Security-WPA2-PSK Case Study,” AWERProcedia Inf. Technol. Comput. Sci., vol. 1, pp. 62–67, 2012.
[6] C. Rong, G. Zhao, L. Yan, E. Cayirci, and H. Cheng, “Wireless Network Security,” Netw. Syst. Secur. Second Ed., pp. 291–317, 2013.
[7] T. H. Chang, C. Chen, H. Hsiao, and G. H. Lai, “The cryptanalysis of WPA & WPA2 using the parallel-computing with GPUs,” Commun. Comput. Inf. Sci., vol. 797, pp. 118–127, 2018.
[8] C. M. Chen and T. H. Chang, “The Cryptanalysis of WPA & WPA2 in the Rule Based Brute Force Attack, An Advanced and Efficient Method,” in Proceedings - 2015 10th Asia Joint Conference on Information Security, AsiaJCIS 2015, 2015, pp. 37–41.
[9] O. Galinina, A.Pyattaev, S.Andreev, M.Dohler, andY.Koucheryavy, “5G multi-RAT LTE-WiFi ultra-dense small cells: Performance dynamics, architecture, and trends,” IEEE J. Sel. Areas Commun., vol. 33, no. 6, pp. 1224–1240, 2015.
[10] S. Talwar, D .Choudhury, K. Dimou, E. Aryafar, B. Bangerter, and K. Stewart, “Enabling technologies and architectures for 5G wireless,” IEEE MTT-S Int. Microw. Symp. Dig., 2014.
[11] A. Gohil, H. Modi, and S. K. Patel, “5G technology of mobile communication: A survey,” 2013 Int. Conf. Intell. Syst. Signal Process. ISSP 2013, no. March, pp. 288–292, 2013.
[12] M. Ayyash et al., “Coexistence of WiFi and LiFi toward 5G: Concepts, opportunities, and challenges,” IEEE Commun. Mag., vol. 54, no. 2, pp. 64–71,
2016.
[13] K. Beckers, “Report ISMS-CORAS : A Structured Method for,” 2013.
[14] C. S. Lee and W. Park, “Enhancing industrial security management system for multimedia environment,” Multimed. Tools Appl., vol. 75, no. 22, pp. 14597–14615, 2016.
[15] A. M. Acuff, J. Cfa, and S. S. Barney, “I Nformation S Ecurity,” vol. 2, no. 4, pp. 1–5, 2010.
[16] www.itgovernance.co.uk, “ISMS,” 2020. [Online]. Available: https://www.itgovernance.co.uk/iso27000-family?cv=1.
[17] I. You, F. Y. Leu, H. C. Chen, and I. Kotenko, Mobile Internet Security: First International Symposium, MobiSec 2016, Taichung, Taiwan, July 14-15, 2016, Revised Selected Papers, vol. 797. Springer, 2018.
[18] I. Petiz, E. Rocha, P. Salvador, and A. Nogueira, “Using multiscale traffic analysis to detect WPS attacks,” in Proceedings of the IEEE International Conference onCommunications Workshops (ICC), 2013, no. Scpa, pp. 1020–1025.
[19] P. Oechslin, “Making a faster cryptanalytic time-memory trade-off,” Lect. Notes Comput. Sci. (including Subser. Lect. Notes Artif. Intell. Lect. Notes Bioinformatics), vol. 2729, pp. 617–630, 2003.
[20] K. Peffers, T. Tuunanen, M. A. Rothenberger, and S. Chatterjee, “<Design Science Research Methodology 2008.pdf>,” Publ. J. Manag. Inf. Syst., vol. 24, no. 3, pp. 45–78, 2007.
[21] M. S. Afaqui, “Contributions to the evolution of next generation WLANs,” 2017.
[22] M. K. Khan and K. Alghathbar, “Cryptanalysis and security improvements of ‘two-factor user authentication in wireless sensor networks,’” Sensors, vol. 10, no. 3, pp. 2450–2459, 2010.
[23] V. Kumkar, A. Gupta, S. Shrawne, A.Tiwari, and P.Tiwari, “Vulnerabilities of Wireless Security Protocols (WEP and WPA2),” Int. J. Adv. Res. Comput. Eng. Technol., vol. 1, no. 2, pp. 34–38, 2012.
