Slashdot Mirror
Government Use of WiFi Not Secure
Terremoto writes "A Congressional report indicates that the use of WiFi by government agencies is being done with little regard for security. The article says, "Government Accountability Office investigators were able to pick up Wi-Fi signals from outside all of the six agencies they tested, and they were able to find examples of unauthorized activity at all six as well.""
Err, doesnt the FCC spank down anybody who does Wi-Fi access control (if it's NOT encrypted)?
YEah, breaking an auth scheme could be grounds of breaking/entering, but when its open invite, isnt it allowed?
You know, public airwaves and all..
It wasn't clear in TFA either, but do they mean a little pr0n surfing/p2p going on or active hack attempts were found?
SEO Firefox Extension
If it's insecure that provides a perfectly valid explanation for unauthorized behaviour.
"I didn't hit porn, must have been some drive-bys on our wireless network"
Can they not afford cat5 or something? 20,000$ for a toliet seat, and this is how you save money.
such as admin.
Precious few government agencies need wireless access anyway, and those who do generally know how to handle it.
Those who don't, have no business incorporating a technology they don't understand. But, I suppose they have to spend their budget on something, even if it has nothing to do with making their job easier.
I would consider it to be criminally negligent.
It is a shame that they allow these agencies to recieve funding or for their IS / IT departments to still have jobs.
Lets stop talking about Filibusters and start talking National Security
Indeed, NetStumbler's help file even suggests such a scenario as one possible use for the program:
" Wireless LAN Auditing
A corporate network administrator needs assurance that the wired LAN is not being exposed to unauthorized users. This can often happen when users set up their own wireless LANs for convenience. Such wireless LANs often have little or no security, which poses a risk to the entire LAN. The network administrator can use NetStumbler to detect the presence of these "rogue" wireless LANs."
At least now that this story has hit the news, perhaps more people will wake up to the danger and try to secure their critical networks (as long as they leave open at least one for me to use as a wi-fi hotspot ;-)).
Laughter is the best medicine, but in certain situations the Heimlich maneuver may be more appropriate.
I'm always a bit doubtful of these surveys. Some companies run an open network, but to reach any network resources you need to set up a VPN. This avoids possible problems with air-side encryption (yes, I know there are many other solutions) and allows visitors to use the network.
The reason why radio frequencies keep leaking out of these government buildings is because they removed the lead paint from the walls. Now they are going to spend a few million USDs putting the lead paint back on the walls. No wonder the White House is complaining about leaks to the media.
Maybe in the next presidential elections concerning a power hungry, i-must-crush-my-opponent-candidate, there will be a wireless-tapping scandal that takes place in the parking lot of the Watergate hotel instead of the actual room.
Obviously, that sets up Forrest Gump II where the Forrest character spots a couple of geeks trying to jump start their van because their surveillance equpiment drained the battery.
porp
Ah yes, aluminum siding! I twill keep the wifi waves inside, and the death rays outside.
no...wimax is a paid-spectrum service, and is not intended for use by the general public. Wimax is only for big companies that can afford the equipment AND SPECTRUM LICENSES to set up a hotspot. It will probably be used mainly to provide wireless Internet access to people - not to provide access to internal networks of companies or governments. It is simply not intended for that purpose.
as far as wimax is concerned, i'd be more concerened about people with hacked equipment reading your traffic if I were you...but I don't know if wimax has any encryption.
About the only solution I've seen is the airFortress product that utilizes a client that encrypts all data and decrypts it through a hardware device that interfaces with the access points. Military has been using it for a bit.
So, some government agencies use unsecured wireless networks, and some people might even be leeching off of them for internet access. That might or might not be a real security issue, depending on if they're using their wireless network for sensitive applications and if those applications aren't using end-to-end encryption for their applications and if their wireless networks aren't firewalled away from the rest of their network. Perhaps the actual report describes the vulnerabilities in greater detail than this article, but I don't see how the mere presence of an unsecured wireless network is necessarily something to get worked up about.
The story title seems wordy, heres the short version.
Someone set us up the bomb, so shine we are!
You watch the government today and realize that the current mode is now to get what you can. GWB is busy getting his for he and his buddies (haliburton is getting the bulk of the iraqi oil). They are squashing all attempts at stopping anybody from gripping (the gal from the DOD who compaigned about the haliburton deal, Edmunds has a gag order (www.justacitizen.org), a traitor is allowed to remain hidden in the white house, etc.). But it is not limited to the white house. Look at Tom Delay, Campbell of Colorado (who resigned rather than be under heavy investigation, but it looks like indictments may still come down), etc. And while I do not mention the dems here, there are plenty of them who are doing there best to get as much as they can.
