Slashdot Mirror
802.1X Security Overview
HJ Franzen writes "Ars Technica have what they call a wireless security blackpaper posted that's well worth a read. I wish this was available when I was spec'ing wireless VPN solutions for my campus. The article is pretty detailed and discusses the many ways in which companies are trying to address the fatal flaws in WEP."
The censorship is getting out of Control. Next week, Slashdot will join forces with the RIAA.
Many of you have noticed that CmdrTaco has changed a few things in Slashcode this week. The three changes I've observed so far are:
Karma displayed as an adjective
Karma score determines posting limit
Client IP addresses placed in readonly mode more easily
None of these are earth-shattering, so I'm going to cover them as a group.
Karma score determines posting limit:
Taco reminds everyone in this (non-archived) post that:
"KARMA DOES NOT MATTER". He goes on to prove this by making karma determine how many times you can post a day. Remember, you shouldn't use all caps, because caps is like being wrong. Here's a summary of how important karma actually is now, and while some of these details may be off, this reflects my best knowledge from reading Slashcode:
Karma: (PPD is posts per day)
26_50 : Post at 2, 25 PPD, Karma = Excellent
12_25 : Post at 1, 10 PPD, Karma = Good
1_12 : Post at 1, 10 PPD, Karma = Positive
Zero : Post at 1, 10 PPD, Karma = Neutral
-9_-1 : Post at 0, 2 PPD, Karma = Bad
-24_-10: Post at -1, 2 PPD, Karma = Terrible
Note that (as Taco points out) these are the default values in Slashcode atm; Slashdot itself may at any time be running with different values. Each IPID/SubnetId is allowed 10 AC posts per day, unless an IP is being 'abused', at which point things get more complicated. So the land of -1 trolling should be moving to threshold Zero, AC. Taco stated on IRC that the rate limiting change was made to prevent scripted crapflooding from -1 Accounts. I'd love to see a link to this crapflooding (I've never seen it) so if any of you have seen it, email me at operation_mongoose 'at' ziplip.com.
Karma adjectives:
Here's CmdrTaco's journal on the subject, and here's the non-archived discussion on the topic. Read it while you can, it will be deleted in two weeks. Taco states that he didn't just enable comments in his journal because he "didn't want people trolling his journal". Additionally, all the comments he made WRT to changes in the Karma system will be deleted. Make of this what you will.
Client IP addresses placed in readonly mode more easily
My details on this aren't very good, but as many have pointed out, the "readonly" error message seems to be popping up more often. The message is "You can't post to this page." and it appears when your IP address has been marked readonly. Basically, readonly mode means you're banned from posting anything, but you can still read the site. I think the only modification was one to the criteria for being placed in readonly mode, but I don't know exactly what the change is, only that pudge mentioned in IRC that he turned it up too high, and that now everything should be "Ok
That's it!!
Really! I'm enjoying my free broadband!
Just keep using it, everything is all right.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
how the current standard is broken, visit toms hardware:
/ in dex.html
http://www.tomshardware.com/network/02q3/020719
They've got some good information on why 64/40 and 128 bit encryption isn't enough; as well as why the current "consumer-level" equipment can't do enough to thwart drive-bys.
Karnal
... unless it's encrypted. Even then, your signal will be able to be recored and broken 10 years later when computers are faster.
I have a Zaurus SL-5500, and when using it with my 802.11b network, it doesn't seem to care about the SID.
It doesn't matter what name I use, it seems to always work. Has anyone else experienced this?
John
The drops of water don't know themselves to be a river; and yet the river flows.
I think this needs to be investigated
well, i'm sure glad to see that /. hasn't changed in the year or so i've not read it. some things in life just need to be stable. idiotic posts, mad nose-picking geeks, neo-fascists in charge of posting censorship, ass-licking dog-fucker michael still being his crackwhore self. ahhhh! the best htings in life ARE free.
/.: eat my rancid shit and die slowly in a fetid and reeking dumpster.
to all my good buddies at
Cutting and pasting in to KWord - changing the author to me-
"I've heard WinXP removed the cmd/command prompt."
No, Microsoft didn't remove the CMD.EXE or COMMAND.COM prompt from Windows XP. But Windows XP has reduced functionality, in many ways, not just in the command line. The command line is a big embarrassment because of its limited capabilities, but at least in Win 95 it worked. With every version since then it has worked less well. (There are two kinds of command prompt, and, according to Microsoft employees, the differences between them are not documented.)