[24] M. Agarwal, S. Biswas, and S. Nandi, “Detection of De-Authentication DoS Attacks in Wi-Fi Networks: A Machine Learning Approach,” in Proceedings - 2015 IEEE International Conference on Systems, Man, and Cybernetics, SMC 2015, 2016, pp. 246–251.
[25] A. Yacchirena, D. Alulema, D. Aguilar, D. Morocho, F. Encalada, and E. Granizo, “Analysis of attack and protection systems in Wi-Fi wireless networks under the Linux operating system,” in 2016 IEEE International Conference on Automatica, ICA-ACCA 2016, 2016.
[26] M. Aye and C. Aung, “Detection and Mitigation of Wireless Link Layer Attacks,” in Software Engineering Research, Management and Applications (SERA), 2017 IEEE 15th International Conference on, 2017, pp. 173–178.
[27] N. Dharini, R. Balakrishnan, and A. P. Renold, “Distributed detection of flooding and gray hole attacks in Wireless Sensor Network,” in 2015 International Conference on Smart Technologies and Management for Computing, Communication, Controls, Energy and Materials, ICSTM 2015 - Proceedings, 2015, no. May, pp. 178–184.
[28] S. Ji, T. Chen, and S. Zhong, “Wormhole attack detection algorithms in wireless network coding systems,” IEEE Trans. Mob. Comput., vol. 14, no. 3, pp. 660–674, 2015.
[29] A. Wahid and P. Kumar, “A Survey on Security Attacks in Wireless Sensor Network,” Int. J. Innov. Res. Sci. Technol., vol. 1, no. 8, pp. 1684–1691, 2012.
[30] J. Bellardo and S. Savage, “802.11 Denial-of-Service Attacks: Real Vulnerabilities and Practical Solutions.,” in USENIX security symposium, 2003, vol. 12, p. 2.
[31] J. Chen and Z. Safar, “Indoor Surveillance with Multimodal Wireless Networks: Multi-Cycle Detection and Performance Analysis,” in 2007 IEEE Wireless Communications and Networking Conference, 2007, pp. 1241–1246.
[32] Q. Dong and W. Dargie, “Evaluation of the reliability of RSSI for indoor localization,” 2012 Int. Conf. Wirel. Commun. Undergr. Confin. Areas, ICWCUCA 2012, no. August, 2012.
[33] R. Wu, Y. Lee, H. Tseng, Y. Jan, and M. Chuang, “Study of Characteristics of RSSI Signal,” in Industrial Technology, 2008. ICIT 2008. IEEE International Conference on, 2008, pp. 3–5.
[34] M. Khanderiya and P. M. Panchal, “A Novel Approach for Detection of Sybil Attack in Wireless Sensor Networks,” Ijsrset, vol. 2, no. 3, pp. 113–117, 2016.
[35] T. H. Chang, J. W. Lin, C. M. Chen, and G. H. Lai, “The Method of Capturing the Encrypted Password Packets of WPA & WPA2, Automatic, Semi-Automatic or Manual?,” in 2018 IEEE Conference on Dependable and Secure Computing (DSC), 2018, pp. 1–4.
[36] D. Cossa, “The Dangers of Deauthentication Attacks in an Increasingly Wireless World.”
[37] S. Compton and C. Hornat, “802.11 denial of service attacks and mitigation,” SANS Inst. InfoSec Read. Room, pp. 14–18, 2007.
[38] H. A. Noman, S. M. Abdullah, and H. I. Mohammed, “An Automated Approach to Detect Deauthentication and Disassociation Dos Attacks on Wireless 802 . 11 Networks,” IJCSI Int. J. Comput. Sci. Issues, vol. 12, no. 4, pp. 107–112, 2015.
[39] O. Huhta, P. Shrestha, S. Udar, M. Juuti, N.Saxena, and N.Asokan, “Pitfalls in Designing Zero-Effort Deauthentication: Opportunistic Human Observation Attacks,” no. February, pp. 21–24, 2017.
[40] K. Bollapalli, Y. Wu, K. Gulati, S. Khatri, and A. R. Calderbank, “Highly parallel decoding of space-time codes on graphics processing units,” in Proceedings of the 47th Annual Allerton Conference on Communication, Control, and Computing (Allerton), 2009, pp. 1262–1269.