Sadly, I really do not blame those that come in through the back door when so many are simply stealing from the front door.
I prefer the "u" in honour as it seems to be missing these days.
I know many disagree with me on this, but personally I think that open WIFI networks is a very good thing. And I encourage all Wifi administrators to Open up their networks for all! This is quite safe if you secure the private services on the networks so random people only have access to the Internet. Think of it like this: You allow a few people to use the Internet from your home in exchange of being able to use the Internet when you are other places. If everybody with a Wifi does this then we will eventually have a global free Internet available everywhere for all. Again, having a Open Wifi is no threat to you IF you simply secure the services running on the Wifi! And this is, in fact, a much better approach than having a firewall and relying on that for security...
9/11: Never forget it was a false-flag operation
Grad students like me are in for big funding!. Yes I don't mind getting paid for setting mac filtering and wep key.
No, it should be tin, not aluminum. Does aluminum protect you from the mind-control rays of the secret government? No, but tin does. Does aluminum protect you from Bush's thought police? Nope, only tin can protect you. So, if we wrap all of the government buildings in tin, we'll all be safe from their harmful effects (except all the legislation, of course. However, if we forget to poke air holes...).
Some of the older posters might point out that "tin foil" caps were good enough to protect them from the government's mind control and thought reading devices of their day, "and it outta be good enough for you". I concur, however, "tin foil" no longer contains tin! Yes, it's really aluminum foil, and people just still call it tin foil. This was a plot by the government to fool people into believing that they were safe from government control. Soon, the black helicopters will be hovering over your doublewide as black-clad stormtroopers burst into your home and disappear you.
You were so close to being partialy right but your wrong. Yes, wimax devices can be made in the licensed spectrum, but they can also be used in the un-licensed spectrum. It is likley that we will see 5.8 Ghz wimax gear in the US as the "listen first" protocol required in the opening of 5.3 is not compatible with the polling protocol specified in the wimax standard.
CP
Wireless network connectivity is nothing new to the US govenrment. I assume they are talking about DSSS when they refer to WiFi. There is no mention of Frequency Hoping systems that they have been using for years.
And in other news, the sun is bright, ice is cold and the new Star Wars flicks arent as good as the originals....
maybe a better technology will pop-out soon. but WiMax will stay just like floppy-drives here in Asia.
RLLQ | http://iconworks.org
Er.. if two computers connect to the same access point, won't they have direct access to each other? And.. if you're not relying on firewalls to protect you from each other you will get to show your ignorant laptop-owning friends how to remove their worms your other ignorant friends (or passers-by) kindly infect them with... the hard way.
What the GP is saying is that you should already have all your boxes secured or should set the wifi up in DMZ. Keep in mind that the vast majority of systems are cracked by locals. That is, from somebody within the company, not out on the internet. So all boxes should be secured from the gitgo. Likewise, if your box will get a worm from a box that is connected, it will almost certainly get it from the employee box that went home at night, was hooked in, and then surfed some site that does worms such as ninenine.
I prefer the "u" in honour as it seems to be missing these days.
One of the issues with many government organisations is that the IT is not managed by a central location. Often policies differ from location to location, state to state etc. Having a uniform policy centrally managed across the entire organisation would be a good start for many government organisations that I have come into contact with when working with a tier 1 networking vendor.
My father works for Boeing, and everything has to be hardlined. There is a company ban on any "secure data" being transfered by any wireless protocol. This ban came when the scare of serious wifi security measures were hacked. The government is smart to stay away from wifi, until a more secure type of encryption is enabled. Maybe possibly a private "wifi protocol" specifically for the government?
$sig$
There is a wonderful solution to all of the wireless security issues:
802.11i
802.11i not only plus all of the holes in WEP, it also uses AES encryption to get around all of the potential problems with RC4.
Right now, as I speak, err write, I can not buy an 802.11i complient router with AES encryption. I've looked at Netgear's site. I've looked at Linksys's site. I've looked everywhere. There was a bunch of discussion about how 802.11i was going to be the next great thing in mid-2003, then a deafening silence.
If I want 802.11i right now, I can't get it.
I think the fact of the matter is the your average user is not willing to pay for than $50 for a wireless router. It is, of course, possible to make AES work fine with a router of that costs, but it is going to take good deal of economics of scale in action to make a 1,000,000-transistor chip for implementing AES affordable at that price point.
