Hacking Wireless 802.11b Nets 126
John Higgins writes "The Wall Street Journal has a great article on my greatest worries about setting up a wireless network in my home. White hatter Peter Shipley and Matt Peterson of, among other things, the Bay Area Wireless User Group, drove the reporter around the valley with some rudimentary equipment to
find how many corporate networks they could "see" from the street or parking lot. (Sun Micro, check your encryption!) Call me a techie lightweight, but it looks like HPNA2 for me!"
neat! open networks freenet! (Score:1)
Re:What the hell's going on around here? (Score:4)
And guess what? Today, i got 5 mod points, used 'em up (careful not to overrate crap, since i noticed all the +5's), and then i got 5 more points!
Maybe the number of mod points was increased. By someone, or something.
answer (Score:4)
[ Preferences ]
You have moderator access
and 49,523 points. Welcome
to the those of you just
joining: please read the
moderator guidelines for
instructions.
(updated 9.9!)
Don't make me -5 your ass
Hacking wireless networks (Score:5)
The security here is terrible. We use no authentication via radius or any other method. Anyone with a 802.11 network card, and a sufficient antenna could steal connectivity, and we could not currently tell.
There exists ways to detect this, by monitering the MAC addresses connecting to the APs on the towers, but this is not employed. Neither is each radio catalogued, and IPs, for the most part, are assigned by the DHCP server with no logging.
I do not know if this is typical of most wireless companies, but if it is, then things should be ripe for the taking. I'm posting anonymously, because my company has a history of firing and suing for less.
Sun's 'testing' (Score:5)
Still, Sun's network is extrememly insecure in so many ways, especially internally. Getting to be an internal user is simple, with wireless and DHCP.
The SA's are pretty much powerless to secure the network, as well. Sun's red tape binds their hands. Get fired for securing the network? You bet! Go Sun!
Forget about actively looking for them.. (Score:4)
As these cards get cheaper and more people use them, the fixed set of frequency's that the frequency hopping cards use are going to become more and more useless with high gain aerials.
Even without the security implications, each site within 'earshot' are going to end up sharing the realistic 500k/s or so that the 11 megabit cards provide.
Big article at free2air (Score:3)
And the fact that they've found 150 open hosts in London's Docklands.
And for you 802.11b geeks, you may be vaguely interested to know that newsfilter.co.uk (below) is served wirelessly. Yehaw!
...j
Re:Hacking wireless networks (Score:4)
Knowing what I know, I would treat every wireless network as if ALL the traffic was being transmitted over a hostile network.
Exactly. Which is why our access point is outside the firewall and wireless guys need to use the VPN to get into the network just like the telecommuters. There is no such thing as wired equivalency.
Found on the printer (Score:5)
Re:What the hell's going on around here? (Score:1)
Somebody is sure running their agenda, that's for sure...
t_t_b
--
I think not; therefore I ain't®
Re:Broadcasting Network Names (Score:1)
Yep, I do this on my home AirPort.. Pretty easy.
Unfortunately, this quickly becomes a gigantic pain in the ass for the admins of the network, because who wants to go through and change the SSID every time you add a new wireless base? It's really practical only for small organizations.
Changing it when adding wireless bases? Sheeit, that's easy. Changing it everytime you have layoffs, now THAT is sucks....
Your Working Boy,
- Otis (GAIM: OtisWild)
Re:I like the idea, but.. (Score:3)
Re:Simple Security... (Score:3)
Re:So what do we reccomend? (Score:1)
Re:So what do we reccomend? (Score:2)
The vast majority of the security issues (including the one in this article) are simply that the network wasn't configured securely. I haven't seen any real-world attacks against networks that run WEP; the few I have seen have been brute-force decryption of packets. I haven't seen or heard of any attacks where packets were tunneled via a VPN over the wireless network.
As long as you're willing to read up on the security issues and take the time to configure your wireless stuff securely, you should be OK.
Re:Encryption (Score:2)
The biggest hurdle is poor key-management. WEP only supports a fixed key, that the base station and all clients need to know. That means that if you have to change the key on the base station and all of the clients at the same time. It also means that if somebody visits your office and wants to use the wireless network, you have to give them the WEP key. In a large organization, it can be pretty difficult to distribute a new key to dozens, hundreds, or thousands of users.
