Wireless security is the prevention of unauthorized access or damage to computers using wireless networks. The most common types of wireless security are Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access (WPA).
WEP is a notoriously weak security standard. The password it uses can
often be cracked in a few minutes with a basic laptop computer and
widely available software tools. WEP is an old IEEE 802.11 standard from
1999 which was outdated in 2003 by WPA or Wi-Fi Protected Access. WPA
was a quick alternative to improve security over WEP. The current
standard is WPA2; some hardware cannot support WPA2 without firmware
upgrade or replacement. WPA2 uses an encryption device which encrypts
the network with a 256 bit key; the longer key length improves security
over WEP.
Many laptop computers have wireless cards pre-installed. The ability to
enter a network while mobile has great benefits. However, wireless
networking is prone to some security issues.Crackers have found wireless
networks relatively easy to break into, and even use wireless
technology to crack into wired networks.As a result, it's very important
that enterprises define effective wireless security policies that guard
against unauthorized access to important resources.Wireless Intrusion Prevention Systems (WIPS) or Wireless Intrusion Detection Systems(WIDS) are commonly used to enforce wireless security policies.
The risks to users of wireless technology have increased as the service
has become more popular. There were relatively few dangers when wireless
technology was first introduced. Crackers had not yet had time to latch
on to the new technology and wireless was not commonly found in the
work place. However, there are a great number of security risks
associated with the current wireless protocols and encryption methods,
and in the carelessness and ignorance that exists at the user and
corporate IT level.Cracking methods have become much more sophisticated
and innovative with wireless. Cracking has also become much easier and
more accessible with easy-to-use Windows or Linux-based tools being made
available on the web at no charge.
Some organizations that have no wireless access points installed do not
feel that they need to address wireless security concerns. In-Stat MDR
and META Group have estimated that 95% of all corporate laptop computers
that were planned to be purchased in 2005 were equipped with wireless.
Issues can arise in a supposedly non-wireless organization when a
wireless laptop is plugged into the corporate network. A cracker could
sit out in the parking lot and gather info from it through laptops
and/or other devices as handhelds, or even break in through this
wireless card-equipped laptop and gain access to the wired network.
The mobility advantage
Wireless networks are very common, both for organizations and
individuals. Many laptop computers have wireless cards pre-installed.
The ability to enter a network while mobile has great benefits. However,
wireless networking is prone to some security issues.Crackers have
found wireless networks relatively easy to break into, and even use
wireless technology to crack into wired networks.As a result, it's very
important that enterprises define effective wireless security policies
that guard against unauthorized access to important resources.Wireless Intrusion Prevention Systems (WIPS) or Wireless Intrusion Detection Systems (WIDS) are commonly used to enforce wireless security policies.
The air interface and link corruption riskit
There were relatively few dangers when wireless technology was first
introduced, as the effort to maintain the communication was high and the
effort to intrude is always higher. The variety of risks to users of
wireless technology have increased as the service has become more
popular and the technology more commonly available. Today there are a
great number of security risks associated with the current wireless
protocols and encryption
methods, as carelessness and ignorance exists at the user and corporate
IT level.Cracking methods have become much more sophisticated and
innovative with wireless.
Modes of unauthorized access.
The modes of unauthorised access to links, to functions and to data is
as variable as the respective entities make use of program code. There
does not exist a full scope model of such threat. To some extent the
prevention relies on known modes and methods of attack and relevant
methods for suppression of the applied methods. However, each new mode
of operation will create new options of threatening. Hence prevention
requires a steady drive for improvement. The described modes of attack
are just a snapshot of typical methods and scenarios where to apply.
Accidental association
Violation of the security perimeter of a corporate network can come from
a number of different methods and intents. One of these methods is
referred to as “accidental association”. When a user turns on a computer
and it latches on to a wireless access point from a neighboring
company’s overlapping network, the user may not even know that this has
occurred. However, it is a security breach in that proprietary company
information is exposed and now there could exist a link from one company
to the other. This is especially true if the laptop is also hooked to a
wired network.
