UN Advised on Wireless Insecurity

otisaardvark writes "There's an article on the BBC about how the UN is being briefed on the problems of wireless networks. Predictable conclusions - security is mainly compromised through human, not technological factors."

Comments

It's like cellphones all over again

[wackybrit]

Back in the 80s you could buy a cellphone and then by using a scanner, could tune into the frequency used by the phone to intercept calls. If you were really clever, and had the right *cough* 'dodgy' software you could send control messages to the phone to activate the mouthpiece, so you can literally tap people.

Cellphones were new, and people just wanted them for the coolness/convenience factor and didn't realize the security ramifications.

In the corporate world there's a certain apathy to hackers. Many execs think.. 'No hacker would be interested in our data, it's just boring business stuff'. That may be so, but when the cops are sniffing your CEO downloading kiddy porn and some script kiddie has just deleted all of your mail, you will think again.

Wireless networks are similar to cellphones in this regard. Companies think they're cool and convenient, so they're hopping on the bandwagon.

So, we need to do what they did with cellphones. Digitally modulate the data over the wireless network and encrypt it within the hardware. Waiting for people to install their own security systems is futile. The manufacturers should make wireless devices encrypt on the fly, just like cellphones do.

This will benefit most companies, since they can dabble in inside trading, downloading warez, etc, and the Feds won't be able to track it, so it benefits everyone really.

Re:It's like cellphones all over again

[LostCluster]

It always seems to go that every new technology is designed to be a straightforward as possible at first, and we all realize that there's a need to encrypt for the sake of security.

Why doesn't anybody ever release the secure version in the first place?

Re:It's like cellphones all over again

[drinkypoo]

Let me take this a step further. It seems like it always turns out that IP traffic should have been encrypted. Why don't we encrypt all IP traffic to begin with?

This has been pointed out before by a zillion different people but some might be new to the thought; If all traffic were encrypted in the first place then we wouldn't ever have had all these problems with sniffing. Of course any packet sniffing you want to do would have to be done on the destination or the endpoint, so perhaps only the significant part of the payload should be encrypted while the control messages (at least those for handshaking) should be let alone.

If ALL traffic were encrypted the difficulty of intercepting "important" encrypted messages would go up and become much more difficult.

Re:It's like cellphones all over again

[DarkZero]

Why doesn't anybody ever release the secure version in the first place?

Why sell anyone the secure version when you can sell them the insecure version AND the secure version, in that order?

The danger of defaults...

[LostCluster]

Whenever any product ships with pre-set default passwords or settings, there is always a segment of the population who will plug it in, see that it's working, and walk away. When a user plugs in a WiFi router, it should require the user to either turn on WEP, or make the user very aware that using the router in its default mode allows any other WiFi device that comes within range to connect, and that includes people who you might not want to let in.

Some people actually want to provide free bandwidth to the community, and I can't blame them for that. However, users need to know when they set themselves up with no security, that will be interpreted by the world as an open invitation for the public to come on in. If you want to block that, enable some sort of security.

Tuned-in and turned-on

[Trane Francks]

Yeah, back in the late-'70s, I had a multi-band radio that could pick up cellular conversations. As a teenager back then, I had an absolute blast listening to calls. It was better than TV. And I promise you, covertly listening in to a hot call between a guy and his girl when you're 16 years old is pretty impressive stuff! :lol:

I never got into blue-box stuff, but pre-scrambled cellular was heaps of fun.

Just human factors?

[John Fulmer]

Last time I checked (and it's my job to) WEP and wireless security are still broken, as far as standards are concerned. 802.1x (PEAP, LEAP, whatever you want to call it) isn't appropriate in all (or even most, IMHO) situtations, and fixes to WEP like TKIP aren't widely deployed.

Wireless will continue to have security issues as long as the underlying security technology is broken and is hard to deploy in a secure, stable, and manageble fashion.

That's a technology factor in my book.

Re:Just human factors?

[LostCluster]

Even a flawed security method works better than broadcasting every bit in the clear. Missed patches mean nothing when we can't even convince people to turn it on in the first place.

802.11b can never be secure.

[skinfitz]

Predictable conclusions - security is mainly compromised through human, not technological factors.

Presumably this is referring to the human failing that was responsible for the flaws in 802.11b design? 802.11b simply *cannot* be made secure. Beacon frames are not encrypted, MAC addresses are not encrypted. Capture approx 1Gb of network traffic and you can decrypt the WEP key. Once you do that, you are in. There is little difference between the time needed to crack 40bit and 128bit WEP keys.

Do not deploy an 802.11b network in an environment where you would not fix cabled LAN ports to the outside of your building with flashing neon signs pointing to them with "PLUG IN HERE!" written on them.

Roll on a truly secure standard.

the major problem with wireless...

[MarvinMouse]

Is that it is so darned easy to listen into the communications. If you can listen in, and interfere with little effort, instantly many attacks become available to you, especially man in the middle attacks.

But, not only can you break into the network, most of the time, you can actively listen in, and just record everything until you get the encryption code in the future (which is actually a pretty easy thing to do with some social engineering.)

