Slashdot Mirror
IBM To Unveil Secure Open Wireless At Black Hat
Trailrunner7 writes "Researchers from IBM's ISS X-Force plan to unveil a new system for running an open wireless network in a secure mode at the Black Hat conference here this week. The system mimics the way that Web sites browsers use digital certificates to establish a trusted connection with one another. X-Force researchers have been working on the system for a while now and the company plans to demonstrate the technology on Thursday during the conference. One of the main problems with public wireless networks is that they're susceptible to a number of simple attacks, including passive sniffing and man-in-the-middle. The X-Force system is designed to get around these problems by using a digital certificate to assure users that they are communicating with the wireless hotspot that they think they are."
They've been working on a system for a while to mimic technology that already exists and can already be purchased Best Buy. Solid work IBM. Digital Certificates! Who would'a thought of that!
Isn't a non broadcasting SSID technically secure? I mean devices will still see the network, but without the SSID of the router, accessing it becomes impossible right?
Whenever a player quits EVE to go play WoW, the Average IQ of both games increase.
One of the main problems with public wireless networks is that they're susceptible to a number of simple attacks, including passive sniffing and man-in-the-middle. The X-Force system is designed to get around these problems by using a digital certificate to assure users that they are communicating with the wireless hotspot that they think they are.
So... How do I get the digital certificate of the wireless hotspot that I think I'm communicating with? How do I even know which hotspot I am communicating with?
When our name is on the back of your car, we're behind you all the way!
I assume "open, but secure" means that anyone can join, but no one can see anyone else's traffic. Isn't this trivial to achieve by giving each connection a VPN back to the wifi router?
Give me Classic Slashdot or give me death!
"IBM To Unveil Open Wireless that is more secure than what's currently available At Black Hat"
Any wireless network is vulnerable to sniffing. It may be very much harder to attack but it's still vulnerable. As far as man-in-the-middle attacks, I'd have to read a lot more on the actual implementation to see how they address this. Digital certificates can be forged. How easy that is depends on the implementation of the certificate.
I have no doubt this is a more secure network. But security is a relative thing. There is (almost) no such thing as a completely secure wireless network.
> susceptible to a number of simple attacks, including passive sniffing and man-in-the-middle.
<sarcasm>because we all know that ethernet based networks are completely immune to this kinds of attacks</sarcasm>
Routing for whole subnets have been hijacked in the past! The solution is wide deployment of DNSSEC and HTTPS, not making inherently insecure networks secure, that is not possible in the Internet.
"For example, IBM could set up an open wireless network with the SSID 'ibm.com.' When you connect, our access point would send down a digital certificate for 'ibm.com,' and your wireless client would establish an encrypted connection with us, knowing that because the name in the certificate is the same as the SSID, the network you are connecting to must be run by IBM.
For serious? Because the SSID is ibm.com and that matches the certificate, you know its run by IBM? Isn't it more than possible to to simply name your SSID whatever the hell you want (i.e. ibm.com) and relatively easy to obtain the digital certificate to match? Simply by connecting to a real ibm.com served AP. That's prevented on the Internet because typing in www.ibm.com directs you to ibm.com, presuming your DNS can be trusted. But WiFi SSID? Absolutely nothing certifies that "ibm.com", as an SSID, directs to anything run by IBM, in any way. And unless they are using some different system of certificate management, obtaining the public digital certificate is trivially easy. All this will do is make it look like untrustworthy APs are trustworthy. And that is very bad.
Is there any way at all in which such a system gives anything but the illusion of security?
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
I wonder who will be the first to make a soho wireless router with self signed certs.
Having to work for a living is the root of all evil.
It sounds like they have chosen a reasonable venue for torture testing their new tech.
It'll be interesting to see how long their shiny new system survives in the "most hostile wireless networking environment on the planet"
---
"I can't complain, but sometimes still do..." Joe Walsh
Anyone want to take bets on how long it takes for a room full of black hats to take this thing down?