WEP has some workarounds for some of this, like letting the base station accept several keys simultaneously, but key management is still difficult.
Re:The reality of clueless sysadmins (Score:1)
Of course that method is quite useless now, as the LinkSys Cable Router I bought has built-in mac address spoofing.
It's damn hard to keep a wireless access point off your network. I'd say at any company a user bringing one in should be fired.
Shipley at it again... (Score:1)
He found lots.
--jurgen@botz.org
Re:What we do (Score:1)
This isn't a perfect solution, people still get free bandwidth if they want...
I would consider this a benefit... it's an excellent convenience to guests. How many "uninvited" users are going to be within your transmission radius?
--jurgen@botz.org
The right way to do wireless (Score:3)
Make a wireless network, but don't put it on your private network... instead just make it an independent network that's directly connected to the Internet (with or without NAT) completely "outside" your organizational firewall. TREAT it as the Internet... wireless PUBLIC Internet access. No security. No WEP. Because there is not need.
Simple. All the laptops that want to use it are already set up for accessing the essential services their users want via the Internet anyway! Who has a laptop at work that doesn't need to access services on their work network when they are off-site, be it via modem or home DSL or riccochet or whatever? And is the laptop on a secure network any of these? No. So what do people do in those cases?
Some use VPNs, some just use Web and mail via SSL, some use Ssh, whatever. The point is, it already works.
So make all wireless networks "public internet access", you get the added benefit that visitors will be able to use it without hassle. At worst you're giving free access to some people in the suite next door or across the street.
--jurgen@botz.org
Re:Encryption (Score:5)
The funny part is we use 3DES hardware VPN devices for PTP T1 lines, but that is done by another department that has the time and materials to implement strong security. And they wonder why we don't trust the corporate network?
Tapping unencrypted lines is easy, one of our security people was trained in tapping fiber cables by DOD in '83. Ask how many people think that their private fiber links are truly secure?
Rather than patching together PGP/GPG, SSL, and SSH, I would strongly recommend you spend your efforts implementing IPSEC instead.
Chris
So what do we reccomend? (Score:3)
While a Cisco Aironet [cisco.com] would be nice, $1400 is a bit steep.
The issue is, with all these current 802.11b security issues and the probable introduction of new security features, what are good products to use and steps take? It's one thing to point out the flaws in the system; another entirely to show how to fix (or at least avoid) them.
I detect an "Ask Slashdot" here....
It's different because.. (Score:2)
If it's just radio waves.. why are cellular phone scanners illegal in the US? (As opposed to Canada, where radio transmissions *are* public)
Nope. (Score:3)
There are professional models you can buy, I'm sure, that may let you, but they are generally for use in labs, and cost a fortune. Of course you can modify your ratshack scanner.....
IF you look at a cool product like the winradio (www.winradio.com) you will notice that the US version has several bands blocked; the euro & Canadian versions don't.
Canada, and many other places, receiving any transmission is legal.
Decryption of private communications may be a different matter.
Re:I like the idea, but.. (Score:1)
He's pretty damn sharp, I'm sure he knows more about the legality of it than I do. And *I'm* sure that his chances of getting sued are close to zero.
And it's pretty hard to claim he's stealing resources when all he's doing is sucking up free electrons.
Re:Receiving the broadcast would be a crime in the (Score:1)
coolness. score one for common sense.
not that a condone dangerous speeding, but it is a good precedent for more reasonable activities
Lord Pixel - The cat who walks through walls
Receiving the broadcast would be a crime in the UK (Score:2)
In the UK it would be illegal even to stand in range and see if you can connect. You don't have to actively probe anything to break the law.
It is illegal to receive any radio broadcast that was not intended for your use
Probably originally introduced to make police or army radio scanners illegal, but has also been used to criminalise all radar detectors (think speed traps) and things like intercepting satellite transmissions (think watching shows not intended for the UK market.
In other words, like all overly broad laws, whatever its original intent was it has been twisted to shut down anything anyone with enough power doesn't like.
