The next generation of knowledge and expertise Wireless Security Basics HTA Technology Security Consulting., 30 S. Wacker Dr, 22 nd Floor, Chicago, IL 60606, 708-862-6348 (voice), 708-868-2404 (fax), www.hta-inc.com
Networking computers, printers, personal desktop assistants (PDA) and other networks together wirelessly provides for a mobile environment at home or in the workplace. Organizations worldwide are realizing that this mobile environment has an associated cost. In some instances, even with the proper security, the cost to the respective organization could be the loss of sensitive information. There are several inherent vulnerabilities associated with transmitting information over a publicly available wireless medium. This medium also known as RF spectrum has a specific band of frequencies that are to be utilized for 802.11 network hardware. The public spectrum is referred to as the Industrial, Scientific, and Medical (ISM) band. It is assumed that the reader of this paper is knowledgeable of the various protocols (i.e., CSMA/CD, OFDM), standards (i.e., 802.11 a/b/g), terminology and hardware needed to construct a basic 802.11 wireless network. This white paper begins with wireless network terminology, then basic wireless network security, which provides guidance associated with the basics associated with creating a secure wireless smalloffice-home-office (SOHO) network. Next, virtual private network (VPN) infrastructure is discussed and how this technology can assist with providing a defense-in-depth postured solution. Finally, IEEE standard 802.11i is then discussed and how it could be the de facto secure wireless networking standard. Basic 802.11 Network Security It doesn t benefit the network owner to allow a malicious user unfettered access to network resources (i.e., bandwidth, network drives, printers, etc), sensitive files, or deny service to the system owner. With this in mind, securing the network against various vulnerabilities is a necessity. Three often-implemented methods used to secure SOHO and/or larger corporate wireless networks include: - SSID configuration - Filtering MAC addresses - Encrypting transmissions These three items when implemented properly can provide enough protection to secure your wireless network from a malicious user with basic to intermediate hacking skills. SSID Configuration The service set identifier (SSID) is not only the name associated with a portion of a network, but it can also be viewed as being a password to a network. It is a descriptor similar to a workgroup name that allows you to access resources associated with a particular portion of a larger network. Wireless APs and routers possess the ability to configure a SSID. The majority of wireless APs and routers come pre-programmed with a default SSID. For example, in their out-of-the-box configuration, Linksys routers are configured with a SSID of linksys. If a system administrator doesn t change the SSID within the router or
AP, any malicious user with the capability to access www.google.com can research the default SSID for various types of 802.11 a/b/g network devices. Another risk associated with not properly configuring the SSID is that the minimal security provided by the SSID could be easily compromised if the AP is configured to broadcast its SSID. Hence, this issue can be resolved by disabling the SSID broadcasts. MAC Address Filtering Every network device (wired or wireless) has a unique media access control (MAC) address. To increase the security of a wireless network, the AP or router can be configured with a list of approved MAC addresses. This technique is best utilized on SOHO networks where the number of clients is reasonably small. In theory, any network device with a MAC address not listed in your MAC access control list will not be granted access to your network. However, MAC addresses can be spoofed by malicious users to obtain access to the desired network. Hence, MAC address filtering and disablement of the SSID broadcasts alone won t provide a secure configuration. WEP Encryption Wired equivalent privacy (WEP) is an encryption standard implemented at the MAC protocol layer of 802.11 networks. The purpose of WEP encryption (up to 128-bit) is to provide wireless networks with security comparable with wired networks. WEP specifies either a 64- or 128-bit option for encrypting transmitted data. Included in the 64- and 128-bit options is a 24-bit initialization vector (IV) that is used in the encryption process. WEP employs the symmetric key encryption algorithm with a pseudo random number generator. The process is diagramed in figure 1. Since this is a symmetric algorithm, the key used to encrypt the data is the same key use to decrypt the data on the receiver side. Hence, the decryption process is the exact opposite of the process shown in figure 1. Figure 1: WEP Encryption Process 1 1 www.ece.umd.edu/merit/archives/ merit2004/merit_fair04_posters/goldberg_simcoe.pdf