The command line prompt sometimes begins to display short file names. Microsoft employees say that Microsoft has no fix, although someone not connected with Microsoft did make a work-around.
Cutting and pasting into a command line program often puts successive extra spaces before each line. Microsoft employees say that there is no plan to fix this.
The fast paste mode that is in Windows 98 is gone in Windows XP. Microsoft employees say there is no plan to fix this.
When using the command line interface, Windows XP doesn't always update the time. After several hours, the time reported to command line programs can be several hours in error.
There is a DOS program called START.EXE that can be used to start other programs. But it does operate the same way as in other versions of Windows. It starts a program, but cannot be made to return control to the command line program as previous versions did. There is no technical reason for this; it is just one of the shortcomings that are allowed to exist.
People often say that DOS has gone away. But Microsoft still calls the command line interface DOS, and in Windows XP Microsoft has added new programs for configuring the OS that work only under DOS.
Sometimes when you press a key while using Windows XP, it is seconds until there is any response. Apparently there is something wrong with the CPU scheduler in XP, because there are a lot of complaints about this in the forums and MS people have said that they are working on it. On one particular fresh installation of XP, on an Intel motherboard with either a Matrox G550 or an ATI Radeon video adapter, it requires 18 seconds to display a directory listing of 94 items. This is apparently related to a bug in the video software, not the adapter drivers.
Something is wrong with the Alt-Tab display of running programs under Windows XP. If there are a lot of programs, not all of them are displayed. The order jumps around in a seemingly random way.
Although articles often say negative things about Microsoft, I've never seen an article that fully documents how bad the situation really is. Microsoft's management is so bad that the company has become self-destructive. For example, Windows XP is spyware. Here is a list of ways Windows XP connects to Microsoft's servers:
- Application Layer Gateway Service (Requires server rights.)
- Fax Service
- File Signature Verification
- Generic Host Process for Win32 Services (Requires server rights.)
- Microsoft Application Error Reporting
- Microsoft Baseline Security Analyzer
- Microsoft Direct Play Voice Test
- Microsoft Help and Support Center
- Microsoft Help Center Hosting Server (Wants server rights.)
- Microsoft Management Console
- Microsoft Media Player (tells Microsoft the music you like)
- Microsoft Network Availability Test
- Microsoft Volume Shadow Copy Service
- MS DTC Console program
- Run DLL as an app
- Services and Controller app
- Time Service, sets the time on your computer from Microsoft's computer.
- Microsoft Office keeps a number in each file you create that identifies
your computer. Microsoft has never said why.
- Microsoft mouse software has reduced functionality until you let it connect
to Microsoft computers.
These are just the ones I know. There may be others.So, if you use Windows XP, your computer is dependent on Microsoft computers. That's bad, not only because you lose control over your possession, but because Microsoft produces buggy software and doesn't patch bugs quickly. For example, as of July 7, 2002, there are 18 unpatched security holes in Microsoft Internet Explorer. This is a terrible record for a company that has $40 billion in the bank. Obviously, with that kind of money, Microsoft could fix the bugs if it wanted to fix them. Since the bugs are very public and Microsoft has the money, it seems reasonable to suppose that top management at Microsoft has deliberately decided that the bugs should remain, at least for now.
It seems possible that there is a connection between all the bugs and the U.S. government's friendly treatment of Microsoft's law-breaking. The U.S. government's CIA and FBI and NSA departments spy on the entire world, and unpatched vulnerabilities in Microsoft software help spies.
Windows XP, and all current Windows operating systems, have a file called the registry in which configuration information is written. If this one (large, often fragmented) file becomes corrupted, the only way of recovering may be to re-format the hard drive, re-install the operating system, and then re-install and re-configure all the applications. The registry file is a single, very vulnerable, point of failure. Microsoft apparently designed it this way to provide copy protection. Since most entries in the registry are poorly documented or not documented, the registry effectively prevents control by the user.
Note that Microsoft does not support making functional complete backups under Windows XP. Look at Microsoft's policy about this: Q314828 Microsoft Policy on Disk Duplication of Windows XP Installation. Only those who work with Microsoft software will understand the true meaning of Microsoft's policy. Since almost all programs use the registry operating system file, if you cannot make a functional copy of the operating system you cannot make a functional copy of all your application installations and configurations. There are other software companies that try to fix this, but they don't work well, and Microsoft can, of course, break their implementations, as they have often done with other kinds of competitors.