Lord Pixel - The cat who walks through walls
Re:What the hell's going on around here? (Score:1)
This is worse than the grade inflation in US schools. If you can spell your own name, you will get a B or +3.
Two words.... (Score:2)
Of course, this opens up the problem of a stolen laptop compromising the network...
Remote detonate.
Re:Smart Cards / Memory Stick Solution. (Score:1)
The problem is that although WEP is rather simple to use the people don't. Using "your" memorystick etc solution it would require even more of an effort. I.e. not gonna happen.
What is needed isn't more tech. What's needed is to make admins, and users aware of the problem.
it's different because this is US law (Score:2)
International law doesn't really exist, so there's no law to break regarding China.
It's only 'testing' it seems... (Score:3)
yeah, right, if it wasn't for all this control, my head would be spinning right out of my neck...
Re:wireless hacking - killing wiredless? (Score:1)
Company: "It was no equipment of ours that set up a napster like server and put in all those beetle songs. We were hacked."
Judge: "So we will have to make all wireless bordcasting of data illegal"
You're not the only one (Score:1)
I also got 5 points used 2 and suddenly got all 5 again (weird) but then my karma been frozen for months now. must have been a unlucky 13 point karma bug. (who know?)
AUGH! (Score:5)
Augh! NO! NO!
SSH is a good protocol for secure terminal sessions, but you should never, never use it for tunneling, unless you're fond of session-timeouts and stalled connections.
SSH uses TCP, which means it's the worst protocol you can use for a tunnel... TCP guarantees the reliability of the connection - so a dropped packet can wreak havok.. the tunnel will stop and re-transmit the packet - so every other TCP connection will stall - and guess what? These stalled connections think their packets have been lost, so they retransmit their 'lost' packets - resulting in LOTS of duplicat packets.. (and if the 'original' packet was lost due to congestion, you can guess that you're gonna start flooding the tunnel - a cascade failure.)
A more technical description is available at
http://sites.inka.de/sites/bigred/devel/tcp-tcp.h
Unless you can guarantee that your network will never drop a packet, you need to use an unreliable protocol for the tunnel (think GRE - that's what it was designed for - but even UDP would be a better choice.)
Got one! (Score:2)
40bit encryption, you can hide the networks from broadcasting themselves, allow only specific MAC addresses, and require a password to join the AirPort network.
But no where does it state that they intend for you to trust all of your data to it.
Page 4 of the AirPort Fact Sheet:A similar comment can be found on page 4 of the AirPort FAQ [akamai.net]. The most important thing is the omission of any sort of notice that there could be a security problem.
Of course, the whole encryption thing was a semi-trollish joke anyway. Half a year of burning off my excess karma has started to make me prone to them lately. Looks like I caught someone!
The real problem in the article was that these companies were using open network, where you don't have to name the network befoe seeing access to it, and they weren't using any sort of encryption at all. Even AirPort's weak 40-bit encryption, combined with a closed network feature and with filtering MACs would have prevented these people from tuning in from their car.
AirPort actually makes all this configuration a no-brainer.
Microsoft, on the other hand, would be saying that it, just like Windows 2000, is totally secure and safe to use on any corporate LAN. *snort*
Straw man. Check my user profile.
Actually, if you configure the damn thing properly, especially by using centralized MAC filters, Airport's security would be safe enough. I'm hoping Mac OS X's UNIX underpinning would make doing this a little easier.
Airport (Score:4)
(Burn, karma, burn...)
Re:Lock onto mac-addresses (Score:4)
The authorized devices using the network are broadcasting their MAC addresses!!
This so very much reminds me of the well-known 'trick' of cloning a cell phone... sit somewhere where there are LOTS of targets, and just record the ESN/SID (or, in the case of 802.11b, the MAC address), program your own device, and off you go!
I still like the idea of VPN tunneling over the wireless segment. Yes, use the hardware safeguards, but don't trust them. Require SSH2 tunnels, perhaps using PGP-style public/private keysets to make things 'easier.' Of course, this opens up the problem of a stolen laptop compromising the network... but I never said this was a perfect world.
