Hacking Wireless 802.11b Nets

John Higgins writes "The Wall Street Journal has a great article on my greatest worries about setting up a wireless network in my home. White hatter Peter Shipley and Matt Peterson of, among other things, the Bay Area Wireless User Group, drove the reporter around the valley with some rudimentary equipment to find how many corporate networks they could "see" from the street or parking lot. (Sun Micro, check your encryption!) Call me a techie lightweight, but it looks like HPNA2 for me!"

Comments

Re:What the hell's going on around here?

[Anonymous Coward]

I did notice this, too.

And guess what? Today, i got 5 mod points, used 'em up (careful not to overrate crap, since i noticed all the +5's), and then i got 5 more points!

Maybe the number of mod points was increased. By someone, or something.

answer

[Anonymous Coward]

Anonymous Coward
[ Preferences ]

You have moderator access
and 49,523 points. Welcome
to the those of you just
joining: please read the
moderator guidelines for
instructions.

(updated 9.9!)

Don't make me -5 your ass

Hacking wireless networks

[Anonymous Coward]

Hello. I might be considered an "insider" in this field. I work at a semi-large ISP where we provide wireless connectivity using BreezeCom network equiptment. Employing large (from 9-24 inch) antennas, and uni-and omni-directional antennas mounted on prominent structures, we are able to send up to 3Mb/s to hosts.

The security here is terrible. We use no authentication via radius or any other method. Anyone with a 802.11 network card, and a sufficient antenna could steal connectivity, and we could not currently tell.

There exists ways to detect this, by monitering the MAC addresses connecting to the APs on the towers, but this is not employed. Neither is each radio catalogued, and IPs, for the most part, are assigned by the DHCP server with no logging.

I do not know if this is typical of most wireless companies, but if it is, then things should be ripe for the taking. I'm posting anonymously, because my company has a history of firing and suing for less.

Re:Hacking wireless networks

[tzanger]

Knowing what I know, I would treat every wireless network as if ALL the traffic was being transmitted over a hostile network.

Exactly. Which is why our access point is outside the firewall and wireless guys need to use the VPN to get into the network just like the telecommuters. There is no such thing as wired equivalency.

Re:Hacking wireless networks

[ByTor-2112]

You really need to read the papers on the attacks. 128-bit encrpytion and 56-bit encryption are both just as susceptible to attacking. MAC addresses are NOT encrypted IIRC and I can steal one of those when your client is down. One potential attack is to send a packet of known content from the Internet TO your network. Then I grab the encrypted packet, and I can XOR out a piece of the cipher stream and (because the way this 802.11b works) I am able to identify future packets that use this piece of the stream and decrpyt them. Other statistical attacks allow me to, over time, build up a database that will allow me to decrypt everything on your network. The more traffic you send, the faster this happens. Knowing what I know, I would treat every wireless network as if ALL the traffic was being transmitted over a hostile network.

Sun's 'testing'

[Anonymous Coward]

If this was at Sun's Santa Clara campus, this was definitely not testing. There are several rogue wireless stations there. These are connected to the iPlanet network rather than Sun's main network, though.

Still, Sun's network is extrememly insecure in so many ways, especially internally. Getting to be an internal user is simple, with wireless and DHCP.

The SA's are pretty much powerless to secure the network, as well. Sun's red tape binds their hands. Get fired for securing the network? You bet! Go Sun!

Forget about actively looking for them..

[DeadBeef]

I have been in a situation with an aironet network where I have flushed the SSID and wep key of the card, and noticed while flicking bettween consoles that there was traffic from another network floating past. This is with a little ( quite directional ) parabolic grid antennae facing about half way bettween two of our own sites.

As these cards get cheaper and more people use them, the fixed set of frequency's that the frequency hopping cards use are going to become more and more useless with high gain aerials.

Even without the security implications, each site within 'earshot' are going to end up sharing the realistic 500k/s or so that the 11 megabit cards provide.

Found on the printer

[iabervon]

What looks like a quick paint program scrawl of the words "secure me".

Re:Encryption

[Chris_Pugrud]

The hurdle that prevents people from using encryption and good security is time and knowledge. It took a lot of effort to get WEP turned on where I work because an understaffed IT department had to do it.

