Posted
10 October 2002 @ 11 PM

Tagged
recommended, security

Hi-Wi-Fi

Given the flawed state of security in the 802.11b standard, a sane person would be very reluctant to deploy a WLAN. Wi-Fi with all the initial hype is a letdown on basic security concerns. Given that one can intercept, insert, jam or just passively listen to WLAN traffic, how would my MD dream about ubiquitous computing? Sitting in the garden and accessing Internet, doing a conference call with a guy sitting halfway across the world? Is that really possible while being reasonably secure?

That's a difficult question.

  • The 802.11b standard uses what is called as Wired Equivalent Privacy. In this, a secret key is shared between the client and the access point. The issue is that the encryption key length is only 40-bit which is way below decent levels . This has lead to crackers roaming around searching for wireless netowrks waiting to be cracked. They do war-walking, war-riding, war-driving and war-chalking to identify open WLANs.
  • Also, given the commonness of equipment available for the 2.4Ghz band (on which 802.11b operates) like microwaves, cordless phones, etc. , a cracker hardly needs time to jam the band with junk signals.
  • DHCP servers happily lend out ip addresses to all people even before verifying if the user is valid.

There are some people like NASA who have a work around for the WEP problem using OpenBSD ;) but then everyone is not that smart. So, the IEEE guys have now thought long term and belted out a couple of security standards for Wi-Fi (802.11b and 802.11a now jointly fall in the Wi-Fi specification) namely the 802.1x standard. This standard provides a framework for authentication (EAP), access control and key management. Couple this with central AAA servers for authentication and access control, you get somewhat secure system. Additionally the 802.11a standard supports upto 54Mbps transfer rates. This means that one can use IPSEC for point to point communication without worrying too much about network performance. Wireless VPNs alongwith the 802.1x standard can help reach a reasonable level of security. Some points I thought of that are useful while implementing a WLAN:

  • Use 802.11a. Dump 802.11b 802.11a with better transfer rates, low noise band(5Ghz) and better modulation is the better choice.
  • Implement mutual authentication mechanisms. e.g. 802.1x security standard.
  • Use a Radius server to authenticate the user even before he tries to send a packet on the wirless network. yes, this is possible using 802.1x (with EAP)
  • After proper authentication, the client is assigned an ip address. The access point, which he is closest to, also gets a list of what the client should and what it should not access on the network, basically the access control policy as applicable to the client.
  • Use fixed ip addresses for clients. Enable mac address binding on the access point.
  • Put up firewalls on the interfaces between WLANs and the mainline wired network.
  • Put up IDSs on access points which are critical.
  • Use VPNs. They provide excellent security for critical data communication.

Some Pointers:

8 Comments (closed)

Posted by
Srinivasan Nagarajan

29 July 2004 @ 7 PM

Theres a broken link at war-Chalking (http://www.warchalking.org) on this page http://nilesh.org/weblog/2002/10/hiwifi/ Please do something abt it.

Posted by
Codey

14 October 2002 @ 11 PM

oops....... correction...... replace dotcom bust with tech bust.... tho it is debatable where one ends and the other begins.... That can be tackled by power users like you and me. : Imagine a journo telling a network admin that he has a hole in his network.... instead of going for sealing the hole, he gets busy blaming you for every damn virus that the network has..... tho your boss who surfs more smut than the rest of the office put together is the one who let it loose.... and trust me i have to deal with this almost everyday..... Normal employees are responsible for security, not a consultant or an auditor. It is a shared responsibility.: Only if pigs would fly ;-)

Posted by
Nilesh

19 October 2002 @ 8 PM

tho your boss who surfs more smut than the rest of the office put together is the one who let it loose Very true! Only if pigs would fly ;-) Yeah! true but still one can make pigs fly. If you as a journo cannot have a say, convince the IT guys. Express your concern to whoever comes your way. I know you must have done it earlier, but you must be persistent. People will start thinking seriously someday.I have been persistent on some issues not been handled properly and have been successful many times (although not always)

Posted by
Nilesh

12 October 2002 @ 2 PM

Mass usage is definitely a key factor in improvement of technology. But then, you see it's a cycle. technical flaws=less deployment=no demand=no supply=no improvement=flaws remain. Atleast there should have been a minimum baseline. Anyway, the technology is gaining acceptance but slowly. >it is more a problem of what the admins do or can be assed enough to do Yup, that's precisely what should be done. 'Educate' them.

Posted by
Nilesh

12 October 2002 @ 6 PM

Codey, in continuation of my comments here, read this article People, not Technology, I just posted.

Posted by
Codey

12 October 2002 @ 10 PM

at some point someone has to bite the bullet and take in R&D that does not make economic sense... the sad downside of the tech bust has been that it is seen as a 'not-happening' thing to provide developmental stuff for free... servers to develop stuff on, bandwidth etc.... this is affecting what has been actually been the foundation of the net and network security... no one is willing to shoot medium sized bucks down the black hole anymore... more than education it is i guess the top level management also has to audit the security chap... most ppl think that hiring an infy to design and secure their network will take care of things.. while all they often do is to slap an out of the box install on the firewall and send you a bomb for it... pressure=admin is forced to keep upto date.. often the former is very much lacking.. then again.... pure security chaps.... black or white are a great grey area...

Posted by
Nilesh

13 October 2002 @ 9 AM

Codey, I feel you sound a bit disappointed. I do not think that the situation is so bad in the Indian scenario. of course, a dot com cannot fund R&D because it itself is on unstable ground. It is the job of a well established company to take up R&D. By my knowledge, there are Indian companies doing exactly that. Ofcourse, no one is sharing resources, they are on their own. But then it will ultimately help the international community in the near future. >pressure=admin is forced to keep upto date.. often the former is very much lacking.. Again, the pressure is lacking because of no seriousness on the management's part. That can be tackled by power users like you and me. We need to 'educate' the management about the perils of misconfiguration, default installs, etc.. Make them serious. I am already doing it. infact the management is very keen on security now. So you see, 'Education' is very important. >then again.... pure security chaps.... black or white are a great grey area... Security is not only about hiring a cracker and asking him to do penetration tests. Or hiring a consultant and asking him to redesign the network. It's also about awareness of the importance of security, right from the top management down to the data operators. Also security is an added responsibility of the existing admins, network enggs, users, etc. It is not a seperate job. Normal employees are responsible for security, not a consultant or an auditor. It is a shared responsibility.

Posted by
Codey

11 October 2002 @ 11 PM

mass usage=hopefully they would rework the whole jingbang someday or at least try and improve it over time.... no deployment=potential premature death of a promising technology... The points you made are very valid... but again the smartness factor overshadows all of them... till a few months back... our network with a block of 35 static ips on a really fat line.... had nothing by the name of NAT or a firewall... there were almost an equal no: of win98 machines allocated to those addies sans any protection on the net 24/7... this network is also on a WAN interconnecting almost 17 centers.... so if someone were to have broken in... the fun would have been incredible... the point being.... even in such a huge organisation... often the problem is not what the specs can do.... it is more a problem of what the admins do or can be assed enough to do... if i remember right.... most WLANs even now do not use standard encryption or authentication.. if you do not use it at 40bits..... there is almost no point in tweaking it upto to 256bits 'cause no one is going to use it...