[41] Wikipedia, “MIMD,” 2017. [Online]. Available: http://en.wikipedia.org/wiki/MIMD.
[42] N. Nishikawa, K. Iwai, H. Tanaka, and T. Kurokawa, “Throughput and Power Efficiency Evaluations of Block Ciphers on Kepler and GCN GPUs,” in Proceedings of the First International Symposium on Computing and Networking, 2013, pp. 366–372.
[43] “Multiple-core processor,” 2019. [Online]. Available: https://developer.ibm.com/articles/cc-machine-learning-deep-learning-architectures/.
[44] Wikipedia, “FLOPS,” 2019. [Online]. Available: http://en.wikipedia.org/wiki/FLOPS.
[45] Wiki, “FLOPS,” 2020. [Online]. Available: https://en.wikipedia.org/wiki/FLOPS#:~:text=In computing%2C floating point operations,than measuring instructions per second.
[46] “CUDA Preprogramming Guide,” 2019. [Online]. Available: http://docs.nvidia.com/cuda/cuda-c-programming-guide/#axzz3F5ky7blr.
[47] J. Cong and M. Smith, “Parallel bottom-up clustering algorithm with applications to circuit partitioning in VLSI design,” Proc. - Des. Autom. Conf., pp. 755–760, 1993.
[48] N. Sadashiv and S. M. D. Kumar, “Cluster, grid and cloud computing: A detailed comparison,” ICCSE 2011 - 6th Int. Conf. Comput. Sci. Educ. Final Progr. Proc., no. Iccse, pp. 477–482, 2011.
[49] C. S. Yeo and R. Buyya, “A taxonomy of market-based resource management systems for utility-driven cluster computing,” Softw. Pract. Exp., vol. 36, no. 13, pp. 1381–1419, 2006.
[50] G. L. Valentini et al., “An overview of energy efficiency techniques in cluster computing systems,” Cluster Comput., vol. 16, no. 1, pp. 3–15, 2013.
[51] www.igi-global.com, “PMK,” 2017. [Online]. Available: https://www.igi-global.com/dictionary/pairwise-master-key/21784.
[52] L. Zhang, J. Yu, R. Zong, J. Chang, and J. Xue, “Prevention research of cracking WPA-PSK key based on GPU,” in Proceedings of the 2nd International Conference on Consumer Electronics, Communications and Networks (CECNet), 2012, pp. 1965–1969.
[53] B. Hitaj, P. Gasti, G. Ateniese, and F. Perez Cruz, “PassGAN: A deep learning approach for password guessing,” Lect. Notes Comput. Sci. (including Subser. Lect. Notes Artif. Intell. Lect. Notes Bioinformatics), vol. 11464 LNCS, pp. 217–237, 2019.
[54] J. H. Huh, S. Oh, H. Kim, and K. Beznosov, “Surpass : System-initiated User-replaceable Passwords Categories and Subject Descriptors,” Ccs ’15, vol. 3, pp.
170–181, 2015.
[55] E. H. Spafford, “OPUS: Preventing weak password choices,” Comput. Secur., vol. 11, no. 3, pp. 273–278, 1992.
[56] R. V. Yampolskiy, “Analyzing user password selection behavior for reduction of password space,” Proc. - Int. Carnahan Conf. Secur. Technol., no. November 2006, pp. 109–115, 2006.
[57] E. H. Spafford, “Observing Reusable Password Choices,” System, pp. 1–14, 1992.
[58] S. Malempati and S. Mogalla, “User Authentication using Native Language Passwords,” Int. J. Netw. Secur. Its Appl., vol. 3, no. 6, pp. 149–160, 2011.
[59] S. Malempati and S. Mogalla, “Intrusion Prevention by Native Language Password Authentication Scheme,” in International Conference on Network Security and Applications, 2011, pp. 239–248.
[60] J. Hsu, “How Language Shapes Password Security,” IEEE Spectrum, 2019. [Online]. Available: https://spectrum.ieee.org/tech-talk/telecom/security/how-language-shapes-chinese-and-english-password-security.
[61] V. Bhatia, D.Gupta, and S. H. P., “Analysis of Dictionary Attack on Wireless Lan for Different Nodes,” J. Inf. Syst. Commun., vol. 3, no. 1, pp. 167–169, 2012.