802.11i is just not a buzzword in the buzz machine that all the tech magazines use. Until it becomes a buzzword, wireless networks will continue to be insecure.
(There is also a lot to be said for 802.11i being deployed on a wide enough scale that AES becomes ubiquitous. I would like to see special AES-specific op codes on x86 chips and have $5 co-processors available that can do AES at 100Mbps)
How secure is secure enough? From what I can see in almost every office I've been in, finding a way to steal data (not necessarily digital format) is relatively easy. So should we really expect "perfect" security from WiFi networks?
/.'s use at home?
Clearly unencrypted wireless is out, WEP too. But how about WPA? I personally feel that running VPN over WiFi would be best, but for many small businesses, the added complexity is hard to justify.
Let me put this another way, what do
For example XP now supports WPA2, but even if you get a router that has it neither Toshiba or Dell appear to offer NIC drivers that support it.
even when it becomes a buzzword (and you know it will--just look how long it took bluetooth to make it to the mainstream...) it will be very difficult to get everyone to switch out the old hardware. there will be plenty of unsecure legacy hardware floating around long after the government (and corporations and private users) have started buying nothing but 802.11i, and what many of these users (and even admins) don't realize is that any hole behind the security perimeter is still a hole--and that makes the whole network vulnerable... but you're definitely right--we need to get it out as soon as we can.
--cid
http://cidviscous.blogspot.com/
I don't suppose you really have any control left but when things are getting that bad it's your only sane option. (It's the only sane option when you're getting to 100+ clients anyway). Allowing users to design your IT infrastructure is pure madness, entropy inevitably turns your network to mush.
Even Windows Terminal Server expensive as it is, is better than 25,000 desktops. We use LTSP and an array of Linux and Sun servers[1] tied together with Sun Grid Engine[2] to provide what the users think of as a single system, "The Grid". It was a remarkably easy sale to management, but we were coming from a largely Unix environment. It's a bit more difficult with Windows, the array smallish servers approach is is far more expensive to implement than Linux.
[1] many of them ex workstations and desktops.
[2] Though Condor looks like a good option.
Deleted
Actually, aluminium is sufficient for a Faraday Cage to keep the WiFi in. The mind-control rays, on the other hand...
I saw a similar story on SC's Website link
The latest gadget news and reviews. www.absolutegadget.com
Solutions exist to implement secure WiFi, but it comes with a cost.
Harris makes an encrypted PCMCIA 802.11b based card that has high grade encryption built in. It certainly makes the system impossible to get into, but they're far from cheap ($2k+).
Product: SecNet11
In the end, a lot of the exploitable networks comes from either poor management, lack of information or lack of control within government areas.
www.techwatch.com.au
My Linksys WRT54G does support WPA with TKIP and AES encryption.
Sure, it is not AES at the low level as 802.11i, but it is AES instead of RC4.
Why is an agency such anything to do with the Governement using WiFi ? Bit stupid imo.
The fact I can pickup some guys WiFi across the road from my couch in my bedroom indicates people aren't hot on security, he doesn't even encrypt !
"Sweet llamas of the Bahamas !"
Is this a stock WRT54G, or is this one with a modified firmware (which seems possibe, since these Linksys beasties run Linux and the source is available)? I can't find anything about AES in the supplied documentation.
I have considered setting up a VPN for my home net so I can forget about WEP. Use L2TP or even PPTP so the Windows machines can have a simple way to connect, Linux is handled by myself.
However, what about the risk that a laptop may not have a decent personal firewall? It gets cracked (or runs malware in the first place), it connects over the VPN since I trusted the user the last time he visited - suddenly the malware has a route to my servers. Or theoretically a cracker could attack the client machine through the WiFi link, right? Then it doesn't help much that the AP is secured and only allows a VPN client to connect, if my neigbor cracks someones laptop while they are connected through the VPN.
What is the sound of one hand clapping?
cat
I have implemented wifi for several parks for a large city. We place the network on the outside of our internal network. We allow anyone to connect to the network after agreeing to a pop-up stating our acceptable use policy. Exactly how can this be conceived as insecure?
With a linksys wrt54g and this new "beta" firmware (linksys release, not 3rd party) you can have wpa2 right now.n d_router/WRT54G_WRT54GS/WRT54GWRT54GSBeta_Firmware _for_Wireless_Transfer_Issues/
ftp://ftp.linksys.com/sg/support/download/broadba
You'll need to have a card that supports wpa2 in the drivers as well. There are a few out there.