Accidental association is a case of wireless vulnerability called as
"mis-association".Mis-association can be accidental, deliberate (for
example, done to bypass corporate firewall) or it can result from
deliberate attempts on wireless clients to lure them into connecting to
attacker's APs.
The threat situation
Main article:
Wireless security is just an aspect of computer security, however
organizations may be particularly vulnerable to security breaches caused
by rogue access points.
If an employee (trusted entity) brings in a wireless router and plugs it
into an unsecured switchport, the entire network can be exposed to
anyone within range of the signals. Similarly, if an employee adds a
wireless interface to a networked computer via an open USB port, they
may create a breach in network security that would allow access to
confidential materials. However, there are effective countermeasures
(like disabling open switchports during switch configuration and VLAN
configuration to limit network access) that are available to protect
both the network and the information it contains, but such
countermeasures must be applied uniformly to all network devices.
Malicious association
“Malicious associations” are when wireless devices can be actively made
by attackers to connect to a company network through their cracking
laptop instead of a company access point (AP). These types of laptops
are known as “soft APs” and are created when a cyber criminal runs some
software that makes his/her wireless network card look like a legitimate
access point. Once the thief has gained access, he/she can steal
passwords, launch attacks on the wired network, or plant trojans. Since
wireless networks operate at the Layer 2 level, Layer 3 protections such
as network authentication and virtual private networks (VPNs) offer no
barrier. Wireless 802.1x authentications do help with some protection
but are still vulnerable to cracking. The idea behind this type of
attack may not be to break into a VPN or other security measures. Most likely the criminal is just trying to take over the client at the Layer 2 level.
Ad hoc networks
Ad hoc networks can pose a security threat. Ad hoc networks are defined as peer-to-peer
networks between wireless computers that do not have an access point in
between them. While these types of networks usually have little
protection, encryption methods can be used to provide security.
The security hole provided by Ad hoc networking is not the Ad hoc
network itself but the bridge it provides into other networks, usually
in the corporate environment, and the unfortunate default settings in
most versions of Microsoft Windows to have this feature turned on unless
explicitly disabled. Thus the user may not even know they have an
unsecured Ad hoc network in operation on their computer. If they are
also using a wired or wireless infrastructure network at the same time,
they are providing a bridge to the secured organizational network
through the unsecured Ad hoc connection. Bridging is in two forms. A
direct bridge, which requires the user actually configure a bridge
between the two connections and is thus unlikely to be initiated unless
explicitly desired, and an indirect bridge which is the shared resources
on the user computer. The indirect bridge provides two security
hazards. The first is that critical organizational data obtained via the
secured network may be on the user's end node computer drive and thus
exposed to discovery via the unsecured Ad hoc network. The second is
that a computer virus or otherwise undesirable code may be placed on the
user's computer via the unsecured Ad hoc connection and thus has a
route to the organizational secured network. In this case, the person
placing the malicious code need not "crack" the passwords to the
organizational network, the legitimate user has provided access via a
normal and routine log-in. The malefactor simply needs to place the
malicious code on the unsuspecting user's end node system via the open
(unsecured) Ad hoc networks.
Non-traditional networks
Non-traditional networks such as personal network Bluetooth devices are
not safe from cracking and should be regarded as a security risk. Even
barcode readers, handheld PDAs, and wireless printers and copiers should
be secured. These non-traditional networks can be easily overlooked by
IT personnel who have narrowly focused on laptops and access points.
Identity theft
(MAC spoofing)
Identity theft (or MAC spoofing) occurs when a cracker is able to listen in on network traffic and identify the MAC address
of a computer with network privileges. Most wireless systems allow some
kind of MAC filtering to allow only authorized computers with specific
MAC IDs to gain access and utilize the network. However, programs exist
that have network “sniffing” capabilities. Combine these programs with
other software that allow a computer to pretend it has any MAC address
that the cracker desires, and the cracker can easily get around that
hurdle.
