Slashdot Mirror
New Security Ideas From Intel
Scott writes "Intel is developing a new technology that could prevent unauthorized access to wireless networks using the time it takes for packets to arrive from the access point to the Wi-Fi user. This is one of several ideas were presented at Intel Developer Forum. Intel has also released a hardware-based solution to fight against worm spreading. From the report: 'The system monitors the number of external connections being made and if a higher network activity is detected, the computer is disconnected to prevent the infection of further machines on the network.'"
is only as strong as the weakest link.. which in most cases is the user.
Hey, kudos to Intel for coming up with this stuff, but I suspect that the majority of people who buy a wi-fi router in the next five years will still not bother to even change the default admin password.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Security through proximity is not security at all.
No thank you. Don't decide for me what traffic I can generate.
You are not the customer.
The amount of time it takes for a packet to arrive could change because things other than physical distance from the access point. Like hardware latency, interference, etc. If it could be forgiving of these, perhaps the packet transfer time could only be so high, it may work. I haven't RTA yet, but I think there are betters ways to stop the spread of a worm. I think every machine on a network should be running a software firewall, not just a hardware firewall for incoming threats from the outside. With people bringing in floppies and USB storage devices, the attacks are coming from the inside. Why trust the inside? Windows desktops should have the firewall enabled. If you need available ports, allow them and nothing else. And IMHO if reasonable, run FreeBSD on your servers or something else with fewer attacks. Intel's solution will help, but still result in problems. It will have to be hardware-based or virii could stop it. A hardware-based solution could be very expensive, unless Intel wants to give it away, or bundle it with NIC's or CPUs.
Powered by caffeine and sugar; BSD
Crackers are developing new technologies to enable unauthorized access to wireless networks using the time it takes them to intercept and retransmit packets between the access point and the Wi-Fi user.
As for the "solution" of detecting worms by autokilling connections when bandwidth usage changes in a way that the software didn't predict, (in a way that's more likely to cripple your favorite P2P client software more than it's likely to disable a worm that decides to start slowly and ramp up), how about Intel gets off its sorry ass (if you felt a rant coming on, you were right) and comes up with a real solution to connection hijacking -- namely by implementing cryptographically strong authentication between client and access point at Layer 2 of the OSI model, not Layer 7.
Oh, right. Securing Layer 2 instead of Layer 7 would harm the interest of those in charge of writing Layers 8 (financial) and Layer 9 (political) of the 7-layer model.
What is there here that can't be done with software ?. Oh, wait .. that needs Microsoft to do it. Doing it at the WiFi card level might give intel an advantage - but most likely they'll just push this into the driver code. Then we're back to the "why doesn't Microsoft do this" - though in truth, we should chuck it and use Linux.
It essentially means that the moment I run bittorrent, Intel's new WiFi chip will throw me off the network. That's what it'll do for most of us.
> The access point times the time it takes a packet to arrive the client and go back. Using this time, the access point can predict the location of the user and tell whether a client device is inside or outside the allowed area, for example office wall.Similarly all Ethernet cards will have something that allows only packets addressed to it's MAC address to be read. And then someone will find out a way to work around that. I could rephrase when guns are outlawed, only outlaws will have guns - but this is even worse. Intel will create APs which have an artificially limited range to prevent you from taking your laptop to the crapper. This is almost like the userfriendly joke about laptops chained to the desk form of security.
Truly these are ideas to be sold, not products. Once people buy in on the security of these things, intel hopes to make a killing for no extra-work (yes, we have to buy the NEW secure WiFi cards and then just boot up that AP, let's get mailing status reports - leaving a router with "linksys" wide open). Security needs care and control - just cheap hacks on hardware will not do .Quidquid latine dictum sit, altum videtur
DOS attacks have just gotten easier.
http://www.rayn.net . Funny. Stuff.
I agree... about a year ago I did a quick wardrive around my mom's neighborhood (upper middle class suburb of Columbus, OH). I drove 3 blocks, and found 14 wireless networks. 10 were open. I tried using the default password for all of the router types (as identified by netstumbler), and it worked on 9 of the open networks... only 1 of the secured networks had not changed the default password.
......
What is the solution to this? I am hardly an expert on supply-side economics relating to production, but how hard would it be to set a random password for both the router and the wireless network? Include a piece of paper with both the password written on them (kind of like a manual addendum, that way each manual won't have to be customized). Or better yet, make the default password the serial number of the router. Extremely difficult to guess, usually a string of alpha and numerics, and the user could never really lose it (unless they removed the serial number sticker from the router).