Because the configuration information for the motherboard and the configuration information for the are mixed together in the registry file, the registry tends to prevent you from moving a hard drive to a computer with a different motherboard. That's another implication of the above Microsoft policy. So, if you have a motherboard failure, and a good complete backup, you may not be able to recover unless you have a spare computer with the same motherboard.
Note that Windows XP Professional can support only ten simultaneous incoming network connections. If you want more than that, you must use Windows 2000 server, and pay much, much more. (There is no Windows XP server yet.) Many businesses have very light network traffic; they just move files from staff member to staff member; they really don't need a dedicated server computer. The staff computers could easily handle the load except for this artificial limitation.
Apparently because the Windows XP GUI comes from Windows 98, Windows XP has the same problem with desktop icons that Windows 98 has. The icons sometimes flicker. Sometimes they move themselves around, particularly after the user switches monitor resolutions. Also, sometimes the taskbar settings un-configure themselves, as they do in Windows 98.
Only technically knowledgeable people know how to avoid signing up for a Microsoft Passport account during initial use of Windows XP. The name Passport gives an indication of Microsoft's thinking. A passport is a document issued by a sovereign nation. Without it, the nation's citizens cannot travel, and, if they leave, won't be allowed back in their own country. In Microsoft's corporate thinking, the company seems to be moving in the direction of believing that they own the user's computer. Most people are both honest and intimidated. Apparently about 95% do whatever they are asked on the screen. They give their personal information to Microsoft. They don't realize that, if they feel forced to get a Passport account, they should enter almost completely fictitious information, since the real question is not "What is your name and address", but "Can we invade your privacy". The honest answer to this is "No, you cannot invade my privacy", and the only effective way to communicate that is to give completely fictitious information. Since it is the educated people who have computers, Microsoft is building a database of the personal lives of educated people. Microsoft knows when they connect and from what IP address (which tends to show the area), what kind of help they ask, and information about what they are doing with their computers, including what music they like. It is not known, and there is no way to know, how much Microsoft or other organizations make use of this information, or their plans for future use.
Not only has Windows XP definitely gone further in the direction of allowing the user less control over his or her own machine, but with Palladium, Microsoft apparently intends to finish the job: Microsoft will have ultimate control over the user's computer and therefore all his or her data. Even now, under Windows XP, a recent security patch requires that the user agree to a contract that gives Microsoft administrator privileges over the user's computer. The contract says that if a user wants to patch his or her system against a bug which would allow an attack over the Internet, he or she must give Microsoft legal control over the computer. See this article also: Microsoft's Digital Rights Management-- A Little Deeper. You may need to be a lawyer to take apart the crucial sentence. "These security related updates may disable your ability to copy and/or play Secure Content and [my emphasis] use other software on your computer" legally includes this meaning: "These updates may disable your ability to use other software on your computer." Note that the term "security related updates" is meaningless to the user because the updates have no relation to user security. So, the sentence effectively means that Microsoft can control the user's computer without notice and whenever it wants. That kind of sentence is known in psychology as "testing the limits". If there is no strong public complaint about this, expect to see more and stronger language like this.
This Register article shows the direction Microsoft is going: MS Palladium protects IT vendors, not you. Absolute power corrupts absolutely, and Microsoft is well down that road. See this ZDNet article, also: MS: Why we can't trust your 'trustworthy' OS.
Microsoft's self-destructiveness does not mean that the user should be self-destructive. There is no need to apologize for using Microsoft software. The correct solution to abuse is persuading the abuser to stop being abusive. Once I posted to a Slashdot story a link to an article on a web site of mine. By far the majority of visitors from the Slashdot story used Microsoft operating systems. Rather than feel embarrassed because Microsoft is abusive, action needs to be taken to prevent the abuse. If you are against Microsoft abuse, you are not against Microsoft; you are more pro-Microsoft than Bill Gates.
These Microsoft policies mean that any government which wants to be independent of the United States government, and any government which represents itself as controlled by the people, cannot use Microsoft operating systems, or other Microsoft proprietary systems.
- posted by poopbot: who doesn't like scat?
foxsZmPsGl Post #294
Version 1.1
Note to moderators : Do not moderate this post down, if you do then you support the editors stance on censorship and you support the end of free speech and
support evil organisations like Microsoft, RIAA, MPAA and laws like the CBTBA and DMCA
Sign this petition, let your voice be heard!
Don't forget to repost this information!