Remember that you are unique, just like everybody else.
Check out the Army's wireless BBP:% 20Wireless%201_25(Final).pdf
http://www.igov.com/informationtech/contracts/BBP
I can't link to the original because it's behind Army infrastructure, but I found a link out in the real world. It's not too bad. On Army installations, you are required to do layer 2 encryption, which is pretty good. However, the "road warriors" are not required to do layer 2 on the road. Layer 2 is not an easy thing, as we are finding...
...I concur, however...
I do not think that word means what you think it means.
I don't know if I want to trust a part of my retirement to a group of folks that can't set up even the most basic Wifi security. I am sure they even overpaid for the access point...
Strange women lying in ponds distributing swords is no basis for a system of government.
does a great job with WiFi reception from a km away.
It's radio. It's not held back by windows. The 'good stuff' happens in the 'big guys' office. His office is high in the building with the nice view. The view goes both ways. The new Athlon 64 box is damn fast!
Now all I need is some surplus 'camo' paint.
It isn't just wireless. Even government wired isn't the most secure thing.
The problem is that that isn't funding to put BlueSocket on wireless for government networks. Nor is there money to put a proper firewall in many instances.
Government flies by the seat of its pants.
You're already using Windows, aren't you accepting a certain level of insecurity anyway?
c'mon, be serious. We all know that government employees don't actually *work*. They're certainly not going to work in a cafeteria, during their federally-mandated 3 hour lunch break each day.
WiFi is insecure when used improperly
and in other news
The government is still a bloated inefficient model of stupidity
Water is still wet
and
New study proves that Fish's skin is wet
I will not give in to the terrorists. I will not become fearful.
Scratch that. I'll be heading to my local bookstore for a reading comprehension book posthaste. Do they make books about reading comprehension? That blows my mind.
mmmm encryption co-processors
I've been thinking of getting one for a long time. SSH, SSL, TLS, they all use AES as their strongest chipher. I also have IPsec and loop-aes setup, so I have even more reason to have one of those cards.
X(7): A program for managing terminal windows. See also screen(1).
MOD PARENT UP!! Interesting.
Check out Proxim AP-700 It support 802.11abg, 802.11i AES, etc.
Proxim also has has other AP's that support 802.11i. I think the D-Link 7200AP also suport 802.11i, but I may be wrong. Oh yeah, and you can get 'em "right now."
You create your own reality - Leave mine to me.
For what it does, displacing/replacing the cost and aesthetics of cat5 cable, wireless does a very bad job of it.
Quite apart from the security aspect, which was handled by slapping WEP on it, its a mess.
It can and does work with extremely simple networks (one transmitters, many receivers,) but it is absolutely terrible at topologies with repeators.
Apple's Airport and 'Bonjour' (previously called 'RendezVous') is one of the worst at letting you build network topologies.
I have scrapped my AirPort base and a couple of 'pucks' because I, a friend AND a network guy I paid for were unable to set up my network.
I am now running a network of Macs and Windows PC on a single LinkSys wireless router because I'd had one since moving to my new place and NOT laying down some cable.
It was simple, secure (WEP & destination addresses so only a few IP addresses are actually exposed and port filtering,) and easy to install.
As for AirPort, Apple's vaunted skills at GUI utterly failed them this time. Its a dogs breakfast of confusing and seemingly contradictory options, 'build' directions and concepts which just don't friggin work.
I'm out $300 bucks on the Airort equipment but two guys and myself are much wiser when it come to wireless. Friends don't let friends buy Airport.
Nice try Apple, but building networks should not be magic where you're never sure if doing one thing just undid another.
Your current GUI approach is totally inadequate, TOTALLY.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
If they can ever get away from the "use two consulting firms in an adversarial role" implementation model, they might see some benefits to their IT advances.
You better watch out, there may be dogs about . .
It's available. Companies should look into it. Paint all exterior walls with it and it could help with the issue.
This might be "US citizen's-only" technically, but the report itself is available on the web here. It's a 1.5MB PDF. You can also request a free printed copy of this or any GAO report here. (This report is GAO-05-383.)
blarg.
The FCC will spank down anyone who tries to enforce "don't broadcast your evil wifi radio waves into my airspace/apartment complex/living room". However, anyone is free to say "don't connect my wired network to wireless", assuming that the network is indeed theirs.
