Page 802 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

now that internet connectivity is nearly ubiquitous, with most of us
carrying an internet-connected device on our person (usually a

smartphone), the popularity of portable Wi-Fi hotspots, and many
retail establishments offering free Wi-Fi as an incentive for customers,
the need for and occurrence of war chalking has faded. When an
attacker uses war dialing to locate a wireless target to compromise,
they don’t mark up the area with special symbols to inform others of
their intentions.

Replay

A replay attack is the retransmission of captured communications in
the hope of gaining access to the targeted system. Replay attacks in
relation to wireless environments specifically may continue to focus on
initial authentication abuse. However, many other wireless replay
attack variants exist. They include capturing new connection requests
of a typical client and then replaying that connect request in order to
fool the base station into responding as if another new client

connection request was initiated. Wireless replay attacks can also
focus on DoS by retransmitting connection requests or resource
requests of the base station in order to keep it busy focusing on
managing new connections rather than maintaining and providing
service for existing connections.

Wireless replay attacks can be mitigated by keeping the firmware of
the base station updated as well as operating a wireless-focused

network intrusion detection system (NIDS). A W-IDS or W-NIDS will
be able to detect such abuses and inform the administrators promptly
about the situation.

IV

IV stands for initialization vector, a mathematical and cryptographic
term for a random number. Most modern crypto functions use IVs to
increase their security by reducing predictability and repeatability. An
IV becomes a point of weakness when it’s too short, exchanged in plain

text, or selected improperly. Thus, an IV attack is an exploitation of
how the IV is handled (or mishandled). One example of an IV attack is
that of cracking Wireless Equivalent Privacy (WEP) encryption.