Slashdot Mirror
AirTraf 802.11b Security Package
An anonymous reader writes "Being ignorant of network vulnerabilities is a happy condition for only so long. Ignorance is bliss, right up until someone with rogue access drives away with your company secrets. This article covers information about AirTraf, an open source package, which performs a number of tasks, such as determining the Service Set Identifier of the access points, and the channel it is operating under. It can tell how many wireless nodes are connected to a given access point, as well as that point's total load. AirTraf is capable, too, of polling a number of sniffers through a central polling server in order to collect the most current information. The least of your fears should be the leeching of your Internet connectivity. Industrial espionage is a growing reality that you must confront."
Wired Cat5e = Secure
:)
Wireless 802.11(a,b,g) = unsecure
I have cracked 'secure' wep's in a matter of hours, and the more traffic going over the network, the easier it is. All you need is about a gig of traffic, and blamo, wep key in shining black letters right in front of you. I'm sorry guys, beaming a signal through the air is not secure (as shown by the amazing security from the satelite TV companies, I think we have all had a h card at some point, or other varients)
The only problem I have ever had with wired lines is bad planning. Providing you know where your workstations are going to go, and how you plan on growing, wires are just fine and MUCH faster!!
No I didnt spell check this post...
Use IPSec, or some other VPN technology. They seem to fix the problem pretty well.
Yes, you can.
Since no one else linked to it: AirTraf's web site
Also, This link goes to Elixar, the AirTraf project team's new company.
Why do I h8 apple?
WEP is a miserable encryption algorithm. It can be brute-forced within hours, or passively within a day or two. Simply by having WEP enabled on your access point is *no* guarantee whatsoever that your data is secure.
Now, having everything SSH tunnelled and then wrapped in a flaky WEP crust, that's different... But WEP for 802.11(x) makes about as much sense as a bicycle for a mermaid.
Bowie J. Poag
Bummer
1) Terminate your wireless AP outside your network
2) Use strong VPN software to access your network
3) Only allow the AP to talk to the VPN box
So what's the result?
- no WEP problems
- nobody on wireless is inside your network
- nobody can steal access
It's certainly the only sane response I've seen. Other than, of course, "Don't allow wireless at work" which is rapidly becoming the standard.
That might be the case for the Tu-144, but the Soviet lunar project was hardly a copy of the Apollo. They were, after all, trying to get there before the U.S. (although they didn't succeed.) It had some very different attributes, and was derived from the Soyuz program.
Buran certainly was, ahem, heavily inspired by the U.S. space shuttle, but was different in some ways -- for one thing it was intended to be able to operate without any crew.
The word about the Tu144 is that the Concorde prototype plans that were acquired by the Soviets contained some deliberate mistakes (an old engineering trick) and these led to the crash.
The Russians did have some very good copies of the VAX 11/780 though running VMS. It was only through an almighty balls up by Digital that they lost their advantage after the end of the Soviet Union. HP did wel out of Digital's mistake.
See my journal, I write things there
The creds: I'm an infosec goon for a big faceless corp that is pretty paranoid about being hacked.
OK here we go:
All you need to get 802.11b (or whatever) working is an access point and a host. The Logical Link (from that OSI model in the first chapter of the MCSE book you never read) indetifiers consist of the ubiquitous MAC address and an SSID. Alllthe client needs to do to connect is specify a valid SSID to the access point in question, voila, free porn on somebody else's dime. Here's the thing, 802.11b access points broadcast their SSIDs.
Some stoggy buggers thought that this kinda sucked, so they decided to wave the magic encryption wand over the system. What they got was the (in)famous WEP, Wire Equivalancy Protocol, or Wireless Encryption Protocol, depending on if you started messing with this before 2001 or not. This stuff comes in 2 main flavors, 56-bit and 128-bit. Two problems with WEP came up round about 2001. First, the key generation algorithim was flawed, and a 56-bit key was really a ~26-bit key, a 128-bit key was really a ~98-bit key. Second, because of the nature of the system it is very easy to gather enough data to preform differential crypto-analyses (aka extracting the keys from a bunch of traffic based on how they are encypted). Detrimental to all hope us poor white hats had of keeping our systems safe, AirSNORT was released, allowing even the cryptographically challanged intruder to compromise the best access points.
Security for the wireless:
Most commercial access points will allow at least some of the following:
Turn off SSID broadcast, this helps, unless the intruder can see a user connecting for the first time, when the client broadcasts the SSID to gain access.
Specify allowed MAC addresses, this also helps, but all an intruder has to do is change the MAC of the intruding interface, nad get on while a client isn't on.
Stuff only a few vendors do:
Use 256-bit encryption, this is pretty good, but only works with compatible cards and drivers. It can also still be cracked by a determined attacker using AirSNORT, (ok, ok a very detemined attacker with some form of supercomputer, but hey there's No Such Agency with that kind of equipment).
Cisco has tech called LEAP, which will do cool things like rotate keys on a 5 minute basis. It is unlikely that an attacker using AirSNORT will get sufficent information to crack the key before it's changed. It'll do some other cool stuff, but I'm not a Cisco rep, so I won't recite the product manual.
A "Best Practice" with wireless is to do some or all of the above, and attach the access point the the outside interface of a VPN gateway. The theory on this is to treat the wireless network like any other external connection.
Now why, if I'm doing all this stuff to secure my network, do I do a Wireless Site Survey at least quarterly at my major sites? Well, because people like easy, and people like to do it themselves. I'm most concerned about someone setting up a combo firewall/access point on my network. The best way to find rogue access points is to play marco polo with a laptop and a directional antenna (if you want good info on that stuff, talk to a friendly neihborhood HAM operator, but a coffee can works pretty well in a pinch).
Stuff you should know about site surving:
Get a good card, preferably one with an external antenna input. See what you can do about getting the right antennas for this knid of thing.
The tool De Jour for this is called Kismet. It does not have all the key cracking kung fu of AirSNORT, but it makes finding the access point pretty easy.
Have you policy in hand for the confrontation with the owner of the rogue access point, wield it with BF&I (Brute Force and Ignorance).
Good luck and happy hunting,
Spyder