If you want the data to be secure use fiberglass wiring, it is the most secure, but if you want convinience, then you'll have to trade off some of the security in enchange for a easier system to use. It's really as simple as that. It's not the human factor, is the human desire for convinience that commonly leads to the largest security breaches.

Re:Why is it insecure

[John Fulmer]

>For example, are the data links insecure--I dont
>think so as most are now 128bit encrypted, right?

128-bit encryption without knowing the cryptographic algorithm used is meaningless as a definition of crypto strength, especially if the encryption is badly designed and broken; both of which are true for 128-bit WEP. Do a google search on it and you'll find the papers that describe the vulnerablility, and the tools to exploit it.

WEP is what hapens when non-crypto people design crypto.

Here's a starter link Look at the '802.11 Encryption" section

I'm no expert...

[Boss, Pointy Haired]

But surely if you want to provide wireless capabilities on your corporate network you put the access point in a DMZ and have users come in via a VPN, just as if they were working from home and connecting over the "public" Internet.

"Good enough" wireless?

[MacAndrew]

I'm using an 802.11b network with 128-bit encryption, meaningless passwords (not "admin" or "router"), and the WAP will recognize only the MAC of the portable (yes, that can be spoofed, but it keeps out random strangers). Finally, the access point is in the basement, so its reception zone is mostly up, not horizontal.

There could be specific weaknesses in my brands of hardware, but that's another problem.

Am I mistaken that this provides reasonably good security? I don't expect to screen out the NSA, but do most snoops. If not, can someone type up a checklist for the well-meaning but slight clueless 802.11 administrator?

Human error certainly includes misconfiguration, but if configuration is too hard for most people to understand I think it is the technology that is faulty -- human factors design and all that.

I'm glad they're making these weaknesses more public. Doonesbury did a good job in the Sunday strip a while ago.

Re:"Good enough" wireless?

[dsouth]

I'm using an 802.11b network with 128-bit encryption, meaningless passwords (not "admin" or "router"), and the WAP will recognize only the MAC of the portable (yes, that can be spoofed, but it keeps out random strangers). Finally, the access point is in the basement, so its reception zone is mostly up, not horizontal.

There could be specific weaknesses in my brands of hardware, but that's another problem.

Am I mistaken that this provides reasonably good security?

Short answer: Yes, you are mistaken.

Longer answers: Here, here, or here.

Assuming your neighbors are clueless luddites who have to call you when their printer runs out of paper, WEP will prevent them from borrowing you Internet uplink bandwidth. Against a determined attacker, WEP, MAC filtering, and most of the other features built into modern 802.11a/b APs are ineffective.

On the other hand, you may not care.

Eg, my home machines are all secured and I do regular audits and scans. Any sensitive communication (eg, logging into a machine at work) happens over ssh and so is protected. So the only thing a script kiddie can do is watch my web traffic (which he is welcome to do), borrow my bandwidth (which would probably be noticed, and maybe try DoSing my home network (which is easy to fix).

All of the above was also true when my home network was wired. The move to 802.11b just traded a decrease in security for an increase in convenence (ah, reading /. while sitting on the deck).

As Schneier has said, security just buys you time. In the case of 802.11 (or for that matter, any wireless protocol), it takes significantly less time for the security to be breached than it would if the wired protocol was in use. If that worries you, don't use 802.11 networking, cordless phones, or cell phones, or adjust the sensitivity of your traffic to suit the medium.

Re:"Good enough" wireless?

[Garin]

Security is about risk management, nothing more. Is it possible that some kid can break your connection? Yeah. Sure. Are they going to? I *seriously* doubt it. Why would they bother? To sniff your traffic? Ooooh. They'll see me reading slashdot. They may even get my slashdot password! Darn. They'll steal my Visa number! Um, nope, because that's over SSL. And my terminal connections are SSH. Email? Maybe, but I consider that a "public postcard" anyways, and I can and do use GPG when necessary. There is no traffic from my network that would make me a deliberate target of a snoop. Nobody would ever -plan- to hit my network and snoop my traffic or attack my boxes. Of course, if I was a business or had some kind of trade secrets, maybe they would (and this would change the situation).

So what does that leave? That leaves people who happen on my network at random, and decide to try to use it for access or for kicks.

Maybe your area is different, but in my neighbourhood, I can't drive more than half a block without finding a completely wide-open wireless lan. The usual density is much higher -- three or four to a block. And this is just me driving with my iBook propped open! Imagine if I actually used an external antenna! What does this mean? Nobody is going to go bother randomly cracking my network just to get bandwidth, when they can simply select another network and get it instantly.

The moral of the story? Consider your risks. I feel I have very little to risk: I have no "intellectual property" to protect, really. My email is essentially public anyhow. My boxes are up to date and as secure as they can be (I think). Wireless network has the benefit of amazing convenience. It is a small risk that I mitigate to an acceptable level. Therefore, it's a managed risk. That's all that matters in security.

Secure or insecure

[anarchima]

My favourite quote from the whole article:

"Wireless technology is going to be deployed across the globe either securely or insecurely" --David Black, Accenture

Now that doesn't seem obvious does it?