To provide a brief synopsis of this process, the IV and the secret key (40- or 104-bit length) are inputs to the pseudo random noise generator. A XOR then occurs between the output of the generator and the data to be transmitted. The output of the XOR computation is the encrypted text or ciphertext. There are various vulnerabilities associated with WEP encryption. For this reason, WEP is suited for SOHO networks or networks with basic security requirements. Without providing technical details, a few of the major issues associated with WEP include: - No key management protocol - IV transmitted in the clear - IV is a static entity - One-way authentication Various secure solutions that can be implemented to resolve these issues include: VPN, WPA1 and WPA2. These solutions will be discussed later in this document. Wireless VPN Security In today s age of technology, most corporate networks are deploying technologies allowing for secure remote access to corporate servers (i.e., Microsoft Exchange, file) back at the office. Providing this capability has the ability to increase both efficiency and mobility while mitigating the risks associated with communicating over the public Internet. A virtual private network (VPN) is a means to provide secure access to a network remotely. First, a connection (socket) is established between the client PC and the VPN server. Once this connection is established, a dedicated enclave or tunnel is created between the two entities. Prior to packets being transmitted, the channel is encrypted between the client and the VPN concentrator. The packets can also be encapsulated in a way that provides for an additional layer of security. Implementing both technologies simultaneously provides an additional layer of security. An example of a VPN implemented onto an existing 802.11 network is diagramed in figure 2. Within various types of operating systems (i.e., Linux, Windows XP Professional), the capability exists to implement a VPN connection. Tunneling protocols such as the pointto-point tunneling protocol (PPTP) and the layer 2 tunneling protocol (L2TP) exist within the operating system. Microsoft has developed an advanced encryption standard (AES) software update that can be used in conjunction with the tunneling protocols.
Figure 2: VPN Over Existing Network [2] 2 Other forms of VPN solutions exist for the corporate enterprise. An organization can purchase a Cisco VPN concentrator (i.e., Cisco VPN 3000) and implement the software portion of the VPN by using Cisco s VPN client. This software would be installed on the client PC. The IP addresses and protocol (i.e., TCP or UDP) would have to be configured in the VPN client. 802.11i Wireless Security 802.11i is the newer version of the original 802.11 wireless network security. 802.11i utilizes an architecture based solution rather than solely an encryption package. This architecture includes an authentication protocol, port-based authentication (802.1x), and temporal key integrity protocol (TKIP). Another name for 802.11i is Wi-Fi protected access (WPA). WPA mitigates the majority of the security risks associated with WEP by eliminating the IV, forcing mutual authentication, and updating the key every session. Implementing 802.11i (w/aes) with a RADIUS server is a viable solution for a corporate enterprise. It provides thorough data protection by means of AES encryption as well as mutual authentication to eliminate rogue APs. An example of this implementation with WEP is detailed in figure 3. Following the diagram is a summary of the steps involved in the protocol. 802.1x The 802.1x protocol is an authentication standard that can be used on any network. It provides the network with a way to authenticate users and/or devices as well as a way to manage the encryption keys. Individual sessions utilize different keys while keys are changed on a random basis. 2 www.dell.com/downloads/ global/vectors/wireless_security.pdf
TKIP TKIP is an encryption algorithm that uses the RC4 algorithm by default, however it has the ability to utilize AES as the encryption. TKIP uses 4 keys in its encryption process along with a key management scheme to force key changes on a continuous basis. Figure 3: 802.1x/RADIUS Implementation 3 Conclusion This paper outlined the fundamentals behind properly securing SOHO, enterprise, or highly sensitive 802.11 wireless networks. Regardless of the data contained within the network, the network should be secured in accordance with corporate policies, network size, cost restrictions, and risk. 3 www.dell.com/downloads/ global/vectors/wireless_security.pdf