Evolution of Wireless Security

Size: px

Start display at page:

Download "Evolution of Wireless Security"

Everett Crawford
7 years ago
Views:

1 Stephen J. Esposito, II Computing Specialist Y-12 National Security Complex August 9, 2007 DISCLAIMER This work of authorship and those incorporated herein were prepared by Contractor as accounts of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor Contractor, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, use made, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency or Contractor thereof. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency or Contractor thereof.

2 Introduction Definition of wireless Scope of this talk Security principles Risks Countermeasures Conclusion 2

3 Definition Transfer of information without the use of electrical conductors Types Microwave Infrared Radio Frequency (RF) Applications Personal Area Networks (PANs) Local Area Networks (LANs) 3

4 Common Technologies RFID - tagging ZigBee industrial IrDA point-to-point Bluetooth personal area networks Wireless USB - desktop a/g/b local area networks Wi-Max wide area networks 4

5 Scope Wi-Fi (IEEE ) a Not common 54 Mb/s 5 GHz b Common 11 Mb/s 2.4 GHz g Common 54 Mb/s 2.4 GHz 5

6 Security principles Wireless almost exactly like wired Implement same security measures Lose physical control Like putting an Ethernet port in the parking lot Confidentiality Authentication Defense in depth 6

7 Risks Introduction of new hardware Broadcast beyond physical security boundary Information sent in the clear Unauthenticated Denial of service 7

8 Introduction of new hardware Problem with any new hardware Exploit driver flaws Can result in remote code execution Affects major vendors Intel Centrino (CS ) Broadcom (MOKB ) Keep drivers and firmware up to date 8

9 Eavesdropping (sniffing) Passive and undetectable Outside physical boundaries Long range Trivial to read unencrypted data Collect encrypted packets to attack 9

10 Unauthenticated Access points cannot authenticate clients Clients cannot authenticate access points Unauthorized client connections Man-in-the-middle or rogue access points 10

11 Denial of service (DoS) Inexpensive Easy Effective Contingency planning Redundancy 11

12 Evolution of wireless security Static network configuration Disable SSID Broadcast MAC filtering WEP WPA WPA2 VPN Wireless IDS/IPS 12

13 Static network configuration Administrators statically configure clients Disable DHCP Static IP, subnet mask, gateway, DNS server addresses, etc. Pro: requires attacker to obtain information and configure system Cons High administrative overhead Trivial to obtain information Trivial to reconfigure system Trivial to disable legitimate client No confidentiality or authentication Security through obscurity Recommendation: No, little security benefit, high administrative overhead 13

14 Disable SSID broadcast Access points (APs) normally broadcast SSID so clients can detect network Disabling SSID broadcast requires administrator to manually configure clients Pros Harder to detect presence of wireless network Client must be manually configured Cons Trivial to detect wireless network Trivial to configure SSID Recommendation: No, can interrupt legitimate clients, little security benefit 14

15 MAC filtering APs allow access to known MAC addresses, deny access to others Pro: limits access to only known clients Cons Trivial to detect allowed MACs MAC spoofing DoS legitimate client or wait for it to disconnect Recommendation: Yes for small and stable client list, no for large or dynamic client list 15

16 Wired Equivalent Privacy (WEP) Attempts to provide confidentiality and integrity CRC-32 integrity checksum RC4 encryption algorithm with 24-bit IV Pros Traffic is encrypted Packet integrity Repels unmotivated attackers Cons Encryption easily defeated Integrity easily defeated Recommendation: No, easily defeated, unless no other method is possible 16

17 Wi-Fi Protected Access (WPA) Response to weaknesses in WEP Michael Message Integrity Code (MIC) RC4 with 48-bit IV 802.1X authentication or pre-shared key (PSK) Pros Better confidentiality Better integrity Good authentication Cons Weakness in Michael Weakness in RC4 Recommendation: Yes unless WPA2 is available 17

18 Wi-Fi Protected Access 2 (WPA2) Real response to weaknesses in WEP Advanced Encryption Standard (AES) encryption and integrity 802.1X authentication or PSK Pros Best confidentiality Best integrity Good authentication Cons May require new hardware Recommendation: Yes unless not capable 18

19 Virtual Private Network Tunneling encrypted traffic over the wireless network Treat wireless network and clients like the Internet Pros Already implemented at most sites for mobile clients Can be implemented on devices not supporting WPA or WPA2 Easy Cons Some attacks against a/b/g protocol CPU useage Recommendation: Yes if not using WPA2 19

20 Wireless VPN diagram 20

21 Wireless Intrusion Detection and Prevention System Detect and/or prevent wireless intrusion attempts Pros Situational awareness Policy enforcement Active protection Cons Expensive May interfere with legitimate traffic Recommendation: Yes if affordable 21

22 Conclusion Wireless is not that different from wired Utilize good wired practices Manage risk Keep up with driver and firmware updates Implement WPA2 or a VPN Have a contingency plan Implement intrusion detection and prevention if possible 22

23 Questions? Stephen J. Esposito, II

Wireless Network Security. Pat Wilbur Wireless Networks March 30, 2007

Wireless Network Security. Pat Wilbur Wireless Networks March 30, 2007 Wireless Network Security Pat Wilbur Wireless Networks March 30, 2007 Types of Attacks Intrusion gain unauthorized access to a network in order to use the network or Internet connection Types of Attacks