Slashdot Mirror
Government Use of WiFi Not Secure
Terremoto writes "A Congressional report indicates that the use of WiFi by government agencies is being done with little regard for security. The article says, "Government Accountability Office investigators were able to pick up Wi-Fi signals from outside all of the six agencies they tested, and they were able to find examples of unauthorized activity at all six as well.""
Err, doesnt the FCC spank down anybody who does Wi-Fi access control (if it's NOT encrypted)?
YEah, breaking an auth scheme could be grounds of breaking/entering, but when its open invite, isnt it allowed?
You know, public airwaves and all..
It wasn't clear in TFA either, but do they mean a little pr0n surfing/p2p going on or active hack attempts were found?
SEO Firefox Extension
If it's insecure that provides a perfectly valid explanation for unauthorized behaviour.
"I didn't hit porn, must have been some drive-bys on our wireless network"
1. In densely packed office buildings, it is in fact cheaper (in terms of material and labor, nobody wants to bust down walls to insert cabling) to just have wireless and put repeater antennas everywhere.
2. $20,000 for a toilet seat breaks down into this:
$19975 for secret black-ops projects nobody will ever hear about.
$24 for the Toilet Seat
$1 for the liability insurance. You know, from the dangers a toilet seat can cause.
I would consider it to be criminally negligent.
It is a shame that they allow these agencies to recieve funding or for their IS / IT departments to still have jobs.
Lets stop talking about Filibusters and start talking National Security
Indeed, NetStumbler's help file even suggests such a scenario as one possible use for the program:
" Wireless LAN Auditing
A corporate network administrator needs assurance that the wired LAN is not being exposed to unauthorized users. This can often happen when users set up their own wireless LANs for convenience. Such wireless LANs often have little or no security, which poses a risk to the entire LAN. The network administrator can use NetStumbler to detect the presence of these "rogue" wireless LANs."
At least now that this story has hit the news, perhaps more people will wake up to the danger and try to secure their critical networks (as long as they leave open at least one for me to use as a wi-fi hotspot ;-)).
Laughter is the best medicine, but in certain situations the Heimlich maneuver may be more appropriate.
I'm always a bit doubtful of these surveys. Some companies run an open network, but to reach any network resources you need to set up a VPN. This avoids possible problems with air-side encryption (yes, I know there are many other solutions) and allows visitors to use the network.
The reason why radio frequencies keep leaking out of these government buildings is because they removed the lead paint from the walls. Now they are going to spend a few million USDs putting the lead paint back on the walls. No wonder the White House is complaining about leaks to the media.
Maybe in the next presidential elections concerning a power hungry, i-must-crush-my-opponent-candidate, there will be a wireless-tapping scandal that takes place in the parking lot of the Watergate hotel instead of the actual room.
Obviously, that sets up Forrest Gump II where the Forrest character spots a couple of geeks trying to jump start their van because their surveillance equpiment drained the battery.
porp
Precious few government agencies need wireless access anyway, and those who do generally know how to handle it.
Could you expand upon that comment please? Why don't government workers need laptops? They seem to make private sector high-tech workers more efficient, why shouldn't the government have access to these efficiencies? After all, government workers were the original Information Technology workers. They didn't just invent digital computers, but also made extensive use of pre-computer information technology.
About the only solution I've seen is the airFortress product that utilizes a client that encrypts all data and decrypts it through a hardware device that interfaces with the access points. Military has been using it for a bit.
So, some government agencies use unsecured wireless networks, and some people might even be leeching off of them for internet access. That might or might not be a real security issue, depending on if they're using their wireless network for sensitive applications and if those applications aren't using end-to-end encryption for their applications and if their wireless networks aren't firewalled away from the rest of their network. Perhaps the actual report describes the vulnerabilities in greater detail than this article, but I don't see how the mere presence of an unsecured wireless network is necessarily something to get worked up about.