The funny part is we use 3DES hardware VPN devices for PTP T1 lines, but that is done by another department that has the time and materials to implement strong security. And they wonder why we don't trust the corporate network?

Tapping unencrypted lines is easy, one of our security people was trained in tapping fiber cables by DOD in '83. Ask how many people think that their private fiber links are truly secure?

Rather than patching together PGP/GPG, SSL, and SSH, I would strongly recommend you spend your efforts implementing IPSEC instead.

Chris

AUGH!

[schon]

Require SSH2 tunnels

Augh! NO! NO!

SSH is a good protocol for secure terminal sessions, but you should never, never use it for tunneling, unless you're fond of session-timeouts and stalled connections.

SSH uses TCP, which means it's the worst protocol you can use for a tunnel... TCP guarantees the reliability of the connection - so a dropped packet can wreak havok.. the tunnel will stop and re-transmit the packet - so every other TCP connection will stall - and guess what? These stalled connections think their packets have been lost, so they retransmit their 'lost' packets - resulting in LOTS of duplicat packets.. (and if the 'original' packet was lost due to congestion, you can guess that you're gonna start flooding the tunnel - a cascade failure.)

A more technical description is available at
http://sites.inka.de/sites/bigred/devel/tcp-tcp.ht ml

Unless you can guarantee that your network will never drop a packet, you need to use an unreliable protocol for the tunnel (think GRE - that's what it was designed for - but even UDP would be a better choice.)

Airport

[Valdrax]

What, you mean people aren't using Apple's Airport with it's robust, secure 40-bit encryption scheme to protect all their traffic? Darn PC users.

(Burn, karma, burn...)

Re:Lock onto mac-addresses

[Raetsel]

Nice idea, but there's one small problem...

The authorized devices using the network are broadcasting their MAC addresses!!

This so very much reminds me of the well-known 'trick' of cloning a cell phone... sit somewhere where there are LOTS of targets, and just record the ESN/SID (or, in the case of 802.11b, the MAC address), program your own device, and off you go!

I still like the idea of VPN tunneling over the wireless segment. Yes, use the hardware safeguards, but don't trust them. Require SSH2 tunnels, perhaps using PGP-style public/private keysets to make things 'easier.' Of course, this opens up the problem of a stolen laptop compromising the network... but I never said this was a perfect world.

How secure are they really?

[NetJunkie]

Has anyone ever seen a test done with someone sitting in a parking lot attacking the 802.11b encryption? We've had several articles here on /. talking about how insecure the encryption MAY be, but no one has done any real tests yet.

Now for this article. Duh. These admins should be fired. I run 802.11b at my house with full encryption and other security features on. I wouldn't let an access point in this building without securing it first. This isn't a technology problem, it's a human problem. These are probably the same people that don't patch up to the security holes and wonder why they get hacked two years later.

To make it easier, there needs to be a good key exchange mechanism. People that don't put much thought in to security don't want the "hassle" of manually entering keys on everyone's notebooks. I wonder how long before there are web pages with key listings for companies and longitude/latitude locations....

What we do

[Twid]

Where I work, we have the whole building in San Jose set up for wireless. The way we approach security is that the wireless network is on the public internet outside the internal firewall (not on the DMZ, the wireless are completely outside).

So, in order to get to internal data while on wireless you must start up a VPN client or go through our portal. This isn't a perfect solution, people still get free bandwidth if they want, but at least they can't get to internal data.

Also, we have most of the wireless access points in public conference rooms, and a couple of them have been stolen!

- Twid

Re:Lock onto mac-addresses

[taniwha]

Of course people could start guessing MAC

Umm --- a sniffer will give you these pretty easily .....

Re:I like the idea, but..

[L-Train8]

This isn't even "non-damaging probes on networks". This is networks broadcasting information to anyone in the vicinity with a laptop and a wireless network card. If you are shouting on a street corner, is it a crime for me to hear you?

Re:Simple Security...

[0xA]

For a network running Microsoft software, taking common steps such as ensuring Guest access is disabled and that passwords are required for all resources will do the job.

Password protecting resorces isn't going to do any good at all. If you read the article it is clear that these guys are running some king of packet sniffer.

"There -- someone just turned on an NT machine and is getting mail."

There is no way to know this unless you have are collecting and looking at packets on the network. Unless all traffic on the wireless segment is encrypted you will have NO security on that segment.