EavesdroppingHacking (Score:2)
Unless I missed something here, this does not involve any 802.11b security issues. Some people didn't encrypt their wireless net, some other people could read their packets. BFD.
I don't agree. (Score:1)
How secure are they really? (Score:4)
Now for this article. Duh. These admins should be fired. I run 802.11b at my house with full encryption and other security features on. I wouldn't let an access point in this building without securing it first. This isn't a technology problem, it's a human problem. These are probably the same people that don't patch up to the security holes and wonder why they get hacked two years later.
To make it easier, there needs to be a good key exchange mechanism. People that don't put much thought in to security don't want the "hassle" of manually entering keys on everyone's notebooks. I wonder how long before there are web pages with key listings for companies and longitude/latitude locations....
Re:What the hell's going on around here? (Score:3)
JOhn
Re:Nortel... (Score:1)
Re:How secure are they really? (Score:2)
Conceptually, this is the same as only selling ethernet cards that don't support promiscious mode and claiming that makes ethernet "secure". It isn't a big hack to make a scanner yourself, and if the card has a programmable microcontroller it can likely be done with a firmware update.
Re:Broadcasting Network Names (Score:2)
Not something to rely upon in the long run, more of a sad comment on the current state of wireless privacy.
What we do (Score:5)
So, in order to get to internal data while on wireless you must start up a VPN client or go through our portal. This isn't a perfect solution, people still get free bandwidth if they want, but at least they can't get to internal data.
Also, we have most of the wireless access points in public conference rooms, and a couple of them have been stolen!
- Twid
Re:Lock onto mac-addresses (Score:4)
Umm --- a sniffer will give you these pretty easily .....
Re:I like the idea, but.. (Score:4)
Re:Simple Security... (Score:4)
Password protecting resorces isn't going to do any good at all. If you read the article it is clear that these guys are running some king of packet sniffer.
"There -- someone just turned on an NT machine and is getting mail."
There is no way to know this unless you have are collecting and looking at packets on the network. Unless all traffic on the wireless segment is encrypted you will have NO security on that segment.
Re:I like the idea, but.. (Score:1)
Yup (Score:1)
Ironically you'd have much better luck as a blackhat, compromising the company's network, stealing their data and selling it to their competition. I'm not advocating this, mind you, but you're a lot less likely to face any legal reprocussions choosing this path. The company you cracked will never be any the wiser, that's for sure.
Likewise notifying a company that they've got a problem as an employee of that company has never (in my experience) got a problem fixed. They keep on doing what they're doing come hell or high water. Companies collectively are damn stupid and I don't see this changing anytime soon. It means plenty of income for the black hats, I suppose. *sigh*
Re:The reality of clueless sysadmins (Score:3)
Exactly.
What we're seeing is only the dawn of what most likely will become a very large problem... the cost of wireless Ethernet is around a few hundered bucks, and is affordable by the clueless.
I run a 1,200 node network, and never thought about this until today. This is an issue we're going to have to address in the future...
If an employee wants to run a wireless LAN, that might be okay, but they really should check with us first to make sure they "do it right"...
Information Warrior (Score:3)
The benefits of this would be manyfold:
Naturally you can't do all of these things at the same time or even have all of these things done by the same person, seeing as the explanation for what the hell you were doing listening in on the traffic in the first place might range from dubious to illegal.
What do you expect! (Score:1)
Re:What we do (Score:1)
Re:Sun's 'testing' (Score:2)
Re:I don't agree. (Score:2)
My favorite was their headline when they lost the anti-trust suit...
MICROSOFT DECLARED "MONOPOLY" (the quotees were theirs). The article spent most of its time talking about how MS wasn't going to be effected and was going to apeal.
I am really amazed you haven't ntoiced their slant.
I love MSNBC's editorial ethics... (Score:5)
Hackers hacking Sun (can you say MS-massive-security-breah-damage-control?)
Any whiff of PS2 trouble.
Pro MS anti=truat case articles.
And so on and so forth.
NBC should be ashamed they have their name associated with what is clearly just another MS publicity arm.