Slashdot is using censorship! It is trying to eridicate free and open discussion like we know slashdot to be, it has the following RESTRICTIONS in place to Censor you
They claim they don't, but they do, wonder why their are so many trolls, crapflooders and lamers on slashdot, because they are fighting for their rights! Slashdot is trying to silence the trolls. Remove the filters, the trolls get bored, and slashdot will be troll free!
- Lameness filters (It blocks a lot of legitmate posts)
- Unnessary posting delays. Hasnt taco learned to touch type? A lot of posts are typed in less than 20 seconds and it is a ANNOYING DELAY! 2 minute ban? Come on, so some are faster then others, big deal, some people have more to say than others
- Broken moderation system, The whole point is to sort the gems from the crap, yet a lot of posts designed to make a LIVELY DISCUSSION are MODERATED as flamebait! Come on, not everyone likes X, but just because some one bashes it dosent mean its Flamebait. Flame bait is more useful for DIRECT INSULTS and not legitmate discussions.
The "troll" moderation reason is fragmented and broken, why? Because they are trying to use an obsolete usenet term on a realtime discussion, "trolls" can cover a huge blanket of ideas.- Crapfloods, a meaningless flood of random letters or text, which the lameness filter does a crappy job at trying to stop, besides trolls have written tools using the opensource slashcode to generate crapfloods which bypass the filter
- Links to offensive websites, the most common one is known a http://www.goatse.cx, a awful site which shows a bleeding anus being stretched on the front page. Trolls sneak these links in by posting messages that look legitimate, but infact are sneaky redirects to the site. Common examples include rd.yahoo.com, www.linux-kernel.tk, goatsex.cjb.net, and googles "Im feeling lucky".
- Trying to break slashdot, this is actually a good thing, as it helps test slashdot for bugs. Famous examples include the goatse.cx javascript pop-up, the pagewidening post and the browser crashing post!
Subnet banning, this bans a user unless they email jamie macarthy with their mp5ed ipids. This is unfair, and banning a subnet BLOCKS A WHOLE ISP SOMETIMES, and not that individual user! This can cause chaos! But real trolls use annoymous proxys to get around this so THIS JUST BANS LEGITMATE USERS!But, the issue that concerens us the most, is the COMMENT QUOTA. A discrimatory system that stiffles discussion, cripples the community and will ultimateley destroy slashdot unless it is removed! Annoymous cowards are allowed only 10 posts a day! This is unethical! Users with negative karma only get two! That is DISCRIMINATION! How would you like to only be able to speak once a day, just because of the color of your skin. That would be racism, and slashdot is discrimitating on people just because of a negative number in a database! BOYCOTT SLASHDOT! LET THEM DIE!
We wan't these stupid useless restrictions REMOVED! This comment will be posted again and again until it does!
Inportant imformation for users
Boycott slashdot, they are pissing over their community, they are becoming like the RIAA and MICROSOFT! Do NOT TOLERATE THIS SHIT! Here are some real news for nerds sites. We don't need slashdot, slashdot deserves to die!
MSNBC
BBC NEWS
News.com
Linux online
Linux daily news network
Weird news from dailyrotten.com
Trollaxor, news for trolls, they are real people too!
CNN.com
New york times (free registration required)
LINUX.com
News forge
K5
Mandrake forum
Toms hardware
The register
Kde dot news
The linux kernel Archives
There are hundreds more, But this is where slashdot STEALS THE MAJORITY OF its "news" from.
Punish them, here are their emails, spam them, flame them goatse them!
Rob malda
Jamie Macarthy
ChrisD
Hemos
The others ones apperantly dont have an e-mail, probably because ROB MALDA IS PRETENDING HE IS JOHN KATZ.
Thank you for reading this, please feel free to repost this information, please reply to add your comments, fight slashdot and its CENSORSHIP
The SSID should be created with the same rules as any strong password (long, non-meaningful strings of characters including letters, numbers and symbols).
By default the Access Point broadcasts the SSID every few seconds in what are known as 'Beacon Frames'. While this makes it easy for authorized users to find the correct network, it also makes it easy for unauthorized users to find the network name.