MAC filtering is effective only for small residential (SOHO) networks,
since it provides protection only when the wireless device is "off the
air". Any 802.11 device "on the air" freely transmits its unencrypted
MAC address in its 802.11 headers, and it requires no special equipment
or software to detect it. Anyone with an 802.11 receiver (laptop and
wireless adapter) and a freeware wireless packet analyzer can obtain the
MAC address of any transmitting 802.11 within range. In an
organizational environment, where most wireless devices are "on the air"
throughout the active working shift, MAC filtering provides only a
false sense of security since it prevents only "casual" or unintended
connections to the organizational infrastructure and does nothing to
prevent a directed attack.
In a network injection attack, a cracker can make use of access points
that are exposed to non-filtered network traffic, specifically
broadcasting network traffic such as “Spanning Tree” (802.1D), OSPF, RIP, and HSRP.
The cracker injects bogus networking re-configuration commands that
affect routers, switches, and intelligent hubs. A whole network can be
brought down in this manner and require rebooting or even reprogramming
of all intelligent networking devices.
Regular WEP
Main article:
The Wired Equivalent Privacy (WEP) encryption standard was the original encryption standard for wireless, but since 2004 with the ratification WPA2 the IEEE has declared it "deprecated", and while often supported, it is seldom or never the default on modern equipment.
Concerns were raised about its security as early as 2001, dramatically demonstrated in 2005 by the FBI, yet in 2007 T.J. Maxx
admitted a massive security breach due in part to a reliance on WEP and
the Payment Card Industry took until 2008 to prohibit its use - and
even then allowed existing use to continue until June 2010.
Wireless intrusion prevention concepts
There are three principal ways to secure a wireless network.
For closed networks (like home users and organizations) the most common
way is to configure access restrictions in the access points. Those
restrictions may include encryption and checks on MAC address. Another
option is to disable ESSID broadcasting, making the access point
difficult for outsiders to detect. Wireless Intrusion Prevention Systems
can be used to provide wireless LAN security in this network model.
For commercial providers, hotspots, and large organizations, the
preferred solution is often to have an open and unencrypted, but
completely isolated wireless network. The users will at first have no
access to the Internet nor to any local network resources. Commercial
providers usually forward all web traffic to a captive portal which
provides for payment and/or authorization. Another solution is to
require the users to connect securely to a privileged network using VPN.
Wireless networks are less secure than wired ones; in many offices
intruders can easily visit and hook up their own computer to the wired
network without problems, gaining access to the network, and it's also
often possible for remote intruders to gain access to the network
through backdoors like Back Orifice.
One general solution may be end-to-end encryption, with independent
authentication on all resources that shouldn't be available to the
public.
There is no ready designed system to prevent from fraudulent usage of
wireless communication or to protect data and functions with wirelessly
communicating computers and other entities. However there is a system of
qualifying the taken measures as a whole according to a common
understanding what shall be seen as state of the art. The system of
qualifying is an international consensus as specified in ISO/IEC 15408.
Denial of service
A Denial-of-Service attack
(DoS) occurs when an attacker continually bombards a targeted AP
(Access Point) or network with bogus requests, premature successful
connection messages, failure messages, and/or other commands. These
cause legitimate users to not be able to get on the network and may even
cause the network to crash. These attacks rely on the abuse of
protocols such as the Extensible Authentication Protocol (EAP).
The DoS
attack in itself does little to expose organizational data to a
malicious attacker, since the interruption of the network prevents the
flow of data and actually indirectly protects data by preventing it from
being transmitted. The usual reason for performing a DoS attack is to
observe the recovery of the wireless network, during which all of the
initial handshake codes are re-transmitted by all devices, providing an
opportunity for the malicious attacker to record these codes and use
various "cracking" tools to analyze security weaknesses and exploit them
to gain unauthorized access to the system. This works best on weakly
encrypted systems such as WEP, where there are a number of tools
available which can launch a dictionary style attack of "possibly
accepted" security keys based on the "model" security key captured
during the network recovery.