I know many disagree with me on this, but personally I think that open WIFI networks is a very good thing. And I encourage all Wifi administrators to Open up their networks for all! This is quite safe if you secure the private services on the networks so random people only have access to the Internet. Think of it like this: You allow a few people to use the Internet from your home in exchange of being able to use the Internet when you are other places. If everybody with a Wifi does this then we will eventually have a global free Internet available everywhere for all. Again, having a Open Wifi is no threat to you IF you simply secure the services running on the Wifi! And this is, in fact, a much better approach than having a firewall and relying on that for security...
9/11: Never forget it was a false-flag operation
No, it should be tin, not aluminum. Does aluminum protect you from the mind-control rays of the secret government? No, but tin does. Does aluminum protect you from Bush's thought police? Nope, only tin can protect you. So, if we wrap all of the government buildings in tin, we'll all be safe from their harmful effects (except all the legislation, of course. However, if we forget to poke air holes...).
Some of the older posters might point out that "tin foil" caps were good enough to protect them from the government's mind control and thought reading devices of their day, "and it outta be good enough for you". I concur, however, "tin foil" no longer contains tin! Yes, it's really aluminum foil, and people just still call it tin foil. This was a plot by the government to fool people into believing that they were safe from government control. Soon, the black helicopters will be hovering over your doublewide as black-clad stormtroopers burst into your home and disappear you.
You were so close to being partialy right but your wrong. Yes, wimax devices can be made in the licensed spectrum, but they can also be used in the un-licensed spectrum. It is likley that we will see 5.8 Ghz wimax gear in the US as the "listen first" protocol required in the opening of 5.3 is not compatible with the polling protocol specified in the wimax standard.
CP
There is a wonderful solution to all of the wireless security issues:
802.11i
802.11i not only plus all of the holes in WEP, it also uses AES encryption to get around all of the potential problems with RC4.
Right now, as I speak, err write, I can not buy an 802.11i complient router with AES encryption. I've looked at Netgear's site. I've looked at Linksys's site. I've looked everywhere. There was a bunch of discussion about how 802.11i was going to be the next great thing in mid-2003, then a deafening silence.
If I want 802.11i right now, I can't get it.
I think the fact of the matter is the your average user is not willing to pay for than $50 for a wireless router. It is, of course, possible to make AES work fine with a router of that costs, but it is going to take good deal of economics of scale in action to make a 1,000,000-transistor chip for implementing AES affordable at that price point.
802.11i is just not a buzzword in the buzz machine that all the tech magazines use. Until it becomes a buzzword, wireless networks will continue to be insecure.
(There is also a lot to be said for 802.11i being deployed on a wide enough scale that AES becomes ubiquitous. I would like to see special AES-specific op codes on x86 chips and have $5 co-processors available that can do AES at 100Mbps)
How secure is secure enough? From what I can see in almost every office I've been in, finding a way to steal data (not necessarily digital format) is relatively easy. So should we really expect "perfect" security from WiFi networks?
/.'s use at home?
Clearly unencrypted wireless is out, WEP too. But how about WPA? I personally feel that running VPN over WiFi would be best, but for many small businesses, the added complexity is hard to justify.
Let me put this another way, what do
I don't suppose you really have any control left but when things are getting that bad it's your only sane option. (It's the only sane option when you're getting to 100+ clients anyway). Allowing users to design your IT infrastructure is pure madness, entropy inevitably turns your network to mush.
Even Windows Terminal Server expensive as it is, is better than 25,000 desktops. We use LTSP and an array of Linux and Sun servers[1] tied together with Sun Grid Engine[2] to provide what the users think of as a single system, "The Grid". It was a remarkably easy sale to management, but we were coming from a largely Unix environment. It's a bit more difficult with Windows, the array smallish servers approach is is far more expensive to implement than Linux.
[1] many of them ex workstations and desktops.
[2] Though Condor looks like a good option.
Deleted
Solutions exist to implement secure WiFi, but it comes with a cost.
Harris makes an encrypted PCMCIA 802.11b based card that has high grade encryption built in. It certainly makes the system impossible to get into, but they're far from cheap ($2k+).