There has to be a better way of doing things than what currently exists. To offer a product to consumers that has no security whatsoever in an out of the box condfiguration is moronic. Even more moronic is the fact that the consumer (I'm speaking in general terms of course) makes no effort to read the manual. You would think that logic would strike them in the face as they connect to their network for the first time...
"Oh, look, Windows automagically detected my wireless network!"
"Neat, now it's joined! That was easy..."
"Almost TOO easy"
*smack* (this is the sound of logic smacking them in the face)
"Wow, maybe I should do something so that it wouldn't be this easy for other people!"
Just like driving a car:
(D) to go forward
(R) to go backward
You could be right, but think of it this way, if your computer is involved in a DDOS, your main method of attack is sending as many SYN packets as your processor and upload will allow, so if your sending 1000SYN packets to every ACK then the network card says HELL NO! and the attack is ceased
While a good thought, you're forgetting how worms propagate themselves.
Usually these days they go in through a buffer overflow in some network application (such as P2P clients).
The bottom line is it's really hard to tell what's a virus and what's not (viruses tend to disguise themselves).
That's why they're trying out this method. Yes it's got some problems, especially for the home user, but for corporate situations this might work.
It all depends on how smart their algorithm is.
"Intel is developing a new technology that could prevent unauthorized access to wireless networks using the time it takes for packets to arrive from the access point to the Wi-Fi user."
As opposed to, say, enabling encryption?
"Intel has also released a hardware-based solution to fight against worm spreading."
The software-based solution is using a real OS. Another hardware-based solution is to refuse to run any Microsoft operating systems.
Windows won't be going away any time soon, so there will remain plenty of worm fodder. I am surprised by the number of relatively unsophisticated home users who are switching to Mac OS X or Linux as a result of adware, spyware, and worms, but I haven't seen the same switcher phenomenon occurring in corporations.
Besides, worms probably wouldn't go away even if Windows did. Although conventional wisdom says that a large pool of exploitable systems is required for successful worm propagation, that's not true, demonstrated by the Witty Worm's exploitation of a very small population of vulnerable systems. Although they are not as common, worms have exploited other, non-Windows systems and application software, and certainly buffer overflow exploits are discovered periodically in such systems. Granted, the UNIX architecture makes worm exploitation of application software less likely to result in super-user access, but routers, DNS servers, and others remain vulnerable to the extent that they contain worm-able security defects -- and clearly many do.
Worms are getting more sophisticated all the time. From the starting point of their current capabilities, worms and botnets could easily be extended to automatically harvest particular types of data from particular companies or government agencies, using the chaos of a massive worm outbreak for cover. Their ability to receive arbitrary commands from remote attackers over IRC control channels means that they may already be in use for this purpose.
My company specializes in antiworm technology and consulting. The FireBreak AntiWorm system impedes worm propagation without interfering with normal network operations -- including bit torrent.
There is a tremendous amount of innovation going in in the software security area lately, driven by the relatively recent realization among large corporations that they must now spend money on worm prevention, containment, and recovery if they want their heavy investment in the Windows monoculture to survive.
Opting out of the monoculture simply isn't feasible for most large corporations at this point. It's not just the cost of the desktop PC -- if that's all it was, a bunch of them would have switched en masse to Mac OS X Tiger when it came out. The applications, the developers who write them, the help-desk workers, the system administrators, the managers, the employees -- at this point all they know is Windows.
Switching a desktop is so hard for a large company, that the survival of the Windows monoculture is virtually assured for about as long as one can predict anything in the IT world (5 years, I'm told). The the problems that come with it will be creating market opportunities for a long while to come.
If you mod me down, I shall become more powerful than you could possibly imagine.
Intel is developing a new technology that could prevent unauthorized access to wireless networks
There already exist a number of methods for preventing unauthorized access to wireless networks: stopping SSID broadcasting, filtering MAC addresses, WPA, and even IPSEC for the paranoid. People already don't use what is available because they don't think it is important. What makes Intel think they will use this? It seems to me that the automatic response to security mechanism these days is "turn it off, it's too confusing and we aren't trying to hide anything." A lot of people just don't understand that their passwords and credit card numbers are being sent over the airwaves in cleartext and can be easily intercepted unless you use the security features of your access point.
So how long before your ISP picks it up? Think of upload caps, port blocks and smtp jails as other "technologies" that piss users off and don't do anything for security.
Friends don't help friends install M$ junk.