Man-in-the-middle attacks
A man-in-the-middle
attacker entices computers to log into a computer which is set up as a
soft AP (Access Point). Once this is done, the hacker connects to a real
access point through another wireless card offering a steady flow of
traffic through the transparent hacking computer to the real network.
The hacker can then sniff the traffic. One type of man-in-the-middle
attack relies on security faults in challenge and handshake protocols to
execute a “de-authentication attack”. This attack forces AP-connected
computers to drop their connections and reconnect with the cracker’s
soft AP(disconnects the user from the modem so they have to connect
again using their password which you can extract from the recording of
the event). Man-in-the-middle attacks are enhanced by software such as
LANjack and AirJack which automate multiple steps of the process,
meaning what once required some skill can now be done by script
kiddies.Hotspots are particularly vulnerable to any attack since there
is little to no security on these networks.
MAC ID filtering
One of the simplest techniques is to only allow access from known,
pre-approved MAC addresses. Most wireless access points contain some
type of MAC ID filtering. However, an attacker can simply sniff the MAC address of an authorized client and spoof this addresses.
SSID hiding
Main article:
A simple but ineffective method to attempt to secure a wireless network is to hide the SSID (Service Set Identifier).This provides very little protection against anything but the most casual intrusion efforts.
Static IP addressing
Typical wireless access points provide IP addresses to clients via DHCP.
Requiring clients to set their own addresses makes it more difficult
for a casual or unsophisticated intruder to log onto the network, but
provides little protection against a sophisticated attacker.
802.11 security
Main article:
IEEE 802.1X is the IEEE Standard authentication mechanisms to devices wishing to attach to a Wireless LAN.
There are a range of wireless security measures, of varying effectiveness and practicality.
A wireless intrusion prevention system
A Wireless Intrusion Prevention System
(WIPS) is a concept for the most robust way to counteract wireless
security risks.However such WIPS does not exist as a ready designed
solution to implement as a software package. A WIPS is typically
implemented as an overlay to an existing Wireless LAN
infrastructure, although it may be deployed standalone to enforce
no-wireless policies within an organization. WIPS is considered so
important to wireless security that in July 2009, the Payment Card
Industry Security Standards Council published wireless guidelines for PCI DSS recommending the use of WIPS to automate wireless scanning and protection for large organizations.
Restricted access networks:
Solutions include a newer system for authentication, IEEE 802.1x,
that promises to enhance security on both wired and wireless networks.
Wireless access points that incorporate technologies like these often
also have routers built in, thus becoming wireless gateways.
WPAv1
Main article:
The Wi-Fi Protected Access (WPA and WPA2) security protocols were later
created to address the problems with WEP. If a weak password, such as a
dictionary word or short character string is used, WPA and WPA2 can be
cracked. Using a long enough random password (e.g. 14 random letters) or
passphrase (e.g. 5 randomly chosen words) makes pre-shared key
WPA virtually uncrackable. The second generation of the WPA security
protocol (WPA2) is based on the final IEEE 802.11i amendment to the
802.11 standard and is eligible for FIPS 140-2 compliance. With all those encryption schemes, any client in the network that knows the keys can read all the traffic.
Wi-Fi Protected Access (WPA) is a software/firmware improvement over
WEP. All regular WLAN-equipment that worked with WEP are able to be
simply upgraded and no new equipment needs to be bought. WPA is a
trimmed-down version of the 802.11i security standard that was developed
by the IEEE 802.11 to replace WEP. The TKIP
encryption algorithm was developed for WPA to provide improvements to
WEP that could be fielded as firmware upgrades to existing 802.11
devices. The WPA profile also provides optional support for the AES-CCMP algorithm that is the preferred algorithm in 802.11i and WPA2.
