DESIGNING AND DEPLOYING SECURE WIRELESS LANS. Karl McDermott Cisco Systems Ireland

Transcription

1 DESIGNING AND DEPLOYING SECURE WIRELESS LANS Karl McDermott Cisco Systems Ireland 1

2 Agenda Wireless LAN Security Overview WLAN Security Authentication and Encryption Radio Monitoring Intrusion Detection Services Location Services and RFID Tracking 2

3 Why WLAN Security Is Important? Vulnerabilities: Hackers Employees Lessons: War Driving Do not rely on basic WEP encryption; Requirement for Enterprise class Security (WPA, EAP/802.1x protocols, Wireless IDS, VLANs/SSIDs, etc) Employees will install WLAN equipment on their own (compromises security of your entire network) Out of the box configuration of APs: All security features are disabled! Business impact due to stolen data: Potential financial and legal consequences (Laws to protect data confidentiality; Example: Healthcare) 3

4 WLAN Security Vulnerabilities and Threats Different forms of Vulnerabilities and Threats Exist Encryption Vulnerabilities: WEP Authentication Vulnerabilities: Shared-Key authentication, Dictionary attacks, and MITM attacks WLAN Sniffing and SSID Broadcasting Address Spoofing: Mac-address spoofing and IP address spoofing (both hostile/outsider attacks as well as insider attacks) Misconfigured APs and Clients Denial of Service (DoS) attacks: Using deauthentication/ disassociation frames, RF jamming, etc. 4

5 Bit Flipping Vulnerability Access Point Attacker ICV Bit Flipped Frame WEP Bit Flipped Frame Pass Layer 3 Receiver CRC Fail Ciphertext Error Msg WEP Plaintext Error Msg Predicted Plaintext Error Msg XOR Key Stream Ciphertext Error Msg 5

6 WLAN Sniffing and SSID Broadcasting Disabling SSID Broadcast should not be considered a security mechanism- Potential attackers can uncover your SSID by observing probe responses! 6

7 Unknown WLANS - Rogue AP Frustrated insider User that installs wireless AP in order to benefit from increased efficiency and convenience it offers Common because of wide availability of low cost APs Usually ignorant of AP security configuration, default configuration most common Malicious hacker Penetrates physical security specifically to install a rogue AP Can customize AP to hide it from detection tools Hard to detect more effective to prevent via 802.1x and physical security More likely to install LINUX box than an AP >99.9% of Rogue APs Jones from Accounting <.1% of Rogue APs 7

9 security approaches Open network SSID can be captured with passive monitoring MAC filtering WEP MACs can be sniffed/spoofed Can be cracked online/offline given enough traffic & time Change keys frequently Traffic can still be decrypted offline Place APs on DMZ Requires VPN access to get back into network Use VPN Doesn t handle roaming WPA and/or EAP 9

10 Authentication methods Open systems authentication Shared key authentication EAP / 802.1x 10

11 Open system authentication Required by Just requires SSID from client Only identification required is MAC address of client WEP key not verified, but device will drop packets it can t decrypt 11

12 Shared key authentication Utilizes challenge/response Requires & matches key Steps Client requests association to AP AP issues challenge to client Client responds with challenge encrypted by WEP key AP decrypts clients & verifies WEAK! Attacker sniffs plaintext AND cipher-text! 12

13 802.1x authentication Encapsulates EAP traffic over LAN (aka EAPoL) EAP: Standard for securely transporting authc data Supports a variety of authentication methods LEAP, EAP-TLS, etc. Port-based only access is to authentication server until authentication succeeds Similar to what s used on Ethernet switches Originally designed for campus-wired networks Requires little overhead by access point 13

14 802.1x authentication (cont.) 3 entities Supplicant (e.g., laptop w/wireless card) Authenticator (e.g., access point) Authentication server (e.g., RADIUS) Three Main Elements 1. Mutual authentication between client and RADIUS 2. Encryption keys dynamically derived after authentication 3. Centralized policy control, 14

15 EAP-FAST Authentication Overview Supplicant AP Enterprise Network RADIUS server EAPOL Start Start EAP Authentication EAP-Request/Identity Ask client for identity EAP -Response/Identity (EAP-ID) RADIUS Access request Access Request with EAP-ID key Client derives PMK EAP success WPA Key Management Protected DATA Transfer Secure Tunnel (via TLS & PAC) Client-side Authentication RADIUS Access Accept (Pass PMK to AP) Perform sequence defined by EAP-FAST key 15

16 Wired Equivalent Privacy (WEP) Part of specification 64-bit key Shared key 40 bits Initialization vector (IV) = 24 bits Uses RC4 for encryption Weaknesses/attacks FMS key recovery attack weak IVs Filter weak IVs to mitigate IV too short, gets reused after 5 hours IP redirection, MITM attacks Traffic injection attacks Bit-flip attacks WEP2 added, increases key length to 128 bits 16

17 TKIP/MIC to the rescue Fixes key reuse in WEP Same encryption as WEP (RC4) MIC Message Integrity Code TKIP Temporal Key Integrity Protocol Protects IV by removing predictability Per Packet keying 17

