In May, news came from Australia that caught the world’s Wi-Fi users completely off guard: A trio of PhD students at the Queensland University of Technology had discovered an indefensible denial-of-service flaw in the 802.11b network protocol. The group, led by associate professor Mark Looi, had accidentally uncovered the vulnerability back in November 2003 while investigating a previously known wireless flaw.
Looi immediately contacted the Australian Computer Emergency Response Team (AusCERT), and that group, in turn, contacted other computer security organizations around the globe, including US-CERT. After eight weeks of verifying that the flaw was indeed fatal, Looi notified the major wireless LAN vendors in January 2004. Working under a nondisclosure agreement, Looi, his team, the CERTs and WLAN vendors tried to find a fix.
They couldn’t.
The vulnerability lay in the 802.11 wireless network protocol, which uses a Clear Channel Assessment (CCA) algorithm to determine whether radio channels are clear so that network devices can use them to transmit data. The group discovered that the CCA algorithm, which works in conjunction with Direct Sequence Spread Spectrum (DSSS) transmission, was vulnerable to an attack by specially crafted radio signals that would trick the algorithm into thinking a channel was busy. As a result, no device in range of the jamming signal would be able to transmit data. All an attacker needed was to be within a couple hundred feet of his target and to have enough know-how to work his PDA and US$40 wireless card. “Prior to this (discovery), all denial-of-service wireless attacks have relied on specialist equipment,” Looi says. “This denial-of-service attack needs nothing more than easily available consumer-grade hardware.”
Unlike other Wi-Fi vulnerabilities, this one was not a product of bad security or human error. Any 802.11 DSSS device was vulnerable — including the newer 802.11g when running at lower speeds. And six months after the flaw’s discovery, AusCERT and US-CERT issued a worldwide alert on May 13. But the response from the Wi-Fi community to Looi’s thunder from down under was more akin to heat lightning — a flash but no boom.
It appears that too many people have too much riding on the Wi-Fi wave for anything to slow it down, even an unfixable flaw. But what, in fact, is essential to good Wi-Fi security? If you’re thinking about a rollout or even if you already have Wi-Fi up and running, here’s what you need to worry about and what you can do to ease your anxiety.
Wireless worries
Rogue users connecting their unauthorized Wi-Fi access points to your network. Attackers launching a coordinated denial-of-service attack from your company’s parking lot. Intruders sneaking onto the network through a back door left open by a user. Those are just some of the things that UPS Inc.’s Director of Global Network Services John Killeen worries about.
UPS has been using wireless since well before the 802.11b standard arrived and — with some 90,000 wireless devices in service — has woven the technology into its operations. “With the 802.11b rollout, IT was directly involved in implementing the solution,” says Killeen. “Having IT involved has made security easier, but an organization the size of UPS is no different than any other organization.”
Killeen was very much aware of the recent Wi-Fi news from Australia. “It certainly got our attention,” he says. “We worked with our integrator, Symbol Technologies, in evaluating that the vulnerability was real, and whether or not it could impact us.” It was real, and an attack could hurt the mobile infrastructure at one of UPS’s facilities. But Killeen also knows that a lone intruder exploiting the flaw could affect only one access point, and his infrastructure has multichannel and redundancy capabilities to mitigate the attack. UPS is currently in the middle of a huge Wi-Fi deployment — with some 15,000 access points in 1,700 facilities — and security is atop Killeen’s mind.
Closing the doors
Images such as the attacker in the parking lot or the intruder in a building just across the street have become mainstays in Wi-Fi security lore. But for those attackers to break in, they need an entry point. And that’s where your users come in. Gene Fredricksen, CISO of Raymond James Financial Inc., a financial services company, is in the throes of implementing Wi-Fi at the corporate headquarters, with plans to roll it out to the rest of the field offices. His security concerns are mostly user-driven: unauthorized access points, misconfigured devices and impatient users. “As soon as you can buy (a Wi-Fi device) at Best Buy or Circuit City, the end user can’t understand why the technology department isn’t deploying it,” says Fredricksen.
“We’re currently trying to seek out and disable rogue access points — and that’s anything that’s not approved by the company. Those access points are a concern.”
Not surprisingly, users can create other worries. How about the mobile user who brings his wireless-enabled laptop back into the office after using his Wi-Fi connection at his home? If his home Wi-Fi setup doesn’t have the appropriate security measures — that is, he isn’t using a personal firewall or VPN encryption — then chances are if anyone is scanning your office, probing for a vulnerable connection, his laptop can provide the bridge to the company’s network.
