Slashdot Mirror
AirTraf 802.11b Security Package
An anonymous reader writes "Being ignorant of network vulnerabilities is a happy condition for only so long. Ignorance is bliss, right up until someone with rogue access drives away with your company secrets. This article covers information about AirTraf, an open source package, which performs a number of tasks, such as determining the Service Set Identifier of the access points, and the channel it is operating under. It can tell how many wireless nodes are connected to a given access point, as well as that point's total load. AirTraf is capable, too, of polling a number of sniffers through a central polling server in order to collect the most current information. The least of your fears should be the leeching of your Internet connectivity. Industrial espionage is a growing reality that you must confront."
As the article points out, they can be a hastle. Metal in the walls, elevators, stairs, etc.
The problem with site surveys is that you have to load expensive software onto a laptop or handheld computer, and go wandering the halls looking for rogue bases, rogue access, and other violations of good security practices. The wandering minstrel who's singing the song of good security must be in the right place at the right time. Invariably, this is a hit-or-miss process, great for finding good places to mount access points, but horrible at making a hit on a security violation. You'd have to traipse the halls and haunt the parking lots, lurking... waiting... like a creepy stalker, trying to find anything out of the ordinary; and you'd still be unable to be in all places at once.
--------
Free your mind.
I've always wondered why wireless security can be such a problem. Why hasn't someone devised a wireless system where encryption is hard to crack? Take a look at SSL: if you have someone listening to the wire, it's hard to get any good information from it based on the way the protocol works. Why can't the same thing be applied to wireless? The only real difference is you don't have to go through the trouble of intercepting the packets on a wire.
- tristan
If anyone knows of any agencies progressive enough to jump on the wireless bandwagon, pipe up. Otherwise I think it's just another victim of the hype monster.
It can tell how many wireless nodes are connected to a given access point, as well as that point's total load. AirTraf is capable, too, of polling a number of sniffers through a central polling server in order to collect the most current information.
As useful as this is, its not going todo much to detect or stop the fact that these are just radio waves. And you can't "detect" a hunk of metal out there picking up on them. Almost all new cards are capable of being put into RF monitor mode and sniffing raw 802.11b frames without transmitting anything.
Prism II and Cisco based cards can do it out of the box. Orinoco cards can do it with a patched driver (patched orinoco-cs on linux, WildPackets driver on Windows).
On top of that, AirSnort now compiles on Windows. Its not a fun/easy setup and still has a lot of problems, but it works.
It's been my experience that all consumer grade access points come with all security features turned off. WEP and MAC filtering are not enabled until the user/admin turns them on. Realistically I don't see this situation changing any. What's the alternative - setting a default WEP password that ships with thousands of identical AP's?
Part of this is an ease of use issue. When you install your first access point you just want to get the thing working. After the initial joy of a succesfull installation it's up to you to turn on WEP and enable MAC filtering. Even then your WiFi network won't be truly secure.
Ignorance is bliss, right up until someone with rogue access drives away with your company secrets
Most wardriving is about finding an open network where you can pull your favorite pr0n from your car on your laptop. And probably for the sheer fun of hacking too. Now, if the admin(s) of a company relie on pirates not being able to plug into the physical ethernet socket for his security, he/they surely should be fired.
In most companies, even if someone gains access to the intranet through 802.11b, he's not going to do much, as the real meat of the company will probably be protected even there. He might get to play with some Windows boxes, see hostnames, sniff this or that, but that's all. True, it's very much better if the guy doesn't see anything in the intranet in the first place, but still, in that worst-case scenario, there is a reasonable level of security left in companies with a decent admin.
Now, 802.11b isn't so secure. If you're really worried, don't use it. If you're really worried and you really want wi-fi, run tunnels over it : it's far from ideal but it's quite secure.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Yet nobody will put the latest service pack on.
Microsoft software, installed correctly and to their specifications, is as if not more secure than most distributions of Linux. The amount of FUD spread about it is all out of proportion to its flaws, and is probably due to a complete lack of familiarity of its features by its detractors, who would of course use it if it was free. It is this same lack of familiarity that is preyed upon by vendors who would rather sell a $10,000 band-aid than a $50 book.
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
I have cracked 'secure' wep's in a matter of hours, and the more traffic going over the network, the easier it is.
It is well-known that WEP is insecure but that doesn't mean that it is impossible to send secure data over the air. It is absolutely not the case that "wires=security". If you need to transmit crucial passwords over your corporate intranet you might be smarter to encrypt than rely on the fact that nobody with access to your physical network wants to steal your data. Encryption is the key to security, not broadcast medium.
The only problem I have ever had with wired lines is bad planning. Providing you know where your workstations are going to go, and how you plan on growing, wires are just fine and MUCH faster!! :)
So you need a network drop anywhere anyone may ever want to work on their laptop (or palmtop, or wi-fi phone). Sure, if you are going to be restrictive it is easy to force people to work in the places you tell them they should work. But this can hurt productivity. Knowledge workers will have persistent wi-fi in their homes, in cafes, in restaurants (even McDonald's), in hotels, and in trains, but you're going to tell them they have to deal with wires at the office? Sorry dude, I can't help but think that you are short-sighted and will be proved so over the next few years. Wireless with true encryption will be standard almost everywhere people work.
Rather than saying that 802.11x is analogous to a network, think of it as being analogous to an RJ-45 wall jack. If you placed a wall jack in a public area of your local shopping mall you would realize that it is insecure and is exposing your network to the world. Knowing this you would take some action to secure that wall jack. You might disable the port at the switch or you may have a firewall set up to allow the wall jack to be used but prevent unauthorized access to your private network.
The same procedure should be used with wireless. Setting up an access point is the same as placing that RJ-45 jack in the shopping mall. You need to isolate the traffic to and from the wireless access point. A firewall could be used for this but, perhaps the best way would be to establish a VPN server between the access point and your private network. This way, unathorized access can only see the front facing VPN server and nothing else on your network.
Don't look for security in 802.11x, it isn't there. At the same time, Cat5e by itself offers no security. The security that you associate with Cat5e comes only from the physical security surrounding the wall jacks and switches. If you expose the wall jacks, it's a whole new ball game.
One thing often overlooked is the overhead in using these encryption schemes. If you want an access point to handle a hundred clients you need to take the load into account. These APs are designed to run w/ little heat and power usage, not to mention the small clients such as PDAs and scanners.