Can someone then explain to me what is the reason for choosing a secure SSID?
i use a little "consumer elvel" access point/router with DHCP turned off, and a strong subnet mask (i'm talking 29 bits!) then i filled up every IP address in the range by assiging multiple ip addresses to the adapter on my server
--fetch daddy's blue fright wig, i must be handsome when i release my rage
whats the difference between an encrypted ack packet and a non enc'd one from a sniffing point of view not a one..
any key you could possible be using will get exposed through these very well documented and standardized packets.
short of non-reversable encs like md5 it is basically impossible to protect data if you know the before enc and after enc data on a common packet.
even if they manage to enc say only data in a packet. a smart sniffer will realise that if he/she sends a standard packet with data to the ip hes trying to access that they can get the keys that way too. This changes the nature from a purely passive interception attack but none-the-less doesnt make it at all secure.
its been well known in military tactics for decades that no matter how you encrypt your data it will always be broken when its exposed to scruitany. Hell pgp can even easily be broken if you know the source doc before encryption and thats supposed to be one of the most secure encryption devices out there.
Add to this that with tcpip you'll always know the source I cant see how you're gonna encrypt the packets short of changing the way tcpip works.
If you're going to use wireless dont expect absolute privacy. This should never have been a concern. If you want security fork out the bucks for wired systems.
Transmitting any sensitive information over radio just doesnt make any sense and is the very reason for the extreme security measures taken by governments. For example in nuclear launch codes.... One time use of one code which has to be on the sub prior to it leaving dock. ol dubyah cant just call up some sub and say launch without the right one of these codes and for good reason.
As for unrestricted broadband access (connection sniffing/interjection) thats tougher. How do you keep someone who can know your keys off your system well you got two choices... You setup a custom algorithm that changes the keys on both the client and access point according to a certain time internally. At best a hacker will grab 3 or 4 of these keys but if they continually rotate around something that cant be standardized it would be very difficult short of knowing the algorithm used to change keys to get reliable access tho it would undoubtedly be possible given enough time to figgure out the deal with the algorithm.
Any way you look at it its gonna be security through obsfuscation and theres really nothing you can do about it. You want wireless you're gonnna have to accept the freeloaders on your service.
To me tho id encourage open access points to everyone. But then again im sure you dont want to get your cute little ip banned from your favorite channel. Maybe ipv6 could help with a translated address or such. i dunno but as it is now you cant block wireless access so why even try.
Note to moderators : Do not moderate this post down, if you do then you support the editors stance on censorship and you support the end of free speech and
support evil organisations like Microsoft, RIAA, MPAA and laws like the CBTBA and DMCA
Sign this petition, let your voice be heard!
Slashdot is using censorship! It is trying to eridicate free and open discussion like we know slashdot to be, it has the following RESTRICTIONS in place to Censor you
- Lameness filters (It blocks a lot of legitmate posts)
- Unnessary posting delays. Hasnt taco learned to touch type? A lot of posts are typed in less than 20 seconds and it is a ANNOYING DELAY! 2 minute ban? Come on, so some are faster then others, big deal, some people have more to say than others
- Broken moderation system, The whole point is to sort the gems from the crap, yet a lot of posts designed to make a LIVELY DISCUSSION are MODERATED as flamebait! Come on, not everyone likes X, but just because some one bashes it dosent mean its Flamebait. Flame bait is more useful for DIRECT INSULTS and not legitmate discussions.
The "troll" moderation reason is fragmented and broken, why? Because they are trying to use an obsolete usenet term on a realtime discussion, "trolls" can cover a huge blanket of ideas.- Crapfloods, a meaningless flood of random letters or text, which the lameness filter does a crappy job at trying to stop, besides trolls have written tools using the opensource slashcode to generate crapfloods which bypass the filter
- Links to offensive websites, the most common one is known a http://www.goatse.cx, a awful site which shows a bleeding anus being stretched on the front page. Trolls sneak these links in by posting messages that look legitimate, but infact are sneaky redirects to the site. Common examples include rd.yahoo.com, www.linux-kernel.tk, goatsex.cjb.net, and googles "Im feeling lucky".
- Trying to break slashdot, this is actually a good thing, as it helps test slashdot for bugs. Famous examples include the goatse.cx javascript pop-up, the pagewidening post and the browser crashing post!
Subnet banning, this bans a user unless they email jamie macarthy with their mp5ed ipids. This is unfair, and banning a subnet BLOCKS A WHOLE ISP SOMETIMES, and not that individual user! This can cause chaos! But real trolls use annoymous proxys to get around this so THIS JUST BANS LEGITMATE USERS!But, the issue that concerens us the most, is the COMMENT QUOTA. A discrimatory system that stiffles discussion, cripples the community and will ultimateley destroy slashdot unless it is removed!
We wan't these stupid useless restrictions REMOVED! This comment will be posted again and again until it does!
Inportant imformation for users
Boycott slashdot, they are pissing over their community, they are becoming like the RIAA and MICROSOFT! Do NOT TOLERATE THIS SHIT! Here are some real news for nerds sites.