Re:Receiving the broadcast would be a crime in the (Score:2)
----
Re:Information Warrior (Score:3)
The whole point of the patent is that to get one, you have to reveal everything you know about it
wireless hacking (Score:3)
Re:Information Warrior (Score:1)
uh, you do know that all patents are on file at the patent office and available for all to see, right? There are trade secrets, but a patent is no secret at all.
Tunneling over a reliable connection (Score:4)
If the tunneled connections don't do retransmission themselves, you can just carefully design the tunneling protocol to be very nonagressive about retransmissions. E.g., ask "did you get that" instead of retransmitting the whole packet, and using a steeper-than-TCP exponentional delay function.
And if you have to tunnel TCP over TCP, the tunneler could inspect packets, detect when the tunneled TCP is retransmitting, and simply drop the retransmission on the floor. This is just a tiny step beyond NAT. Of course, if you're tunneling arbitrary reliable protocols, you're screwed. (Although I suppose you could blindy bandwidth limit the tunneled protocol by dropping packets. If you did this agressively enough, the tunneled protocol could be convinced to sufficiently rate limit itself.)
Incidentally, I've been thinking about this because sometimes you don't have a choice about what kind of connection to use. Sometimes you are provided with an arbitrary stream-oriented, possibly reliable, connection and have to make do.
BTW, thanks for the link to the TCP-TCP web page. I can point people at that instead of explaining...
Re:Hacking wireless networks (Score:3)
What the hell's going on around here? (Score:2)
Like many people (I suspect), I read Slashdot mainly for the posts. Some of the most informative pieces are those in which one of Slashdot's editors have made a factual error, and the community summarily slams him/her (are there any "hers"?) for lack of journalistic integrity. We get 3-6 +5 posts that seem to be written by experts in the field and are very informative to neophytes like me.
But if we suddenly have like 25 +5 posts per thread, the signal/noise ratio goes WAY down. Come on, 59 +5 posts in the SDMI story [slashdot.org]? WTF!?!?! They really weren't all that good.
Did Slashdot get cracked? Did they change the moderation system? SOMEBODY CHANGE IT BACK!!!
Thanks for listening.
If you're not wasted, the day is.
Re:Encryption (Score:2)
Re:The reality of clueless sysadmins (Score:2)
Unfortunately, very few administrators stop to think of the implications of wireless before doing a mass deployment.
This recently happened at my school, as is talked about in this paper I wrote [wh3rd.net], which gives a breakdown on some of the vulnerabilities present in my, and many others', schools.
Re:I like the idea, but.. (Score:5)
If you're spewing stray radio waves all over the place, whose fault is that? Is it your job to control your communications or our job to keep our ears shut?
Re:You would think... (Score:1)
a little confused? (Score:2)
But besides that.. I read the article earlier today, now I'm finding myself looking down to the parking lot looking for people with laptops in their car..
And I will reiterate the point.. I will stop being paranoid when you all stop following me.
Re:Lock onto mac-addresses (Score:3)
I sent them an email yesterday but have not heard back. I would like to know if I can tie the VPN to authenticate from our LDAP server to allow users worldwide mobility without having the local admins create them an account.
As for the stolen laptop, if you use SecureID tokens, this would help in a case like that, which is the reason I prefer this method over digital certificates.
I'm pretty sure... (Score:1)
Now, prosecuting, or even getting the feds to listen to your sob story is another thing, considering no damage was done. The FBI quotes (IIRC) a $5k minimum on damages before they'll even talk to you, but in reality, you'd have to approach $100k or so, and be willing to air your company's lackluster security in the court of law, and of public opinion.
Re:Nortel... (Score:1)
Nortel... (Score:2)
When a VPN vendor doesn't even use it's own software, it looks like it's time to pick a new VPN vendor... ;-)
Re:This is incredible! (Score:1)
Honestly, I didn't meet that many people I disliked. But most of the people I worked with were really out of their depth working with Sun machines, and even the ones that wanted to learn had no time to do it, or weren't allowed to by their bosses.
I wouldn't be surprised if most of the executives use Windows, because they have enough clout to get out of using the standard system put in place for the less than fully clued.
