Slashdot Mirror
802.11 Security
With the amazing proliferation of wireless networks these days, there seems to be constant churning about how best to secure them, while at the very same time, barely anybody is actually doing anything about it. Potter and Fleck have offered up this little book, 802.11 Security, as a no-nonsense guide to understanding the problem of wireless networking security (or, as the case may be, the complete lack thereof) as well as demonstrating how to implement viable solutions.
Straight from the horse's mouth, "This book is aimed at network engineers, security engineers, systems administrators or general hobbyists interested in deploying secure 802.11b-based systems." The greatest attention is given to Linux and FreeBSD systems, though OpenBSD, Mac OS X and Windows are covered as client systems, too. The authors split the book into four parts: "802.11 Security Basics (Part I)," "Station Security (Part II)," "Access Point Security (Part III)," and "Gateway Security (Part IV)."
Part I, "Security Basics," gives a very good introduction to the concepts of wireless communications. Chapter 1 explains how radio transmissions work (and how antenna shapes affect them), and why radio transmissions are inherently insecure (i.e., anyone with an antenna in range can listen in). 802.11 is explained, as well as WEP, and WEP's problems. Chapter 2 describes in detail the risks involved with wireless networking, and gives examples of types of attacks which can be performed against wireless networks.
Part II, "Station Security," outlines in great detail what you need to do to make sure your wireless network clients are as secure as possible. We're given two goals for client station security: prevent any access to the client systems, and make sure that the clients speak secure protocols for any network services they access. To the paranoid, both these goals are rather obvious, but they're important enough that the authors spent time explaining them. They follow with a couple paragraphs on logging and security updates on the client systems, and the rest of Part II (Chapters 4 through 8) give specific information on how to best secure client systems of various OSes.
Part III (Chapter 9, really), "Setting Up an Access Point," delves into the intricacies of setting up and securing a wireless access point, from generic advice on how to configure access point appliances to more specific instructions on configuring host-based access points running Linux, FreeBSD and OpenBSD. Comparatively little time is spent on host-based access points in the book, probably because most people generally don't do things things way since access point appliances are so cheap and simple to configure/install.
The remainder of the book is spent on Part IV, "Gateway Security" (Chapters 10 through 15), which describes the infrastructure end of how most wireless networks will likely end up being integrated to wired networks. Basic suggestions for structuring the combined networks are given, and follow what I'd consider to be really good advice: wireless networks should be on their own interface of the gateway (or firewall), physically separated from both internal networks and the Internet. The authors strongly recommend against simply attaching the access points to the internal network, as that introduces too many security risks (an example involving ARP poisoning is given to illustrate why and how). The next three chapters detail the configuration of Linux, FreeBSD and OpenBSD as a secure gateway.
Chapter 14, "Authentication and Encryption", introduces the idea of using strong authentication and encryption mechanisms outside of WEP, using NoCat (which will run on Linux, FreeBSD and OpenBSD) and WiCap (for OpenBSD only) for authentication and IPSec for strong encryption. The idea the authors present here is that for the most secure setup, in addition to enabling strong WEP (as detailed in the rest of the book), your wireless network is set up to not allow clients access to anything until they are authenticated. Then, and only then, the gateway will allow wireless clients to access other network segments (i.e., the internal LAN, and/or the Internet), but only if all the communications over the wireless segment are done through secure tunnels. Sadly, the authors neglected to mention OpenBSD's, Windows 2000's or XP's ability to do IPSec, and their treatment of IPSec for FreeBSD and Linux certainly isn't very detailed, though pointers are given to the appropriate web sites for more information. 802.1x authentication (physical port authentication) is also explained in some detail, though it is of little use, since very little equipment deployed today has support for it. It is an interesting concept, though.
Closing out the book, Chapter 15 is appropriately titled "Putting It All Together." Here we get a final overview of all the pieces as well as how they fit together, and how certain aspects of the system as a whole affects both the administrators and the users of the system.
Overall, I'd have to say that this is exactly the type of "security in depth" book I've been needing to help me figure out how best to implement wireless networking at the office with minimal risk to the rest of the network. The authors write in a very approachable style and do a very good job of giving the necessary background before launching into any detailed discussions. I would highly recommend this book to anyone considering installing wireless networking without wanting to simultaneously install a simple back door to their network. Honestly, I haven't found much to complain about.
I'm of the opinion that, after reading this book, and using it as a guide to setting up a secure wireless network, I'll be able to sleep at night. Even though people can still war drive (or even war fly) and find your access points, even if they managed to crack the WEP keys and associate to the AP, the network will still be secure because of the multiple layers that have been put in place.
You can purchase 802.11 Security from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
I recently was paid to get a wireless network working (as well as fix some shared Internet connectivity problems in general) for a client.
When I arrived, I found out the client had everything running through a Belkin firewall/router device with built in 802.1g wi-fi. (It was attached to an external DSL modem via ethernet cable.)
It struck me that unless I'm missing something, these combo wi-fi bases/routers are inherently limiting in how much security they can offer the user. (EG. You can't really place the wireless clients behind some sort of a VPN tunnel with authentication if the other end of the wi-fi connection is managed by integrated firmware in the router itself, right?)
I ended up enabling 128-bit WEP for the guy, as well as disabling "broadcasting" of the existance of the router/w-fi base, but couldn't see much else to do beyond those measures.
besides not having to splice a wire or find an unused network drop to get in
That is the inherent vulnerability. Someone can have "wired equivalent" access to your network from possibly miles away using a good antenna, so physical security is irrelevant. Compounding this problem is the fact that wireless networks are expected to have clients connecting and disconnecting all the time, from different places, whereas in most wired networks the client base is fairly stable (and easily policed).