WPA Enterprise provides RADIUS based authentication using 802.1x. WPA
Personal uses a pre-shared Shared Key (PSK) to establish the security
using an 8 to 63 character passphrase. The PSK may also be entered as a
64 character hexadecimal string. Weak PSK passphrases can be broken
using off-line dictionary attacks by capturing the messages in the
four-way exchange when the client reconnects after being
deauthenticated. Wireless suites such as aircrack-ng
can crack a weak passphrase in less than a minute. Other WEP/WPA
crackers are AirSnort and Auditor Security Collection.Still, WPA
Personal is secure when used with ‘good’ passphrases or a full
64-character hexadecimal key.
There was information, however, that Erik Tews
(the man who created the fragmentation attack against WEP) was going to
reveal a way of breaking the WPA TKIP implementation at Tokyo's PacSec
security conference in November 2008, cracking the encryption on a
packet in between 12–15 minutes.Still, the announcement of this 'crack'
was somewhat overblown by the media, because as of August, 2009, the
best attack on WPA (the Beck-Tews attack) is only partially successful
in that it only works on short data packets, it cannot decipher the WPA
key, and it requires very specific WPA implementations in order to work.
Caffe Latte attack
The Caffe Latte attack is another way to defeat WEP. It is not necessary for the attacker to be in the area of the network using this exploit. By using a process that targets the Windows wireless stack, it is possible to obtain the WEP key from a remote client.By sending a flood of encrypted ARP requests, the assailant takes advantage of the shared key authentication and the message modification flaws in 802.11 WEP. The attacker uses the ARP responses to obtain the WEP key in less than 6 minutes.
Additions to WPAv1
In addition to WPAv1, TKIP, WIDS
and EAP may be added alongside. Also, VPN-networks (non-continuous
secure network connections) may be set up under the 802.11-standard. VPN
implementations include PPTP, L2TP, IPsec and SSH. However, this extra
layer of security may also be cracked with tools such as Anger, Deceit
and Ettercap for PPTP and ike-scan, IKEProbe, ipsectrace, and IKEcrack
for IPsec-connections.
EAP
The WPA-improvement over the IEEE 802.1X standard already improved the
authentication and authorization for access of wireless and wired LANs.
In addition to this, extra measures such as the Extensible Authentication Protocol
(EAP) have initiated an even greater amount of security. This, as EAP
uses a central authentication server. Unfortunately, during 2002 a
Maryland professor discovered some shortcomings.Over the next few years
these shortcomings were addressed with the use of TLS and other
enhancements.
This new version of EAP is now called Extended EAP and is available in
several versions; these include: EAP-MD5, PEAPv0, PEAPv1, EAP-MSCHAPv2,
LEAP, EAP-FAST, EAP-TLS, EAP-TTLS, MSCHAPv2, EAP-SIM, ...
EAP-versions
EAP-versions include LEAP, PEAP and other EAP's
LEAP
Main article:
This stands for the Lightweight Extensible Authentication Protocol. This protocol is based on 802.1X
and helps minimize the original security flaws by using WEP and a
sophisticated key management system. This EAP-version is safer than
EAP-MD5. This also uses MAC address authentication. LEAP is not safe
against crackers. THC-LeapCracker
can be used to break Cisco’s version of LEAP and be used against
computers connected to an access point in the form of a dictionary
attack. Anwrap and asleap finally are other crackers capable of breaking
LEAP.
This stands for Protected Extensible Authentication Protocol. This
protocol allows for a secure transport of data, passwords, and
encryption keys without the need of a certificate server. This was
developed by Cisco, Microsoft, and RSA Security.
Other EAPs There are other types of Extensible Authentication Protocol
implementations that are based on the EAP framework. The framework that
was established supports existing EAP types as well as future
authentication methods.EAP-TLS offers very good protection because of
its mutual authentication. Both the client and the network are
authenticated using certificates and per-session WEP keys.EAP-FAST also
offers good protection. EAP-TTLS is another alternative made by Certicom
and Funk Software. It is more convenient as one does not need to
distribute certificates to users, yet offers slightly less protection
than EAP-TLS.
TKIP
MAIN ARTICLE:
This stands for Temporal Key Integrity Protocol and the acronym is
pronounced as tee-kip. This is part of the IEEE 802.11i standard. TKIP
implements per-packet key mixing with a re-keying system and also
provides a message integrity check. These avoid the problems of WEP.