“Everyone’s been focusing on the access point as the intrusion point. But no one’s looking at the client,” says Ryan Crum, a wireless security specialist at PricewaterhouseCoopers. “It’s just as big of an issue because everybody’s mobile these days.” Crum mentions a tactic called wireless phishing, where a hacker sets up a fake T-Mobile access point while sitting in a retail establishment that offers a T-Mobile hot spot. The fake log-in screen looks similar to the Wi-Fi users, so they naturally log in their corporate ID and password. “How do you know that it’s not authentic?” asks Crum.
Together, those are enough nightmares to keep CIOs who are venturing down the Wi-Fi path awake at night. Here’s how to get some rest.
Controlled airspace
In the future, Frequency Selective Surface panels from the likes of BAE Systems PLC might be able to keep your wireless traffic in-house and wireless intruders out. But until this so-called stealth wallpaper — which blocks specific radio frequencies — becomes commercially available, you’ll need to approach wireless security with more mundane techniques.
First off, most Wi-Fi devotees say that CIOs shouldn’t fight Wi-Fi. The technology’s low cost and simplicity make outright bans impossible to enforce. Therefore, developing a sound strategy to control Wi-Fi’s proliferation is all the more critical for CIOs. “We knew wireless was coming. We knew it was a legitimate business need. We knew we had to do something,” says Fredricksen. “But out-of-the-box wireless is absolutely contrary to the security controls we have put in place.” So Fredricksen went back to the basics.
“We applied the same security baselines to the wireless initiative that we apply to all of our other projects,” he says.
Alternate routes
Regarding the denial-of-service flaw, Fredricksen says, “There would always be an alternate way to get the business done,” whether users would have to switch to a wired connection or go to an offsite kiosk. But, he concedes, you have to ask yourself one tough question: “If you had a branch become 100 per cent wireless, how devastating could [an attack] be?”
To mitigate that scenario, a thorough and well-understood wireless policy is critical. “From the CIO perspective, you have to have the appropriate staff and technology solutions,” says Ollie Whitehouse, technical director of @Stake Inc.’s United Kingdom division. “You also have to have a policy and procedure to back it all up. If not, the first two are useless in the end.” That policy should at the very least cover network and device management, as well as monitoring and enforcement mechanisms. CIOs also need to weigh the risks involved with placing your company’s most sensitive information up on a Wi-Fi network — for example, consider the health-care, government and financial sectors. If the information is mission-critical to the business or if your company operates in a heavily regulated industry, security becomes even more paramount.
New management
CIOs need to make certain that attackers cannot get to the hardwired corporate network through a WLAN hole. “You always have to be thinking about how you can narrow the aperture of the target space without hurting your business,” says Tim Keanini, CTO of nCircle Network Security Inc., a network security vendor.
“You have to assume an opponent is actively trying to find your flaws.” That means unauthorized access points need to be found and terminated, and authorized access points need to be situated in areas where the radio frequency footprint isn’t extending beyond your offices. Default security settings on Wi-Fi-enabled laptops and handhelds need to be cranked up to your company’s standard security levels. Those devices also need to be running, at the very least, these security programs: For user authentication, use Media Access Control (MAC) filtering; for Radius authentication and authorization, use Kerberos or smart keys; and for encryption, use Wi-Fi Protected Access (WPA) or virtual private network (VPN). Also, make sure that ad hoc or peer-to-peer Wi-Fi connections are not permitted on mobile users’ laptops.
“The Wi-Fi communications medium can be made secure,” says Whitehouse. “You can make the transfer of data through the air secure.”
Rigid enforcement
One of the more crucial steps in ensuring Wi-Fi security is monitoring your company’s airwaves. And it’s also the one on which most companies trip. For those companies that say “No Wi-Fi,” security experts offer a test: Scan your building for Wi-Fi access points using a sniffer tool, and most likely, you’ll find some hot spots. “How do you really know [you don’t have rogue Wi-Fi users] if you aren’t monitoring your systems?” asks Anil Khatod president and CEO of AirDefense Inc., a wireless security vendor. “How do you enforce the policies?” He says that around a third of the companies using AirDefense’s wireless monitoring products have a policy of no WLANs; they’re simply trying to enforce the policy.
Wireless intrusion detection systems now being offered by a handful of vendors — including AirDefense, AirMagnet Inc., AirWave Wireless and Internet Security Systems Inc. — can provide another layer of Wi-Fi security. These systems can detect attackers, rogue access points, unusual network occurrences and, as Whitehouse terms it, allow a certain level of compliance assurance. “This compliance assurance comes from such things as allowing enterprises to detect misconfigured devices that may expose the wired enterprise network to attackers,” he says.
So Looi’s denial-of-service discovery lingers in the Wi-Fi world, unfixed. But many users claim that they will deal with this problem as they have dealt with other Wi-Fi vulnerabilities — with proven security practices, communication with users and hopefully a bit of luck.