--
Re:Sun and security (Score:2)
Sun has no way of connecting back in to work from home. Sun.Net [sun.net] is a sad joke, providing only access to mail and calendar and such. The servers are (or at least they were) quite unreliable.
There is a terminal app, written in Java, but instead of using something normal and usable [mindbright.se], they used some bizarre thing which interfaced with the security cards. I can understand the need for that, but the only way to use the system was through an extremely slow and unreliable applet, or by telneting to localhost and going through several gateways (each of which had a nasty habit of hanging right in the middle of working) to finally telnet (?!) to one's office workstation. X11 was, of course, unavailable, unless you wanted to go in through the modem pool, which was limited to 28.8kb/s.
When the only way to get in and maybe fix the emergency brewing at the office is that pathetic, it's a given that there will be unauthorized tunnels in use. I experimented with a few SSH-based things myself (made extremely painful due to the temperamental SOCKS proxy), but had the good sense and courtesy to be even more anal about security than is my wont.
Oh yeah. People liked to share passwords. Within earshot, or over unencrypted voice lines.
Somebody at Sun please work on fixing this. It hurts to remember.
--
Sun and security (Score:5)
There are other gaping holes which I feel it would be completely unfair to post in any level of detail, but suffice it to say SWAN is riddled with holes waiting to be exploited, and I hope someone decides to do something about it before a h4x0r realizes how easy it would be to own all of it.
--
I like the idea, but.. (Score:4)
However, I believe three major things will keep most companies from prosecuting these guys.
1.) They are embarrassed enough already, and a court case will only embarrass a computer company more (Sun with an insecure network, that looks real good).
2. A lot of Silicon Valley comapnies are running out of cash.
3. The only thing the companies have to gain is deterring others from pulling the same stunt (and tattling about it later).
This could be fun (Score:3)
Encryption (Score:4)
IMHO, saying that encrypting traffic is too much effort is no longer a valid excuse, now that tools such as ssh, PGP/GPG, and SSL are in wide use. In fact, OpenSSH now supports dynamic port forwarding with socks support; which can allow transparent encryption of traffic.
So, what is the hurdle that prevents people from using the tools available to encrypt their traffic?
Re:The reality of clueless sysadmins (Score:1)
Re:a little confused? (Score:1)
Read the article title and credits--
See?
Simple Security... (Score:2)
...fixes the job. For a network running Microsoft software, taking common steps such as ensuring Guest access is disabled and that passwords are required for all resources will do the job.
I can see their point though about networks behind a firewall, but even inside a firewall I'd think companies would be proactive in securing their networks. I just think there's more "scare" than bite in this story-- the technology is secure, it's the networks the technology is run on that needs to be worked with (and this could easily be Linux or Windows systems). It could happen to more than just 802.11b based networks, this could happen to any company that has their network connected to the internet, or any home user that has DSL and a permanent IP address..
Re:How secure are they really? (Score:2)
These guys in the article only mention getting into maybe two or three networks, but they see a lot more. A visible SSID isn't necessarily bad security by itself, and it's a hell of a lot better than a wide-open 802.11b that lets you surf the web from somebody else's parking lot!
Not much better is a building with live DHCP'ed 100-base-T ports in every room. I've found at least one university building like this. I wonder how long until people hiding base stations (not advertising SSIDs, of course) in the ceiling spaces of buildings gets to be a real problem.
Peeking at unencrypted networks... (Score:4)
--
Broadcasting Network Names (Score:5)
After reading the article, it sounds to me like they're cruising around, looking for wireless LAN's that identify themselves.
By default, a wireless base station will broadcast the SSID of the wireless network of which it is part, and wireless LAN cards can join the network without already knowing the SSID of the network.
One of the simplest security practices is to turn off SSID identification broadcast at the base station. Then the wireless user has to know the name of the network in order to connect. Unfortunately, this quickly becomes a gigantic pain in the ass for the admins of the network, because who wants to go through and change the SSID every time you add a new wireless base? It's really practical only for small organizations.
Mind you, I'm sure this could be fairly easily intercepted from traffic between a user and a base station, but it's a start down the road towards hiding your wireless LAN.