This has usually come up in the context of landowners (airport operators, universities acting as landlords to "off campus" housing, etc.) trying to enforce a monopoly on wireless internet access while on their property. However, in the US the FCC regulates the wireless spectrum exclusively, hence the smackdowns on all "though shalt not broadcast" prohibitions. (related smackdowns occur occasionally against homeowners associations who try to prevent an FCC-licensed ham radio operator from putting an ugly-looking antenna in her yard)
But the issue of offering connectivity to a particlar (non-public) network through an unatuhorized interface is something else entirely.
From TFA: At one agency, 90 laptop computers were configured to search for a wireless connection while they were plugged in to a wireless network -- an easy way in for snoops and hackers.
How does one "plug in" to a wireless network?
The SSID was named linksys....
the govt doesnt actually care. this is just a study someome did to 'look busy'. if the govt cared this problem would not exist in the first place.
"Freedom and Justice for All" is a registered trademark of The United States Govt Inc. Not available in all areas.
we don't usually find them unless we physically stumble across them or unless the DHCP server in the device is handing out address on the LAN at the site and therefore breaking connectivity for the users.
We forbid DHCP "blanket use" on our network. We have a DHCP/BOOTP server for only one purpose: to hand out reserved leases for a handful of legacy network printer devices which can only get an IP address that way.
Here's how we solve the problem of unauthorized IP address assignments: I set up a Linux box with a shitload of ip aliases on its eth0. Every device on our network has a manually assigned fixed ip address. All ip addresses that are unassigned are put into that Linux box as ip aliases, in essence our entire address space is filled. If anyone tries to connect an unauthorized device with an adddress the user just picked out of our address space, he gets a duplicate address collision and we find out about it right away. When we need to add another legitimate device to our network, we remove the IP address from one of the aliases on the Linux box and assign it to the new device.
Sure, it's a hassle to admin this mess, but it guarantees no unauthorized devices will function when plugged into a switch port.
I pickup signals all the time, this does not mean that I am able to connect. If they jammed or otherwise prevented the signalls from being broadcasted, it would defeat the reason for having a wirless connection in the first place!
GENERATION 25: The first time you see this, copy it into your sig on any forum and add 1 to the generation. Social exper
It only keeps the casual script kiddie occupied for a while. Not even WPA2 is secure. Nothing short of Layer-2 encryption with minimum AES 128-bit really constitutes a serious impediment to a real wireless cracker. Look at an Air Fortress AF2100 or AF7500 is you want your Wi-Fi to be secure... for a short while anyway.
At least, not at Goddard where I work. NASA used to be an easy target for crackers, but we've tightened up a lot since those days. Network security around here wardrives the grounds, and people with guns (!) will show up if they detect an unauthorized access point.
To a Lisp hacker, XML is S-expressions in drag.
mod parent down - what a load of rubbish
There are WPA2 (or 802.11i if you prefer) APs available. Try the Cisco 1130AG Wireless Access Point for a start. Plus there are WPA2 certified wireless client cards available - including both pcmcia and MiniPCI.
MAC addresses are configurable, for a number of legitimate reasons I won't go into.
Anyway, if you and I have the same MAC address there will not necessarily be any confusion that's visible to the end user.
Each of our machines will discard the packets that do not fit into the conversations we are having, based on other values than the MAC. For example, stuff like sequence numbers, higher-level addressing details (ports & IPs), etc.
So, this will just make stuff run slow, due to all the packet discards. It'll still mostly work.
Now, if you are on a switched network (NOT wireless) and two machines have the same MAC, it will confuse the bejeezus out of the switch and cause much more havoc. Higher level protocols that can ask for retransmits might still muddle through if the the switch is fast enough and you luck out on on the timing, but the switch should throw up all kinds of alarms to the net admins.
Seriously, man, grow a spine. Your organization - which is apparently funded by my tax dollars - needs to be reported to los federales. Your management's behaviour is criminal if your post is correct - so do your job, and your duty as a citizen, and turn the bastards in. Look up "anonymous whistle blower" in the federal phone book or consult Google for how to do it.
128-bit WEP, no SSID broadcast (aka "stealth mode") and connect the access point via a crossover cable to an ethernet card on a stripped-down linux box that firewalls all ports except 22.
On the laptops use a little script that does an SSH login (user supplies password, never stored anywhere) and then forwards the SMB/CIFS, IMAPS, DNS, and SMTP-AUTH ports over the SSH connection.
Make sure the access point is very "dumb" - that is, it doesn't have enough memory or OS to allow an attacker who compromises the AP itself to install an SSH M-i-t-M sploit. I use weird Intel and Enterasys boxes (pulled out of dumpsters) that haven't got real OSes anyway.
