802.11 Security

Inherent Insecurity

Data in conventional networks travels across wired mediums. Coaxial cable, twisted pairs of copper wire, and strands of fiber optics have been the foundation for networks for many years. In order to view, interrupt, or manipulate the data being transmitted, the wires or switching equipment have to be physically accessed or compromised.

Tip

An attacker does not need to physically tap into wired communication in order to eavesdrop on it. Wired communication that uses electrons to transmit data (such as phone calls and 10BaseT Ethernet) radiates small amounts of electromagnetic energy. With highly sophisticated equipment, an attacker can reconstruct the original data stream from the radiated energy. The skill required to pull off this attack as well as the relative proximity the attack requires, however, makes it highly unlikely.

Restrictions on physical access to network cables have been a cornerstone of information security. While physical protection of cables obviously does not solve all the network security problems, it helps mitigate the risk of certain man-in-the-middle (MITM) attacks. Wires are relatively easy to keep physically secure. Placing wires inside of a controlled space such as a data center keeps the physical layer secure from the majority of attackers.

When using radio frequency (RF) communication channels such as a WLAN, users lose the fundamental physical security given to them by wires. WLANs use high frequency radio waves to transmit their data. These RF waves travel through the air and are difficult to physically constrain. RF waves can pass through walls, under cracks in doors, across streets, and into other buildings. Even if a wireless access point is located inside a physically controlled data center, the wireless data may leave the bounds of the data center into uncontrolled spaces, as shown in Figure 1-3.

Figure 1-3. Wireless signals travel outside of controlled areas

Data on 802.11 networks can be intercepted from large distances if the attacker has line of sight. Peter Shipley, a security professional who performed some early research into wireless security, was able to eavesdrop on wireless networks in downtown San Francisco from the hills of Berkeley. That’s a distance of over 20 miles! For more info on Peter’s research, see his web site at http://www.dis.org/wl/maps/.

War Driving

Attackers use many methods to gather information on computer systems that they may attack. There are automated tools to scan various networks for the existence of computer systems that may be good targets.

Before the large-scale adoption of the Internet, attackers would use automated scripts to dial large blocks of phone numbers in an effort to find modems. If the script found a modem, it would log various information about it (the number dialed, any prompt that was given, etc.), then move on to the next number. After the script was completed, the attacker could examine the output and determine numbers that may warrant further investigation. This practice of dialing in bulk became known as war dialing.

As the Internet gained popularity, attackers found a more efficient way to find interesting systems. By scanning large blocks of IP space for hosts and scanning those hosts for services, attackers could find weak systems to attack. This practice, known as port scanning, is very common and very effective.

WLANs have now become the target of mass data harvesting scripts that aim to accomplish the same goal. Using specialized software, a GPS, and a wireless-enabled laptop, an attacker can drive through a metropolitan area looking for wireless access points. The software logs varied information about the access points including latitude, longitude, and configuration. After logging all of this data, an attacker can examine the results to find a vulnerable WLAN. This practice has come to be known as war driving, due to its similarity to its phone-system-based predecessor.

Due to the lack of physical control of where the wireless network data may end up, WLANs create special risks for users, administrators, and owners. Eavesdroppers many miles away may be able to intercept sensitive information or access machines that would be otherwise be protected by a firewall. When deploying a wireless network, the fundamental insecurity of the physical medium should drive the overall architecture.