WEP encryption has been proven to be an easily circumvented technology (as reported on /. once upon a time), as has this lack of SSID broadcast, but it's a start. The best bet for true security is to implement a VPN over your wireless LAN, or just treat your wireless zone as a DMZ.
Use encryption you can trust (Score:5)
Wireless security is an iffy proposition at best (Score:4)
There was a previous discussion on Slashdot [slashdot.org] about issues with the security of WEP. The articles out there on security holes in WEP are too numerous to list here.
What scares me most is the sheer lack of concern expressed by many network engineers, with regard to wireless. I've heard many times now, variants on "It's a wireless network. It's insecure by definition so why even make an attempt to secure it." Scary.
--CTH
---
Re:Wireless security is an iffy proposition at bes (Score:5)
http://www.isaac.cs.berkeley.edu/isaac/wep-faq.ht
---
Re:The reality of clueless sysadmins (Score:3)
No, you can keep wireless access from happening -- it's just a pain in the ass. Most switches these days support secure ports. With the Cisco switches I use at work, you can set port security so it not only allows just one specific MAC to use the port, but if anybody unplugs the cable to plug something else in, the port is automatically disabled (although there are other settings to choose from besides automatically disabling the port). This keeps people from spoofing the MAC, because nothing will work until an admin resets the port. For more information, check out this article [sans.org].
Like a lot of security, it's a pain in the ass, but you can prevent people from plugging in unauthorized devices, wireless or otherwise. Of course, no security is unbeatable.
Re:a little confused? (Score:2)
Security (Score:2)
This particular manufacturer stated the hardware was compatible with up to 128-bit encryption, and I did set my remote interface to 128-bit with no problems. The base unit, on the other hand, had no such setting; encryption could either be turned on or left off.
This leads to two potential exploits:
1. Brute force: trying to connect using all 2^40 keys until you are able to access the network. This is probably unworkable, but worth noting.
2. For a network with a large number of remote connections, one or more might have been set to 40-bit instead of 128-bit. Traffic from these nodes could be sniffed and analyzed, and the passphrase hash recovered.
Since I'm administering all of the remote points on my network, I've taken steps to keep this from happening; but for a large corporate net where users tend to fiddle with things, this could definitely cause a problem.
The reality of clueless sysadmins (Score:5)
I'll bet those sysadmins would be very surprised to discover that the 802.1b access points were even on their networks. This stuff is too cheap and bone-head easy to install. Apparently a lot of consultants of various types like to pack them around with their laptops so they don't have to futz with network cables whereever they happen to be working that day.
This isn't merely a clue problem. There is a control problem as well.
It may be deliberate. (Score:5)
Driving arround town there are a lot of 802.11b networks that are left open on purpose. I could care less about someone sending bits over my broadband pipe. Media one might mind but that is a different matter.
If it wasn't for the fact that if I did leave the access point open someone like the author of the article would be bound to post the fact on the net as 'security expert hacked' I would have no problems leaving it open. My internal systems are all behind a firewall in any case.
Reiterations (Score:3)
There's slight temporary fixes for the Wireless problems dealing with security, I think someone has PKI certs for them (almost sure they have them) but PKI is not really a fix [antioffline.com] at all now is it?
I'm hoping Pat Calhoun and the folks over at Diameter [diameter.org] get on the mark soon with their protocol, since it seems RADIUS is now a dinosaur of sorts. Well for those interested in Wireless security, check out this thesis on it. "Security in Public Access Wireless Networks [antioffline.com]"
#define crypto [antioffline.com]
Re:I like the idea, but.. (Score:2)
Such a lawsuit would be an interesting hodgepodge. There would probably be cases of Satellite-TV piracy referred to, along with some of the new industrial-strength anti-hacking laws (do the old "wire" laws apply to wireless networks?) Maybe copyright violations?
You would think... (Score:4)
Re:Hacking wireless networks (Score:5)
Layoff list to HR (Score:2)
Re:How secure are they really? (Score:2)
GDH
---
"No violence, gentlemen -- no violence, I beg of you! Consider the furniture!"
-- Sherlock Holmes