Wi-Fi remains a work in progress

While Microsoft has caught considerable grief over Windows network security holes, it is not alone in what seems to be an industry-wide practice of leaving security features turned-off by default. Wi-Fi vendors also ship their equipment with simple default settings and without activating security enhancements, which could be especially problematic for enterprises and public-safety organizations.

The Black Hat Federal Briefings held in Washington, D.C., in September 2003, focused on the security weaknesses of 2.4 GHz networks. It’s a fairly simple matter for hackers to crack the wired equivalent privacy (WEP) security protocol, spoof Internet protocol addresses and forge media access control (MAC) addresses, according to Don Bailey, principal of security consultancy The Shmoo Group, who spoke at the conference. Additionally, 2.4 GHz networks legally can be jammed.

“Wi-Fi is the Wild West of networking … maybe there will be a vendor fix, but don’t count on it,” Bailey said.

Using off-the-shelf equipment and a program they wrote called Airsnarf, Bailey and colleague Bruce Potter quickly illustrated how a more powerful unauthorized rogue Wi-Fi access point (AP) could overwhelm a public wireless hot spot.

Once machines establish a connection — or “associate” — to the rogue AP, a laptop computer configured as a web server and capable of replicating popular web pages could be utilized to capture user IDs and passwords without the end user’s knowledge. A rogue AP could then be used to unleash a denial-of-service (DoS) attack on a public hot spot or corporate network, pilfer user credentials or execute an AP cloning scenario for long-term unauthorized access to a network. “Someone could pay a janitor $25 bucks to plug an AP [into a corporate network],” Bailey said. “Or a user could plug in an unauthorized AP for his convenience.”

A roaming Wi-Fi network connection typically is associated between a user’s computer and the most powerful signal source. Most off-the-shelf Wi-Fi gear emits 25 megawatts of power, but some vendors manufacture laptop cards that put out as much as 200 megawatts, Bailey said. Combined with an omni-directional antenna, a rogue AP can emit 6 watts of transmission power, which is no match for a 25-megawatt transmitter. But add an amplifier to the basic setup and the equation shifts in favor of the attacker. “A ham radio operator can legally broadcast up to 1500 watts of power — what do you think a bad guy will do?” Bailey said.

Even if a rogue AP setup broadcasting illegally outside a building were to be detected — which generally is difficult to do — the perpetrator likely would be long gone before the FCC could show up with direction-finding equipment, Bailey said.

Remarkably, a licensed amateur radio operator can legally interfere with 2.4 GHz equipment, as long as he or she complies with Part 97 of the Federal Communication Commission’s rules. Wireless hot spots operate equipment under Part 15 and therefore must accept interference from any licensed or unlicensed source. Consequently, should a disgruntled ham operator become annoyed with a local Wi-Fi cybercafe — or any 2.4 GHz operator for that matter — he or she could conduct a denial-of-service attack without fear of FCC repercussion.

“We need something like ZoneAlarm for Wi-Fi,” said Bailey, who criticized vendors for failing to supply basic advisory tools. Taking matters into their own hands, Potter and other Shmoo Group members have put together HotSpotDK, a background application that monitors and logs changes to an established Wi-Fi connection.

The application checks for and notes changes in the service set identifier (SSID) and MAC address of the associated AP, the default route or router MAC, and signal strength. Written for the Apple Macintosh OS X operating system, future versions will incorporate an authorized list of MAC addresses and a sensitivity slider for signal power changes, and will enable the monitoring of link status changes.

Potter believes the real fix for Wi-Fi security is 802.1x, a link layer authentication standard. Extended from the original point-to-point protocol (PPP) dial-up authentication specification, an extended authentication protocol (EAP) was designed to work with wired or wireless networks using a centralized server to provide authentication.

Multiple types of authentication can be supported within the 802.1x framework, ranging from token cards to public key authentication. The 802.1x standard is natively implemented in Windows XP and hardware vendors such as U.S. Robotics are lining up behind it.

Bailey is more skeptical. “The devil is really in the implementation details,” he said, pointing out that weaknesses in vendor implementations will be ferreted out by someone. “You should turn on whatever security features you have available,” Potter said, “Any hacker simply looking for low-hanging fruit to exploit will move on to the next site.”

Both consultants also were quick to point out that regardless of the amount of Wi-Fi security infrastructure, the end-user often is the weakest link, because they can be fooled or coerced into giving up user IDs, passwords and WEP keys. “You name it,” Potter said.

Consequently, organizations need to create and, more importantly, enforce security policies. Organizations particularly vulnerable to attack, or those that would find a lengthy network outage severely damaging — such as a public-safety organization — may need additional security layers, including intelligent smart cards or other devices that provide hardware authentication.

Start-up Koolspan demonstrated a hardware-authentication system at the Enterprise & Public Wireless LAN conference in October 2003. Each end-user receives a token, a USB-based device and some on-board software. To initiate a secure session, the token is inserted into the USB port, which causes the device to execute a smart card-based query of the server. The server also issues a challenge to the token. If both queries are authenticated, an AES-encrypted session begins.

The hardware is expected to cost $1595 when the device starts shipping. Koolspan, based in Bethesda, Md., expected to roll out its first product by the end of 2003.

In contrast to The Shmoo Group’s stark picture, U.S. Robotics is offering a more optimistic view of Wi-Fi security. The company recently conducted a series of evangelistic events around the globe to educate resellers on Wi-Fi technology and security solutions in conjunction with 802.11g, especially into the corporate space. “Resellers are saying that wireless is not secure and that it doesn’t perform well, and that is just not true anymore,” said Peter Blampied, a U.S. Robotics official based in Europe.

U.S. Robotics addresses the issue of security in its “802.11g Wireless Turbo White Paper,” discussing security technologies incorporated into its latest hardware and how they should be used.

Features include 256-bit WEP encryption, disable broadcast SSID, MAC address authentication, 802.1x authentication, and Wi-Fi protected access (WPA). Upon successful authentication, the temporal key integrity protocol (TKIP) alters the static 40-bit WEP security key into multiple dynamic 128-bit security keys, making WEP a much more secure protocol.

on the web:

For more information on the technology and business developments that are shaping the land mobile radio and private wireless markets, check out our Web site:
WWW.IWCE-MRT.COM.COM