Wi-Fi - living with security holes
The DoS problem is just one of several.
By Thomas Wailgum, CIO Magazine | Computerworld UK | Published: 13:55, 17 September 2004
In May, news came from Australia that caught the world's Wi-Fi users completely off guard: A trio of PhD students at the Queensland University of Technology had < ahref="http://www.techworld.com/mobility/news/index.cfm?NewsID=1551">discovered an indefensible denial-of-service flaw in the 802.11b network protocol. The group, led by associate professor Mark Looi, had accidentally uncovered the vulnerability back in November 2003 while investigating a previously known wireless flaw. Looi immediately contacted the Australian Computer Emergency Response Team (AusCERT), and that group, in turn, contacted other computer security organisations around the globe, including US-CERT. After eight weeks of verifying that the flaw was indeed fatal, Looi notified the major wireless LAN vendors in January 2004. Working under a nondisclosure agreement, Looi, his team, the CERTs and WLAN vendors tried to find a fix.
The vulnerability lay in the 802.11 wireless network protocol, which uses a Clear Channel Assessment (CCA) algorithm to determine whether radio channels are clear so that network devices can use them to transmit data. The group discovered that the CCA algorithm, which works in conjunction with Direct Sequence Spread Spectrum (DSSS) transmission, was vulnerable to an attack by specially crafted radio signals that would trick the algorithm into thinking a channel was busy. As a result, no device in range of the jamming signal would be able to transmit data. All an attacker needed was to be within a couple hundred feet of his target and to have enough know-how to work his PDA and a cheap wireless card. "Prior to this [discovery], all denial-of-service wireless attacks have relied on specialist equipment," Looi says. "This denial-of-service attack needs nothing more than easily available consumer-grade hardware."
Unlike other Wi-Fi vulnerabilities, this one was not a product of bad security or human error. Any 802.11 DSSS device was vulnerable (including the newer 802.11g when running at lower speeds). And six months after the flaw's discovery, AusCERT and US-CERT issued a worldwide alert on May 13. But the response from the Wi-Fi community to Looi's thunder from down under was more akin to heat lightning -- a flash but no boom.
It appears that too many people have too much riding on the Wi-Fi wave for anything to slow it down, even an unfixable flaw. And it has been argued that it is actually quite easy to defend against attacks which use the flaw.
What wireless problems are IT managers really worrying about? Here are some comments from experienced Wi-Fi users. There's a handy guide to the answers in our How-To section.
Rogue users connecting their unauthorised Wi-Fi access points to your network. Attackers launching a coordinated denial-of-service attack from your company's parking lot. Intruders sneaking onto the network through a back door left open by a user. Those are just some of the things that UPS's Director of Global Network Services John Killeen worries about.
UPS has been using wireless since well before the 802.11b standard arrived and -- with some 90,000 wireless devices in service -- has woven the technology into its operations (read our case study on the Bluetooth/Wi-Fi tracking system it uses). "With the 802.11b rollout, IT was directly involved in implementing the solution," says Killeen. "Having IT involved has made security easier, but an organisation the size of UPS is no different than any other organisation."
Killeen was very much aware of the recent Wi-Fi news from Australia. "It certainly got our attention," he says. "We worked with our integrator, Symbol Technologies, in evaluating that the vulnerability was real, and whether or not it could impact us." It was real, and an attack could hurt the mobile infrastructure at one of UPS's facilities. But Killeen also knows that a lone intruder exploiting the flaw could affect only one access point, and his infrastructure has multichannel and redundancy capabilities to mitigate the attack. UPS is currently in the middle of a huge Wi-Fi deployment- with some 15,000 access points in 1,700 offices - and security is atop Killeen's mind.
Closing the doors
Images such as the attacker in the parking lot or the intruder in a building just across the street have become mainstays in Wi-Fi security lore. But for those attackers to break in, they need an entry point. And that's where your users come in. Gene Fredricksen, CISO of Raymond James Financial, a financial services company, is in the throes of implementing Wi-Fi at the corporate headquarters, with plans to roll it out to the rest of the field offices. His security concerns are mostly user-driven: unauthorised access points, misconfigured devices and impatient users. "As soon as you can buy (a Wi-Fi device) at Best Buy or Circuit City, the end user can't understand why the technology department isn't deploying it," says Fredricksen. "We're currently trying to seek out and disable rogue access points - and that's anything that's not approved by the company. Those access points are a concern."
Not surprisingly, users can create other worries. How about the mobile user who brings his wireless-enabled laptop back into the office after using his Wi-Fi connection at his home? If his home Wi-Fi setup doesn't have the appropriate security measures - that is, he isn't using a personal firewall or VPN encryption - then chances are if anyone is scanning your office, probing for a vulnerable connection, his laptop can provide the bridge to the company's network.
"Everyone's been focusing on the access point as the intrusion point. But no one's looking at the client," says Ryan Crum, a wireless security specialist at PricewaterhouseCoopers. "It's just as big of an issue because everybody's mobile these days." Crum mentions a tactic called wireless phishing, where a hacker sets up a fake T-Mobile access point while sitting in a retail establishment that offers a T-Mobile hot spot. The fake log-in screen looks similar to the Wi-Fi users, so they naturally log in their corporate ID and password. "How do you know that it's not authentic?" asks Crum.
Together, those are enough nightmares to keep IT managers who are venturing down the Wi-Fi path awake at night. Find a guide to the answers in our How-To section.