If I've ever been cracked, it was done so gracefully I haven't even noticed... and since my neighbors don't even run WEP it's unlikely that I'd even be noticed much less targeted.
Oh, and most importantly: Don't use default passwords, and KEEP YOUR PATCHLEVELS UP TO DATE!
...driving past a government building posting this comment.
I think the fact of the matter is the your average user is not willing to pay for than $50 for a wireless router. It is, of course, possible to make AES work fine with a router of that costs, but it is going to take good deal of economics of scale in action to make a 1,000,000-transistor chip for implementing AES affordable at that price point.
well perhaps if the vendor adds nifty features like wireless audio streaming and whatever else you can think of to it people will be willing to pay more for it. 802.11i can become a complementary feature, a bonus.
just maybe if apple puts 802.11i support in their next-gen low-end base station with some cool new features and corresponding high price tag...
(may read 'IMHO' wherever omitted from above text)
At one agency, 90 laptop computers were configured to search for a wireless connection while they were plugged in to a wireless network -- an easy way in for snoops and hackers.
Well no wonder the wireless security is a flop! If they can plug in they need wired security. Some people, sheesh..
I work for a government department/agency that was one of the six more intensely reviewed. Though I was not directly involved with the survey, I work with folks who were and I have a general knowledge of their findings.
As the report mentioned, every one of the six reviewed in depth were found to have unsecured wireless devices. Our organization was one of the better ones. In our main building they found two unauthorized devices after doing a hallway-by-hallway search. Neither of these devices were connected to any of our enterprise networks. One was an access point that was connected to a DSL connection by a construction contractor and the other was a personal laptop or something of the sort. Nevertheless we had unsecure wireless devices in our facilties. Of course there were some other network signals that they couldn't authoritatively say did or did not come from our building. This is a building with several thousand employees, BTW.
Currently, we do not authorize the use or purchase of wireless networking devices. This is a management directive from our main IT body. We do not however, have any official policy stating that wireless shall not be used nor any policy on its secure use. This is simply due to the fact that we will likely authorize limited use of wireless devices but do not want to do so without including enforceable policy documents. At least where I work, getting policy is something like passing a law. Lots of folks have to review and sign off on it, and there's the occasional bickering on language, responsibility, funding implications, etc. The point being that establishing new policy is quite an undertaking, espcially in an environment of differing opinions (there are multiple draft policies in the works). GAO did not mis-state nor I think mis-represent anything that applied to us. Despite our directives stating no wireless, someone new and senior enough could simply open the floodgates.
GAO can sometimes be a thorn in the side of federal agencies. They are given tasks by Congressmen to go research something and generate a report after said congressman may have read a magazine article, saw something on TV, or had a conversation with a lobbyist. The few GAO folks that I have been in contact with are very professional people and for the most part work for everyone's best interests. They do ultimately work for Congress and will present recommendations and to a certain extent need to find problems to prove their worth (kind of like a toned-down inspector general but without direct enforcement ability). OMB isn't much better with their mandates. Just say the words "telework" or "HSPD-12" to any IT or security person and you'll likely hear them groan.
Anyway. I guess the reason I'm pointing this is that being in the goverment myself, I often get annoyed by the reputation that our culture attributes to government employees and the way we do business. Believe me, some of it is deserved. We have to follow some governement-only labor laws that were passed at the turn of the century that make it extremely time consuming and very difficult to fire (and hire) someone. There are many highly-dedicated and qualified government professionals that are way underpaid. As a whole, government employees tend to be hardworking folks. Our bad apples just happen to be really really bad.
In theory, yes, you are right. You should be able to just configure your client to reject connection when the host keys are changed, and provide the keys to clients via a secure channel like floppy, USB, or whatever (I recommend putting the SSH host public keys and wireless encryption keys on a CD, even though it's a huge waste of space. Some of my cow-orkers use a USB stick for this).
In practice, there are always rumors of SSH M-i-t-Ms going around, and some of the rumors always turn out to be true, although they are usually restricted to specific implementions or to specific encryption methods. For example, I use PuTTY to connect from windows boxen; in versions of PuTTY prior to 0.56 a M-i-t-M can simply replace your host key files during session startup, before host key verification is even begun. But if your AP OS is sufficiently esoteric or space-limited, an attacker will not be able to insert code to do this without breaking the wireless functions.
So, using dumb APs is another layer in the "defense in depth" strategy. You should have a virus scanner too...