MSNBC
BBC NEWS
News.com
Linux online
Linux daily news network
Weird news from dailyrotten.com
Trollaxor, news for trolls, they are real people too!
CNN.com
New york times (free registration required)
LINUX.com;
News forge
K5
Mandrake forum
Toms hardware
The register
Kde dot news
The linux kernel Archives
There are hundreds more, But this is where slashdot STEALS THE MAJORITY OF its "news" from.
Punish them, here are their emails, spam them, flame them goatse them!
Rob malda
Jamie Macarthy
ChrisD
Hemos
The others ones apperantly dont have an e-mail, probably because ROB MALDA IS PRETENDING HE IS JOHN KATZ.
Thank you for reading this, please feel free to repost this information, please reply to add your comments, fight slashdot and its CENSORSHIP
Are you trying to say I am the only one who has been hacking in to windows systems, applying patches, and beefing up security? I mean, the ends justify the means, right? Just don't be surprised if you leave your system on, leave the room, and come back to discover gentoo running on it....
I haven't read the aforementioned article, but I will check it out. My experiences may just say the same thing as they say (or maybe not). So sorry if this is repeated.
WEP is a joke unless you keep rekeying connection, which depending on how many packets you throw across the connection may or may not be realistically possible. (In many cases I'd guess not)
Choosing a secure SSID as someone mention won't get you very far if you're running in infrastructure mode since it broadcasts that. And if someone knows you have an AP then they can scan channel by channel until tcpdump picks something up and then you really don't need an SSID.
IPSec is a widely accessible protocol that gives the ability to encrypt communications and do authentication (in much the same way that ssh does it). IPSec is available on many platforms: Linux, Windows 2k/XP, BSD, (I think Mac OSX does), and most of them support it natively (ie no slow userspace daemons to run).
Using the authentication you can allow only authorized clients to connect, by allowing only IPSec packets through your router and then let IPSec do the rest. IPSec also does rekeying for the encryption so it's much safer than WEP.
Patrik
----------
Just your ordinary BOFH
http://killertux.org
For subscribers only?
I like to make PDF's of pages of particular interest for offline reading and archiving should they ever go offline.
I usually click the printer friendly version if they have one, print it to a file, which gives me a postscript file within Linux, then using the a tool that come with ghostscript (?) "ps2pdf" the file. It usually comes out very nice.
But with Ars, I prefer to just grab the article with wget, since they don't seem to offer a printer friendly version outside of a subscribers only PDF file. Anyone subscribed? Free?
Course, now I have OS X, I just print preview then save to PDF.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
in my town there are so many (mostly linksys) AP's that use the default SSID that I could practically drive arround and hit the internet from anywhere. It would be interesting to compromise a machine across the internet while connected to someone else's AP... the deleting of your logs is basically driving home.
- what is the definition of simultanagnosia?! I've been meaning to look it up!
There will always be people willing to break the encryption no matter what the costs in time, and technology. If you wanted access to my Internet connection through my 802.11 (without physically breaking into my home), you could get it eventually. But I can make it difficult for you, and that is the point.
Encryption was never to prevent information from being intercepted. It was never to stop data from being read. It was to delay. It comes back to the simple question - how important is the security of your network/data?
That what was all this school was for... to teach us how to solve our own problems. -- janeowit
ok i know the last one was that "infamous" M$ paper, but could someone give me a "color chart" as to define all these different papers that i'm seeing more and more often posted on slashdot?
moox. for a new generation.
But who will want your 10-years old porn collection or DIVX rips?
The joke here is that ars has published an aritcle that has useful technical information, but their website has a black background with white text. Therefore, this is a black paper.
I don't want free as in beer. I just want free beer.
Blackpaper? That's a kewl term I haven't heard before. I suppose it's a paper in response to a white paper showing the dark side of a technology?
M@
Krispy Cream is people
Security is only one issue that needs to be considered in implementing wireless networking. We identified three key issues in developing a wireless strategy: (1) security that was "good enough", (2) end-user simplicity, and (3) technical staff set-up and management.
We eventually decided to use Nathan Zorn's Authentication Gateway. Wireless connections are blocked at the gateway until users connect via ssh. Clients need to have ssh and know the name of the gateway: everything else gets configured automatically. The system uses iptables, PAM, and ssh and the only admininstration required is to build accounts. The system might not scale well, but works well for an entity our size (one department).
I gave a presentation about our conclusions.