[62] E. N. Lorente and C. Meijer, “Scrutinizing WPA2 Password Generating Algorithms in Wireless Routers,” in Workshop on Offensive Technologies, 2015.
[63] N. H. M. Alwi and I. S. Fan, “Information security management in E-learning,” Int. Conf. Internet Technol. Secur. Trans. ICITST 2009, no. July 2015, 2009.
[64] S. Creese, D. Hodges, S. Jamison-Powell, and M.Whitty, “Relationships between password choices, perceptions of risk and security expertise,” Lect. Notes Comput. Sci. (including Subser. Lect. Notes Artif. Intell. Lect. Notes Bioinformatics), vol. 8030 LNCS, pp. 80–89, 2013.
[65] R. Wash, E. Rader, Z. Wellmer, and R. Berman, “Understanding password choices: How frequently entered passwords are re-used across websites,” SOUPS 2016 - 12th Symp. Usable Priv. Secur., no. Soups, pp. 175–188, 2019.
[66] K. Renaud, V .Zimmerman, K. Renaud, and V. Zimmermann, “Nudging folks towards stronger password choices : providing certainty is the key This is the author accepted manuscript which has been accepted for publication in a revised 116 form in British Public Nudging Folks Towards Stronger Password Choices : Providing,” 2018.
[67] D. Malone and K. Maher, “Investigating the distribution of password choices,” WWW’12 - Proc. 21st Annu. Conf. World Wide Web, pp. 301–310, 2012.
[68] P. B. Maoneke, S. Flowerday, and N. Isabirye, “The influence of native language on password composition and security: A socioculture theoretical view,” in IFIP International Conference on ICT Systems Security and Privacy Protection, 2018, pp. 33–46.
[69] J. Krekan, M. Pleva, and L. Dobos, “Statistical models based password candidates generation for specified language used in wireless LAN security audit,” in Proceedings of the 20th International Conference on Systems, Signals and Image Processing (IWSSIP), 2013, pp. 95–98.
[70] J. H. P. Eloff and M. Eloff, “Information security management: a new paradigm,” Proc. 2003 Annu. Res. Conf. South African Inst. Comput. Sci. Inf. Technol. Enablement through Technol., pp. 130–136, 2003.
[71] Y. S. Bae, “A study of Effect of Information Security Management System [ISMS] Certification on Organization Performance,” J. Korea Acad. Coop. Soc., vol. 13, no. 9, pp. 4224–4233, 2012.
[72] www.aircrack-ng, “Aircrack-ng,” 2019. [Online]. Available: http://aircrack-ng.org/.
[73] “Gerix-wifi-cracker,” 2018. [Online]. Available: https://github.com/kimocoder/gerix-wifi-cracker. [Accessed: 01-Dec-2018].
[74] Pyrit.wordpress.com, “pyrit,” 2019. [Online]. Available: https://pyrit.wordpress.com/.
[75] K. Tran, “GPU - accelerated WPA PSK cracking solutions,” Minnesota State University, 2010.
[76] L. Zhang, J. Yu, Z. Deng, and R. Zhang, “The Security Analysis of WPA Encryption in Wireless Network,” in Proceedings of the 2nd International Conference Consumer Electronics on Communications and Networks (CECNet)., 2012, pp. 1563–1567.
[77] Z. Jin, Y. Liu, and Y. Wang, “Survey on Security Scheme and Attacking Methods of WPA/WPA2,” in Proceedings of the 6th International Conference on Wireless Communications Networking and Mobile Computing (WiCOM)., 2010, pp. 1–4.
[78] “Cyrptanalysis Software,” 2017. [Online]. Available: http://hashcat.net/oclhashcat/.
[79] “Taiwan Mobile Phone System,” 2019. [Online]. Available: https://mobile-phone.com.tw/台灣電話號碼查詢系統.html.
[80] “Wireless Password Dictionary,” 2019. [Online]. Available: https://www.wirelesshack.org/wpa-wpa2-word-list-dictionaries.html.
[81] L. R. D. of T. R. of China, “the Personal Data Protection Act.” [Online]. Available: https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=I0050021#:~:text=The Personal Data Protection Act,proper use of personal data.&text=%22data subject%22 refers to an,is collected%2C processed or used.