I love MSNBC's editorial ethics...

[catseye_95051]

Have you ever noticed what stories they "indepndantly" choose to run?

Hackers hacking Sun (can you say MS-massive-security-breah-damage-control?)

Any whiff of PS2 trouble.

Pro MS anti=truat case articles.

And so on and so forth.

NBC should be ashamed they have their name associated with what is clearly just another MS publicity arm.

Tunneling over a reliable connection

[sigwinch]

You are right for conventional PPP-over-SSH-over-TCP tunneling, but there is still hope for tunneling over TCP.

If the tunneled connections don't do retransmission themselves, you can just carefully design the tunneling protocol to be very nonagressive about retransmissions. E.g., ask "did you get that" instead of retransmitting the whole packet, and using a steeper-than-TCP exponentional delay function.

And if you have to tunnel TCP over TCP, the tunneler could inspect packets, detect when the tunneled TCP is retransmitting, and simply drop the retransmission on the floor. This is just a tiny step beyond NAT. Of course, if you're tunneling arbitrary reliable protocols, you're screwed. (Although I suppose you could blindy bandwidth limit the tunneled protocol by dropping packets. If you did this agressively enough, the tunneled protocol could be convinced to sufficiently rate limit itself.)

Incidentally, I've been thinking about this because sometimes you don't have a choice about what kind of connection to use. Sometimes you are provided with an arbitrary stream-oriented, possibly reliable, connection and have to make do.

BTW, thanks for the link to the TCP-TCP web page. I can point people at that instead of explaining...

Re:I like the idea, but..

[fleener]

Huh, and this is different from flying an EP-3 surveillance plane off the coast of China how?

If you're spewing stray radio waves all over the place, whose fault is that? Is it your job to control your communications or our job to keep our ears shut?

Sun and security

[vsync64]

I worked at Sun fairly recently, and I have to say that their security is nothing short of pathetic. I don't want to seriously jeopardize their operations (although it's sadly obvious that they don't need me to do that), so I won't go into much detail, but:

• There is no NAT. Any connections to the outside world go through application-based proxy servers, and if one is lucky and the server is up, SOCKS. This is not in itself a problem (except for the system's hopeless obsolescence and inconvenience), but it encourages (I would almost say forces) employees to find less than official means of getting to the outside world in order to do their jobs.
• No one I met had even heard of SSH. No one. All internal connexions take place over RPC, and most people have .rhosts file with at least "+ <user>" in it.
• Everyone leaves their X server wide open. xhost + is everyone's first action ("xauth? what?"), and I was shocked to see a security manual put out by Sun say "In order to start this GUI security tool, you will need to run the command xhost +.".
• Servers were always going down, badly enough that I moved my home directory, mail, and all related files and services to my local machine. Even in instances where a proper security policy might exist, I have doubts that it would last for long.

There are other gaping holes which I feel it would be completely unfair to post in any level of detail, but suffice it to say SWAN is riddled with holes waiting to be exploited, and I hope someone decides to do something about it before a h4x0r realizes how easy it would be to own all of it.

--

I like the idea, but..

[proxima]

These guys in the end are doing these companies a service by exposing blatant security holes and embarrassing them. However, they're also itching for a lawsuit. I know most people on /. don't see anything wrong with non-damaging probes on networks, but a law doesn't even have to be violated to win a lawsuit. Any one of these companies (especially the bigger ones) could perhaps win a lawsuit against these guys for using (stealing) their network resources without permission.

However, I believe three major things will keep most companies from prosecuting these guys.

1.) They are embarrassed enough already, and a court case will only embarrass a computer company more (Sun with an insecure network, that looks real good).

2. A lot of Silicon Valley comapnies are running out of cash.

3. The only thing the companies have to gain is deterring others from pulling the same stunt (and tattling about it later).

Encryption

[RuneB]

Why do people find it difficult to use encryption over the networks they use? A person should assume that any un-encrypted traffic over any network could be easily monitored by someone with the right equipment, and relying on the security of every machine along a route is dangerous.

IMHO, saying that encrypting traffic is too much effort is no longer a valid excuse, now that tools such as ssh, PGP/GPG, and SSL are in wide use. In fact, OpenSSH now supports dynamic port forwarding with socks support; which can allow transparent encryption of traffic.