18 VPN Authentication Overview Alternative to 802.1X over WLAN IETF standardized IPSec implementation Key benefits Mutual authentication between client machine and VPN concentrator using Shared-Key or Digital Certificate Provides 3DES or AES Encryption Provides SHA/MD5 for data integrity protection Provides Centralized user authentication (such as OTP) and administration 18

19 VPN Deployment Requirements Two-Factor Authentication Client Machine IPSec VPN supplicant VPN supplicant & WLAN adapter supplicant integration (optional) Personal Firewall for Local Attack Mitigation Client Machine RADIUS/OTP Servers VPN Concentrator Access Point Packet Filtering VPN Concentrator Authenticate Remote Users Terminate IPSec DHCP services (DHCP pool or DHCP Relay) 19

21 What is Wireless IDS? Wireless Intrusion Detection permits the detection of malicious or non-malicious security events on the WLAN Rogue AP detection Denial-of-Service detection WLAN Exploit Signature Analysis RF Interference detection Detection of attempts to access WLAN network and attempts to attract managed clients (honeypot) 21

22 Radio (Air/RF) Monitoring Si NMS Si Si Network Core Wireless Controller or IDS Server WDS Service (aggregation point) Si Si Distribution RM RM Access Rogue AP Rogue AP RM 22

23 Rogue AP Detection & Suppression Real-time RF monitoring ALL channels scanned while offering service Can scan country channels only or all channels During Scan all packets are collected and characterized Rogue beacons, Rogue clients, interference Matched against IDS signatures. Rogue AP suppression techniques Trace the rogue AP over the wired network and shut-down the switch port Use of managed devices to disassociate clients from unauthorized AP and prevent further associations via deauthentication frames 23

24 Autonomous AP: Rogue AP Location 24

25 Wireless enabled Location Solutions ( Active RFID ) 25

26 Active RFID Location Solutions Provide Real time Asset information provide the answers to: What Do We Have? How Many Do We Have? Where Is It? What Is It s Status? Real-time Location Tracking Presence Choke-point Infant X is in room Y Pallet X is on the line Vehicle X entered the terminal 26

27 Example Asset Loss in Hospitals [Hospitals] cannot find 15-20% of the devices they own. Arthur Gasch, Medical Strategy Planning Infusion pumps simply disappear. When it comes time to do preventative maintenance, we cannot find them. Materials Manager, large US hospital Data from hospitals demonstrates magnitude of problem: 500-bed hospital: loses 40 of 500 pumps per year (8%) 150-bed hospital: loses 250 of 1500 pumps per year (17%) Loss= failure to locate the equipment in time for scheduled preventative maintenance 27

28 Applications for location information Location based trending RF Capacity Management Troubleshooting Security Visibility Asset Management Streamline Workflow Security Better rogue detection Perimeter security Policy enforcement Location/movement based alerts Voice Code Blue, Voice Alerts E911 Location Based Content Distribution LOCATION Telemetry Relevant information about tracked item 28

29 RF Location Architecture Browser Based Remote Console HTTPS NMS SOAP/XML 3 rd party Integrated Applications: E911, Asset Tracking, ERP, Workflow Automation Wireless Location Appliance APs collect RSSI from devices and tags RSSI Location information is aggregated by Controllers SOAP/XML Information is sent to the Location Appliance for computation Wireless LAN Controller Access Point Access Point Location information is visually displayed by NMS NMS provides immediate applications for RF capacity management, location based security & asset visibility. Rich location information can be used by Location Appliance API for integration & display by location based applications Wi-Fi 2003 Cisco Handsets, Systems, Inc. clients, All rights reserved. rogues & Wi-Fi Tags 29

30 Location services technologies Closest AP: Identify AP with strongest RSSI. Limited accuracy: an AP can easily cover several thousand feet. RF Triangulation: All APs identify the strength with which they hear a client. Intelligent algorithms triangulate responses to find probable location. More accurate than closest AP. But does not account for effect of building material and people on signal e.g. multi-path, attenuation, reflection RF Fingerprinting: RF prediction creates a grid that identifies how every single part of the floorplan looks to all APs. Real world information is gathered by APs is compared to these fingerprints to determine location to within a few meters. 30

31 Wi-Fi Active RFID Tags Interoperability: Interoperable with any standards based tag Proven interoperability with PanGo & Aeroscout tags Battery life: 3-5 years, depends on beacon/blink rates Unassociated tags promote battery life; intelligent motion detectors provide intelligent alerting only, preserving battery life Security mechanisms: i/WPA2 & VLANs Unassociated tags do not associate to network Rich Device Information Relay: Serial telemetry information capable Dimensions: Varies slightly by vendor but approximately 2.44 (2.61) x 1.57 (1.74) x 0.67 (0.88) /62mm (66.3) x 40mm (44.2) x 17mm (22.35) Weight:1.2oz (35g) -2.5oz (w/batteries) Various Mounting Options Environmental Durability: Operating Temperature: varies by vendor: -30 C to +75 C (-22 F to 167 F) to 32 to 130 F (0 to 54 C) Dirt/Dust/Water resistance, includes rubber lining IP-67, IP-68 31

32 Summary WPA, WPA2, with an EAP protocol solution is recommended for WLAN security deployment Segment wireless network along the same lines as wired network and use the same access restrictions Implement wired security features as well as Wireless IDS Radio Monitoring is a requirement even if you do not have a wireless network Radio Monitoring also delivers Location Services 32