Bitchslapped. Neat.
otherwise, it's a good book.
I hate it when people say wireless is so incredibly insecure. It's true that the wireless signals can easily be picked up by anyone. It's also true that one can pick up radiation from cables to sniff packets on your "secure wired network."
The solution is to not rely on the hardware encryption of your card and hub. Instead, use encrypted streams for all communications from your laptop. Use SSH, never use telnet (that should be common sense). If you just do that, then you don't have to worry about someone sniffing your packets because they are encrypted (and if they're also hardware encrypted you have some nice double-encryption). Also, you could easily set up an ssh tunnel to your router for the http protocol or whatever else you need. That way you have the security through the air. Anything after that is subject to wires on the internet, which like I said before, give off measurable radiation.
In short, just remember to always use software encryption and not rely on the hardware encryption of your wireless devices. Simples as that.
We used 802.11 to make a secure office home network, and like any insecure medium for IP, you can secure it against sniffing by layering a secure tunnelling protocol on top of it. This probably wasn't necessary since most sensitive information goes over ssh or SSL connections anyhow, but the way to do it is to use a encrypted network device tunnelling driver thingy.
:)
... )
I'm used to CIPE and like it because it has a Windows NT/2K/XP implementation as well as a Linux module. VTUN does much the same job, is slightly easier to set up, although instead of a Windows driver, runs on Solaris and various BSDs. We used the latter to make a link between mine & my partner's house and managed to use the Linux bridging features to bridge his home wireless network to the office ethernet-- the bridge is over a vtun interface which sits on top of the 802.11 link between our office and his house. Complicated but it seems to work
Anyone else have a similar setup? I'd be interested to know how to grow this kind of setup manageable (not that we have a need for it, but
Matthew @ Bytemark Hosting
Even though people can still war drive (or even war fly) and find your access points, even if they managed to crack the WEP keys and associate to the AP, the network will still be secure because of the multiple layers that have been put in place.
...
Actually, layer2 is completely unauthenticated, so anyone can associate with your access point using no key or the wrong key. IP and above will get dropped however.
The lack of an authentication mechanism in the 802.11b MAC leaves a number of nasty weaknesses that can be exploited by malicious persons.
Denial of service (forged disassociation) and active man-in-the-middle attacks (using higher signal and forged BSSID/SSID) continue to remain possible in even the latest security extensions to 802.11.
I'm surprised no mention was made of IDS systems that can detect and respond in real time to 802.11 layer 2 attacks (and other higher level IDS checks on the IP traffic), although even these are of limited utility
Well, no. It's not as strong as it could be or ought to be, but someone has to sniff and crunch your packets for a good long time (there's a spam subject line if I ever heard one) to break WEP.
This site suggests that you need the packet traffic generated by 500 person-hours of heavy network usage to break WEP. I use my network about 10 hours a week. Accordingly, if I change my password once every few months -- that is, once every 100-200 hours of network use -- I avoid the nightmare scenario of someone printing 500 copies of goat-man to my color printer.
If anyone has any information that suggests WEP is weaker than that, I'd be happy to hear about it.
Now, mind you I like this book too, but it's already out of date. Wi-Fi changes too fast to be captured in a book. For example, WEP has never worked that well even when you try to make the most of it (http://www.80211-planet.com/tutorials/article.php /2106281), but as of a few days ago, WPA (http://www.80211-planet.com/news/article.php/2198 151) finally became available. That said, I still wouldn't write a book about it. Why not? Because by the time a book got into print, WPA, which is only a stopgap, will be replaced by 802.11i. If you want to secure your WiFi network, a book, even this one, is only a start, you really need to keep your nose to the Web sites specialized in WiFi like Glenn Fleishman's Wi-Fi Networking News (http://wifinetnews.com/) and 802.11 Planet.
Steven
Most wireless hardware is a lot harder to crack than it used to be. Vendors got a lot smarter when implementing their IV selection algorithms. Go try and AirSnort a Cisco AP these days. I tried against my .b/.a Linksys AP running the latest firmware (that's the important part) and only got 19 weak IVs after two weeks and GBs, and GBs, and GBs of traffic going across it. I flooded the network so I could see lots and lots of packets.
That's fine for home use. I'm not so worried about my simple 128bit WEP now. For the office you can go pricey, but good, with something like Cisco LEAP...or you can buy any old AP and do VPN/SSH/Tunnel.
The phrase "wireless security" is considered by some to be an oxymoron. How can a system with no physical security hope to facilitate secure data transport? Well, with careful planning and configuration, a wireless network can protect itself from many types of attacks and become almost as secure as its wired counterpart. 802.11 can be deployed with various security mechanisms to provide robust, mobile, and hardened network infrastructure.
Okay, so you won't find 802.1x support in your standard el cheapo LinkSys or NetGear AP. In fact, you won't find 802.1x support in any cheap access point. On the other hand, if one does pay for the higher-end access points, pretty much every major vendor supports 802.1x authentication. It is considered a requirement for an access point to be considered an "enterprise" AP. Furthermore, WECA's requirements for WiFi certification this year are adding "WPA", which is a stripped down version of 802.11i, which happens to depend heavily on 802.1x. Any new products after this requirement is added will have to have 802.1x support in order to be "WiFi Certified."
Believe me, the wireless industry is moving heavily towards 802.1x (I've written two different implementations of 802.1x for two different access point products myself), so it should not be so casually dismissed.
For those who scoff at wireless security: sure, it probably won't be as secure as locked away wired networks; but 802.11i does at least make it non-trivial to break the security of wireless networks (pairwise session keys on a per-client basis, larger size keys, larger IV space, message integrity checks, etc).