So, what is the hurdle that prevents people from using the tools available to encrypt their traffic?

Peeking at unencrypted networks...

[ackthpt]

"This looks like a good place to work, oh, wait, was that a layoff list I just saw go over to HR?"

--

Broadcasting Network Names

[fahrvergnugen]

After reading the article, it sounds to me like they're cruising around, looking for wireless LAN's that identify themselves.

By default, a wireless base station will broadcast the SSID of the wireless network of which it is part, and wireless LAN cards can join the network without already knowing the SSID of the network.

One of the simplest security practices is to turn off SSID identification broadcast at the base station. Then the wireless user has to know the name of the network in order to connect. Unfortunately, this quickly becomes a gigantic pain in the ass for the admins of the network, because who wants to go through and change the SSID every time you add a new wireless base? It's really practical only for small organizations.

Mind you, I'm sure this could be fairly easily intercepted from traffic between a user and a base station, but it's a start down the road towards hiding your wireless LAN.

WEP encryption has been proven to be an easily circumvented technology (as reported on /. once upon a time), as has this lack of SSID broadcast, but it's a start. The best bet for true security is to implement a VPN over your wireless LAN, or just treat your wireless zone as a DMZ.

Use encryption you can trust

[mendepie]

I am currently using 802.11b a good bit, and have come up with a solution that I am happy with. I setup filtering to disallow any access from the 802.11 interface except to ssh. I then use ppp over ssh to connect. I have setup my laptop to do this when it brings the interface up. I would like to do IPsec, but I have not spent enough time to get it working.

Wireless security is an iffy proposition at best

[hillct]

I've now worked with wireless network equipment from Cisco, Motorola, and Nortel Networks. I've found that none perform particularly well when using the Wired Equivelency Protocol (WEP) for security, although there aren't a whole lot of other options out there at preasant. Many companies rely simply on the uniqueness of the SSID used within their wireless lan. Some restrict access by MAC address. None of these methods are particularly secure. The only one that suggests making an effort at security is use of WEP.

There was a previous discussion on Slashdot about issues with the security of WEP. The articles out there on security holes in WEP are too numerous to list here.

What scares me most is the sheer lack of concern expressed by many network engineers, with regard to wireless. I've heard many times now, variants on "It's a wireless network. It's insecure by definition so why even make an attempt to secure it." Scary.

--CTH

---

Re:Wireless security is an iffy proposition at bes

[hillct]

Here's the berkeley study on WEP security:
http://www.isaac.cs.berkeley.edu/isaac/wep-faq.htm l
---

The reality of clueless sysadmins

[david_bonn]

Now for this article. Duh. These admins should be fired. I run 802.11b at my house with full encryption and other security features on. I wouldn't let an access point in this building without securing it first. This isn't a technology problem, it's a human problem. These are probably the same people that don't patch up to the security holes and wonder why they get hacked two years later.

I'll bet those sysadmins would be very surprised to discover that the 802.1b access points were even on their networks. This stuff is too cheap and bone-head easy to install. Apparently a lot of consultants of various types like to pack them around with their laptops so they don't have to futz with network cables whereever they happen to be working that day.

... and to think of it another way, if you were a bad guy this is a pretty awesome way to put a tap on someone's entire network without their knowledge. Sometimes it seems to me that wireless LANs were invented by either law enforcement agencies or spies. Or both -- maybe they're in cahoots.

This isn't merely a clue problem. There is a control problem as well.

It may be deliberate.

[Zeinfeld]

The security in 802.11b is worse than useless, it claims a degree of security it does not provide. That is why most large corporations deploying 802.11b don't rely on WEP, they use IPSEC or PTPP to add security that was not broken at birth. Go to Redmond washington and every MSFT conference room has IEEE802.11b, but they don't use WEP.

Driving arround town there are a lot of 802.11b networks that are left open on purpose. I could care less about someone sending bits over my broadband pipe. Media one might mind but that is a different matter.

If it wasn't for the fact that if I did leave the access point open someone like the author of the article would be bound to post the fact on the net as 'security expert hacked' I would have no problems leaving it open. My internal systems are all behind a firewall in any case.

You would think...

[JohnnyKnoxville]

A company as large and as technically inclined as Sun Microsystems might investigate this type of thing before going ahead and implementing this type of network.