RADIUS:
MAIN ARTICLE:
Remote Authentication Dial In User Service (RADIUS) is an AAA (authentication, authorization and accounting) protocol used for remote network access. RADIUS was originally proprietary but was later published under ISOC documentsRFC 2138 and RFC 2139.
The idea is to have an inside server act as a gatekeeper by verifying
identities through a username and password that is already
pre-determined by the user. A RADIUS server can also be configured to
enforce user policies and restrictions as well as record accounting
information such as connection time for purposes such as billing.
End-to-end encryption
One can argue that both layer 2 and layer 3 encryption methods are not
good enough for protecting valuable data like passwords and personal
emails. Those technologies add encryption only to parts of the
communication path, still allowing people to spy on the traffic if they
have gained access to the wired network somehow. The solution may be
encryption and authorization in the application layer, using
technologies like SSL, SSH, GnuPG, PGP and similar.
The disadvantage with the end-to-end method is, it may fail to cover all
traffic. With encryption on the router level or VPN, a single switch
encrypts all traffic, even UDP and DNS lookups. With end-to-end
encryption on the other hand, each service to be secured must have its
encryption "turned on," and often every connection must also be "turned
on" separately. For sending emails, every recipient must support the
encryption method, and must exchange keys correctly. For Web, not all
web sites offer https, and even if they do, the browser sends out IP
addresses in clear text.
The most prized resource is often access to Internet. An office LAN
owner seeking to restrict such access will face the nontrivial
enforcement task of having each user authenticate himself for the
router.
WPA2 is a WiFi Alliance branded version of the final 802.11i standard.The primary enhancement over WPA is the inclusion of the AES-CCMP
algorithm as a mandatory feature. Both WPA and WPA2 support EAP
authentication methods using RADIUS servers and preshared key (PSK).
The number of WPA and WPA2 networks are increasing, while the number of
WEP networks are decreasing, because of the security vulnerabilities in
WEP. It is important to note there is a possible security vulnerability
to the WPA protocol. It is referred to as Hole196. It is a hole in the
protocol that exposes the user to insider attacks.
WPA2 has been found to have at least one security vulnerability,
nicknamed Hole196. The vulnerability uses the WPA2 Group Temporal Key
(GTK), which is a shared key among all users of the same BSSID, to
launch attacks on other users of the same BSSID. It is named after page
196 of the IEEE 802.11i specification, where the vulnerability is
discussed. In order for this exploit to be performed, the GTK must be
known by the attacker.
Additions to WPAv2
Unlike 802.1X, 802.11i already has most other additional
security-services such as TKIP. Just as with WPAv1, WPAv2 may work in
cooperation with EAP and a WIDS.
This stands for WLAN Authentication and Privacy Infrastructure. This is a
wireless security standard defined by the Chinese government.
Smart cards, USB tokens, and software tokens
This is a very strong form of security. When combined with some server
software, the hardware or software card or token will use its internal
identity code combined with a user entered PIN
to create a powerful algorithm that will very frequently generate a new
encryption code. The server will be time synced to the card or token.
This is a very secure way to conduct wireless transmissions. Companies
in this area make USB tokens, software tokens, and smart cards. They
even make hardware versions that double as an employee picture badge.
Currently the safest security measures are the smart cards / USB tokens.
However, these are expensive. The next safest methods are WPA2 or WPA
with a RADIUS server. Any one of the three will provide a good base
foundation for security. The third item on the list is to educate both
employees and contractors on security risks and personal preventive
measures. It is also IT's task to keep the company workers' knowledge
base up-to-date on any new dangers that they should be cautious about.
If the employees are educated, there will be a much lower chance that
anyone will accidentally cause a breach in security by not locking down
their laptop or bring in a wide open home access point to extend their
mobile range. Employees need to be made aware that company laptop
security extends to outside of their site walls as well. This includes
places such as coffee houses where workers can be at their most
vulnerable. The last item on the list deals with 24/7 active defense
measures to ensure that the company network is secure and compliant.