Product: SecNet11
In the end, a lot of the exploitable networks comes from either poor management, lack of information or lack of control within government areas.
www.techwatch.com.au
A laptop without wireless is still a laptop. It isn't that difficult to use a network cable.
Of course it prevents you from bringing the laptop to the bathroom.
I have implemented wifi for several parks for a large city. We place the network on the outside of our internal network. We allow anyone to connect to the network after agreeing to a pop-up stating our acceptable use policy. Exactly how can this be conceived as insecure?
Check out the Army's wireless BBP:% 20Wireless%201_25(Final).pdf
http://www.igov.com/informationtech/contracts/BBP
I can't link to the original because it's behind Army infrastructure, but I found a link out in the real world. It's not too bad. On Army installations, you are required to do layer 2 encryption, which is pretty good. However, the "road warriors" are not required to do layer 2 on the road. Layer 2 is not an easy thing, as we are finding...
WiFi is insecure when used improperly
and in other news
The government is still a bloated inefficient model of stupidity
Water is still wet
and
New study proves that Fish's skin is wet
I will not give in to the terrorists. I will not become fearful.
Scratch that. I'll be heading to my local bookstore for a reading comprehension book posthaste. Do they make books about reading comprehension? That blows my mind.
Quoted from parent mod'd off-topic:
Sadly, I really do not blame those that come in through the back door when so many are simply stealing from the front door.
WindBourne has a technical point, at the end of his non-slashdot-compative rant: even before wireless became useful/cheap/widespread, many folks feared any physical connection to a nework that was "insecure"....for example, a Sun JumpStart server allowed (gasp) annonymous ftp access for images.
For what it does, displacing/replacing the cost and aesthetics of cat5 cable, wireless does a very bad job of it.
Quite apart from the security aspect, which was handled by slapping WEP on it, its a mess.
It can and does work with extremely simple networks (one transmitters, many receivers,) but it is absolutely terrible at topologies with repeators.
Apple's Airport and 'Bonjour' (previously called 'RendezVous') is one of the worst at letting you build network topologies.
I have scrapped my AirPort base and a couple of 'pucks' because I, a friend AND a network guy I paid for were unable to set up my network.
I am now running a network of Macs and Windows PC on a single LinkSys wireless router because I'd had one since moving to my new place and NOT laying down some cable.
It was simple, secure (WEP & destination addresses so only a few IP addresses are actually exposed and port filtering,) and easy to install.
As for AirPort, Apple's vaunted skills at GUI utterly failed them this time. Its a dogs breakfast of confusing and seemingly contradictory options, 'build' directions and concepts which just don't friggin work.
I'm out $300 bucks on the Airort equipment but two guys and myself are much wiser when it come to wireless. Friends don't let friends buy Airport.
Nice try Apple, but building networks should not be magic where you're never sure if doing one thing just undid another.
Your current GUI approach is totally inadequate, TOTALLY.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
If they can ever get away from the "use two consulting firms in an adversarial role" implementation model, they might see some benefits to their IT advances.
You better watch out, there may be dogs about . .
This might be "US citizen's-only" technically, but the report itself is available on the web here. It's a 1.5MB PDF. You can also request a free printed copy of this or any GAO report here. (This report is GAO-05-383.)
blarg.
Spot on. The other part is that the request for the toilet seat stated that it should be able to touch a human ass without freezing it at -10 degrees and still be cool to the touch at 125 degrees. Also needs to be equally comfortable for both sexes and should have a service life of 75 years.
"Want in one hand and spit in the other and see which one fills up first." - My Dad
At least, not at Goddard where I work. NASA used to be an easy target for crackers, but we've tightened up a lot since those days. Network security around here wardrives the grounds, and people with guns (!) will show up if they detect an unauthorized access point.
To a Lisp hacker, XML is S-expressions in drag.
also requires said "toilet seat" be an
1. integrated structural part of the airframe,
2. not release toxic gases on contact with combustion,
3. upon catastrophic failure not pose a physical hazard to the aircrew,
Apocalypse Cancelled, Sorry, No Ticket Refunds