"We are just a war away from Amerikastan. When god vs god the undoing of man." Dave Mustaine
One additional thing the article doesn't mention - Open Secure Wireless was originally an idea proposed by Christopher Byrd, who is helping to demonstrate the technology along with IBM at Black Hat. More information about the proposal including additional details is available at http://riosec.com/open-secure-wireless
http://slashdot.org/submission/1241738/Open-Secure-Wireless-for-Hotspots
If Verisign won't do it, some other "reputable" (i.e. trusted by Microsoft OS) CA will sign it. How many users will see that and think "maybe it isn't really IBM".
To make it worse, IBM's IT probably won't want their private key on every hotspot so they will use something like publicwireless.ibm.com. I didn't read the article, so maybe they have a way to handle authentication from a central location (e.g. the ibm.com web server) rather than at each hotspot.
IBM is not, in fact is the antithesis, of who I think of when I think of who might be attending a Black Hat convention.
Seriously. Just who thinks they're all badass and rebellious when they're hiring the Empire to hook up their wi-fi?
What if you used proper WPA2 wifi but gave dhcp subnets of like 255.255.255.255 and then specifically set it such that you couldn't get routed between users. Should be pretty secure then?
Do we really need wireless security standards? The option of using an encrypted tunnel on top of the wireless connection has been around since forever, is far more flexible in terms of security and makes WEP, WPA etc effectively redundant.
Isn't what does wpa-eap ?
http://tw.seattle.intel-research.net/index.php?title=SlyFi
Why not devise better (realistic) solutions for end-to-end encryption. If I have authenticated/encrypted traffic to an end-point, then there's a limit to what information can be sniffed from an open wifi connection. If you come up with easier wifi encryption, then you still don't know what's happening once your traffic has been received by the wireless access point.
Or am I missing the point?
I've been running secure open WiFi networks for the past three years. Using hostapd and a patched radius server to ignore the password. I.e. the user asks for a connection, gets the certificate from the radius server through EAP, then the user is prompted for a username/password. The user is allowed to enter *any* username and *any* password, the "authentication" proceeds and simply grants access.
Presto, open WiFi, with private WPA2 encryption per client, and an SSL certificate from the access point which can be validated against. I don't know what IBM et al have been doing, but this is readily available tech (patching the radius server was/is not exactly rocket science) and it works since 2008, and it certainly is nothing exciting to get all fussy about at a black hat conference.
I see that they have a patent pending; this must be a joke (then again, the whole software patent system is a joke).
Roaming is a pain. It' a pain to choose a closed network, a closed network with a well-known password, a passwordless open network or several passwordless networks that will redirect you to a captive portal that can ask you for different sums of money or your address and the number of your passport (true story). That is before you consider that anyone in your vicinity can configure your expected SSID and middle-man your password and everything else. Ask yourselves where you want mobile access to be in ten or twenty years. Answer: hassle-free. You may want to choose your hotspot based on performance or price or simply because it's yours, but roaming far from home in an era of not-quite-ubiquitous Internet, you most probably just want one that works.
Redesign authentication using client certificates so that the user's ISP can authenticate the user directly for any hotspot. The hotspots would simply keep a list of approved CA certificates. You'd insert the name of the ISP's authentication servers into the ISP CA certificate into the client certificate.
You could add in a option for mandatory VPN direct to the ISP. It could be made mandatory by the user or by the hotspot. The hotspot provider would then not have to keep user logs and worry about responsibility and source ports and otherwise identifying abuse. The user would have his VPN, his own IP address, could roam almost seamlessly over hotspots belonging to different owners, and would not care about choosing the hotspot based upon the confidence that the hotspot operator will not sniff or use a sniffable upstream.
You could add in a fee (advertised through the SSID?) that would be put on the user's ISP bill and transferred to the hotspot operator. The ISP would need the address to send the money, but that can also be put in the authentication procedure. If the connection is mandatory VPN there can't even be disputes about the amount to bill, since the hotspot and the ISP should have the same amount.
Seems like a reasonable technical approach, but the problem is clearly with adoption.
AFAIK, IBM does not make wireless access points, and it's probably going to be hard to get the IEEE to adopt the mechanism (esp. if patented and restricted) as part of the 802.11x standards.
Looks like the team there recognizes this as a key challenge. See the bottom of this post: A new solution to wireless security issues