This can take the form of regularly looking at access point, server, and
firewall logs to try to detect any unusual activity. For instance, if
any large files went through an access point in the early hours of the
morning, a serious investigation into the incident would be called for.
There are a number of software and hardware devices that can be used to
supplement the usual logs and usual other safety measures.
RF shielding
It’s practical in some cases to apply specialized wall paint and window
film to a room or building to significantly attenuate wireless signals,
which keeps the signals from propagating outside a facility. This can
significantly improve wireless security because it’s difficult for
hackers to receive the signals beyond the controlled area of an
enterprise, such as within parking lots.
Despite security measures as encryption, hackers may still be able to
crack them. This is done using several techniques and tools. An overview
of them can be found at the Network encryption cracking
article, to understand what we are dealing with. Understanding the
mindset/techniques of the hacker allows one to better protect their
system.
For closed networks (like home users and organizations) the most common
way is to configure access restrictions in the access points. Those
restrictions may include encryption and checks on MAC address. Another
option is to disable ESSID broadcasting, making the access point
difficult for outsiders to detect. Wireless Intrusion Prevention Systems
can be used to provide wireless LAN security in this network model.
For commercial providers, hotspots, and large organizations, the
preferred solution is often to have an open and unencrypted, but
completely isolated wireless network. The users will at first have no
access to the Internet nor to any local network resources. Commercial
providers usually forward all web traffic to a captive portal which
provides for payment and/or authorization. Another solution is to
require the users to connect securely to a privileged network using VPN.
Wireless networks are less secure than wired ones; in many offices
intruders can easily visit and hook up their own computer to the wired
network without problems, gaining access to the network, and it's also
often possible for remote intruders to gain access to the network
through backdoors like Back Orifice. One general solution may be
end-to-end encryption, with independent authentication on all resources
that shouldn't be available to the public.
Mobile devices
Main article:
With increasing number of mobile devices with 802.1x interfaces,
security of such mobile devices becomes a concern. While open standards
such as Kismet are targeted towards securing laptops, access points
solutions should extend towards covering mobile devices also. Host based
solutions for mobile handsets and PDA's with 802.1x interface.
Security within mobile devices fall under three categories:
- Protecting against ad hoc networks
- Connecting to rogue access points
- Mutual authentication schemes such as WPA2 as described above
Wireless IPS solutions now offer wireless security for mobile devices.
Mobile patient monitoring devices are becoming an integral part of
healthcare industry and these devices will eventually become the method
of choice for accessing and implementing health checks for patients
located in remote areas. For these types of patient monitoring systems,
security and reliability are critical, because they can influence the
condition of patients, and could leave medical professionals in the dark
about the condition of the patient if compromised.
Implementing network encryption
In order to implement 802.11i, one must first make sure both that the
router/access point(s), as well as all client devices are indeed
equipped to support the network encryption. If this is done, a server
such as RADIUS, ADS, NDS, or LDAP needs to be integrated. This server
can be a computer on the local network, an access point / router with
integrated authentication server, or a remote server. AP's/routers with
integrated authentication servers are often very expensive and
specifically an option for commercial usage like hot spots. Hosted
802.1X servers via the Internet require a monthly fee; running a private
server is free yet has the disadvantage that one must set it up and
that the server needs to be on continuously.
To set up a server, server and client software must be installed. Server software required is an enterprise authentication server such as RADIUS, ADS, NDS, or LDAP.
The required software can be picked from various suppliers as Microsoft,
Cisco, Funk Software, Meetinghouse Data, and from some open-source
projects.