There was a mention of using a VPN scheme to secure your wireless LAN, which would be fine to protect your own data but still allows 'visitors' to piggyback their own networks on top of yours. This still allows the 'visitor' to take an IP address from your DHCP server and talk to the other machines.
This thought might not solve the piggyback problem but it might go a step further in securing your data. Use a PPPoE server (such as a Win2K box running RASPPPoE) to hand out network addresses and require all your clients to connect using some form of PPPoE (again, such as RASPPPoE) which can be reasonably protected using MD5 CHAP for passwords and encrypted packets.
The only thing exposed then are MAC addresses, so 'visitors' could still piggyback their own network on top of yours, but they're not taking up IP addresses or able to see *anything* on your network except other MAC addresses.
And if you wanted to be really smart you could have a probe program (too bad one doesn't exist yet) that could compare a MAC address to a matching PPPoE connection, say every ten minutes. If a MAC address doesn't have a corresponding PPPoE connection, it's blacklisted for a while and the port is freed for a legitimate client.
Use Evolution instead of Outlook? Bewa
The only major objection I have is that Ars is presenting some WEP problems as being RC4 problems ie: that RC4 is broken and cannot be secure if implemented properly. "The main problem with WEP is that the RC4 stream cipher used to encrypt the data has been proven insecure." I'd change that to read ".. has been proven insecure if research notes regarding these problems are ignored."
They claim the RC4 algorithm itself is broken, which it is to some degree, but there's lots of information on how to avoid these problems that was available prior to the design of WEP. I also dislike their implication that RC4 inherently uses a 24 bit IV, that was an IEEE decision, RC4 can use an IV that's as large as you want.
RC4 is reasonably secure when implemented correctly, but IEEE ignored the very well known and clearly stated fact that when using RC4, keys must not be re-used for the same data. And that's not surprising, block ciphers are greatly weakened by such things too, which is why anyone in their right mind uses a decent sized IV. RC4 is weaker to key reuse than block ciphers because of its design, but that was a well known fact prior to the design of WEP.
Weak keys are a genuine weakness in RC4. However, they too are well documented and can be easily detected and skipped prior to use. The fact that WEP uses a 24bit IV makes it particularly easy to create a table of IVs that weak, making this problem significantly worse. A great paper on RC4's weak keys, and how to avoid the problem, was posted to sci.crypt in 1995:
http://marcel.wanda.ch/Archive/WeakKeys.txt
So all the weaknesses in WEP that stem from the use of RC4 as an encryption algorithm were well documented, and methods of avoiding them resulting in weaknesses were well known, but the IEEE chose not to heed them. They were trying to make something "secure enough" and traded off things like using a short IV without consulting the cryptographic community about the implications.
Hindsight is 20-20, but I can't exactly call these RC4 flaws. I mean, if you had a power tool and you ignored the warnings printed in the manual, would you blame the tool when it fails?
Using a short IV is clearly an implementation flaw, the fault of WEP not RC4. IEEE wanted to save a few bytes of overhead and purposefuly chose a short IV. The weak keys are a flaw in RC4, but just generating a few bytes and discarding prior to using the key helps reduce the scope of this attack dramaticly. Even better is to detect and avoid the use of the weak keys in the first place, or do both. Since this was widely known when WEP was designed, I consider it to be a implementation flaw in WEP as well, albeit one that stems from a weakness in RC4.
-Matt
In other news, a consortium of large companies has announced that they have developed a building material that spray paint cannot adhere to. This should help companies that can not or will not secure their networks protect themselves from the insiduous threats of wardriving and warpainting. More news at 11.
The article seems very intent on proving that every possibility is flawed. However I wonder about their VPN reasoning. They exude that using VPN's you can still let "crackers" talk and communicate using your WAP. But why would anyone go to the trouble of hacking into a WAP, just to essentially use ad-hoc mode on their wireless cards?
Bueller?
Bueller?
1. Authentication comes before association, not the other way around as the article mentioned. Authentication was not added in 802.11b it was there in the original 802.11 spec.
:)
2. Decryption takes no longer with 128 bit wep than it does with 64bit wep. This depends on the actual RC4 implementation, but anyone who implemented RC4 in a way that it takes twice as long to crypt a 128bit string than it does to do 64 bits doesn't know what they are doing. Most implementations use a lookup table that makes encryption take the same amount of time regardless of key length. I'm no encryption expert, but I believe that all symetric algorithms share this attribute. It certainly won't "drastically shrink useable bandwidth" unless you have a very lame access point or 802.11 card. I don't believe any implementation will reduce the bandwidth at all by using 128 bit encryption.