SOFTVARE INCLUDES:
- Cisco Secure Access Control Software
- Microsoft Internet Authentication Service
- Meetinghouse Data EAGIS
- Funk Software Steel Belted RADIUS (Odyssey)
- Aradial RADIUS Server
- freeRADIUS (open-source)
- SkyFriendz (free cloud solution based on freeRADIUS)
Client software comes built-in with Windows XP and may be integrated into other OS's using any of following software:
- Intel PROSet/Wireless Software
- Cisco ACU-client
- Odyssey client
- AEGIS-client
- Xsupplicant (open1X)-project
Open access points
Today, there is almost full wireless network coverage in many urban areas - the infrastructure for the wireless community network (which
some consider to be the future of the internet) is already in place.
One could roam around and always be connected to Internet if the nodes
were open to the public, but due to security concerns, most nodes are
encrypted and the users don't know how to disable encryption. Many
people consider it proper etiquette to leave access points open to the
public, allowing free access to Internet. Others think the default
encryption provides substantial protection at small inconvenience,
against dangers of open access that they fear may be substantial even on
a home DSL router.
The density of access points can even be a problem - there are a limited
number of channels available, and they partly overlap. Each channel can
handle multiple networks, but places with many private wireless
networks (for example, apartment complexes), the limited number of Wi-Fi
radio channels might cause slowness and other problems.
According to the advocates of Open Access Points, it shouldn't involve
any significant risks to open up wireless networks for the public:
The wireless network is after all confined to a small geographical area.
A computer connected to the Internet and having improper configurations
or other security problems can be exploited by anyone from anywhere in
the world, while only clients in a small geographical range can exploit
an open wireless access point. Thus the exposure is low with an open
wireless access point, and the risks with having an open wireless
network are small. However, one should be aware that an open wireless
router will give access to the local network, often including access to
file shares and printers.
The only way to keep communication truly secure is to use end-to-end
encryption. For example, when accessing an internet bank, one would
almost always use strong encryption from the web browser and all the way
to the bank - thus it shouldn't be risky to do banking over an
unencrypted wireless network. The argument is that anyone can sniff the
traffic applies to wired networks too, where system administrators and
possible crackers have access to the links and can read the traffic.
Also, anyone knowing the keys for an encrypted wireless network can gain
access to the data being transferred over the network.
If services like file shares, access to printers etc. are available on
the local net, it is advisable to have authentication (i.e. by password)
for accessing it (one should never assume that the private network is
not accessible from the outside). Correctly set up, it should be safe to
allow access to the local network to outsiders.
With the most popular encryption algorithms today, a sniffer will usually be able to compute the network key in a few minutes.
It is very common to pay a fixed monthly fee for the Internet
connection, and not for the traffic - thus extra traffic will not be
detrimental.
Where Internet connections are plentiful and cheap, freeloaders will seldom be a prominent nuisance.
On the other hand, in some countries including Germany, persons
providing an open access point may be made (partially) liable for any
illegal activity conducted via this access point. Also, many contracts
with ISPs specify that the connection may not be shared with other
persons.
Anyone within the geographical network range of an open, unencrypted wireless network can 'sniff' or capture and record the traffic,
gain unauthorized access to internal network resources as well as to
the internet, and then use the information and resources to perform
disruptive or illegal acts. Such security breaches have become important
concerns for both enterprise and home networks.
If router security is not activated or if the owner deactivates it for convenience, it creates a free hotspot.
Since most 21st-century laptop PCs have wireless networking built in
(cf. Intel 'Centrino' technology), they don't need a third-party adapter
such as a PCMCIA Card or USB dongle. Built-in wireless networking might
be enabled by default, without the owner realizing it, thus
broadcasting the laptop's accessibility to any computer nearby.
Modern operating systems such as Linux, Mac OS, or Microsoft
Windows make it fairly easy to set up a PC as a wireless LAN 'base
station' using Internet Connection Sharing, thus allowing all the PCs in
the home to access the Internet via the 'base' PC. However, lack of
knowledge among users about the security issues inherent in setting up
such systems often may allow others nearby access to the connection.
Such "piggybacking" is usually achieved without the wireless network
operators knowledge; it may even be without the knowledge of the
intruding user if their computer automatically selects a nearby
unsecured wireless network to use as an access point.
Articles