3. Turning off beacon frames breaks some important 802.11 features, such as power management support. What most vendors do is not disable sending beacons, but they lie about the ssid (or leave it blank) in the beacons, and only respond to probe requests if the client request the correct ssid in the probe.
4. Turning off or hiding the ssid gives you no security whatsoever. All it does is keep the casual person from seeing your network. Any form of WEP will work better than that, because the casual user won't be able to exchange data packets on your network. The professional cracker will not be slowed down at all by hiding the ssid, all it takes is a sniffer to listen for a probe request/response which contains the actual ssid. Anyone who thinks they are securing their network in this way is deluding themselves.
5. I won't repeat the comments previously made about the authors incorrect understanding of how RC4 works, and why it is exploitable in this implementation.
After I finish reading the parts on 802.1x maybe I'll add to this list.
- Access to other attackers in your group over the wireless.
- Access to legitimate clients.
As you point out, the former isn't really a super big deal. The latter, however, means that the attacker can probe legitimate clients on the same WLAN, find a weakness in one, and gain access to that box. Once an attacker has access to a legit client, I'm sure you can see the way forward.When you say something like 802.1X and you mean all wireless, you are showing ignorance.
802.1 encompasses a large number of wired standards in addition to wireless.
Or maybe the poster meant the actual standard named 802.1x? Port Based Network Access Control? I thought that was used for tying switch ports to certain MAC addresses.
I propose if you mean to say "all the 802.11 standards" you say 802.11*, since IEEE uses letters such as "x" to denote certain standards, not as a wildcard.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
The whole article is a bit silly, pushing relatively unproven standards (EAP) which have been extended (LEAP) and extended (PEAP) over VPN standards with a good trackrecord (IPSEC).
The client is always the weakest link, for both VPN and wireless access. Basically, the author's argument boils down to saying that most IPSEC clients do not block access from other clients while they are connected (split tunneling), whereas the [LP]EAP clients do.
It's a matter of configuration. There is no way one can claim that one client is more secure that the other. Clients are always unsafe, and if not, its user is :-). I'm sure a determined recalcitrant enduser can always hack his [LP]EAP client to enable split tunneling, or other unsafe settings.
The only way to fix this (for both VPN and wireless) is to supply the user with trusted hardware. But that would mean a lot of money and a revolt of endusers because their PCs will be taken away...
By the way, here's an article by Microsoft on this matter. It basically says that Microsoft will solve all your problems if only you would buy into the latest Microsoft offerings.
Would you rather use a solution based on open standards, try Wavesec. It is mostly based on IPSEC, DHCP and DDNS.
-------
Warning: Slashdot may contain traces of nuts.
chops and chekhov are right, and the (currently +4!)comment they're replying to is wrong.
All the block ciphers in PGP, like IDEA, CAST and so on have (so far) survived cryptanalysis based on known plaintext attacks. In fact, a cipher is considered "cracked" in the academic sense if the key can be retrieved with *chosen* plaintext in less time than by searching all possible keys.
The "black paper" makes this conclusion about shared-secret authentication as part of association:
"By passively listening to the conversation, an attacker can obtain two of the three variables in the authentication equation; the clear text challenge string and what the challenge string looks like after it has been encrypted. By plugging these values into the RC4 equations, the attacker can easily solve for the shared authentication key. "
Actually, this is not what their referenced whitepaper describes at all. By observing the authentication sequence, an attacker can forge an authentication by responding correctly to the challenge without knowing the WEP key. This is made possible by the amateur 802.11b authentication scheme, not because RC4 is easily 'solved'.
So, while the shared secret authentication does not hinder a determined attack, it is incorrect to say that it weakens security at all. In the case of unenthusiastic stumblers, it may hinder casual associations with your AP.
To recommend an "open authentication" scheme for improved security seems like bad advice.
Apparently "blackpaper" means "white text on a black background".
Please - this is one fad from the '90s that deserves to die, quickly.
I've been thinking of hacking together a somewhat simple system that would randomly generate WEP keys, use tcl/expect/perl-expect whatever to control lynx-ssl to connect to my AP, set up a new WEP key on the AP (it can have multiple keys), then ssh to my laptops and change the wep keys on them.
One could easily write small scripts for whatever AP or system you wanted to reconfig, assuming you can do 'em from a command line.
Comments?
-- I speak only for myself.