Wi-Fi Networks: How to Overcome Security Challenges

The rapid adoption of Wi-Fi networks by residential users is a testament to their convenience versus traditional wireless networking. Some of the more advanced businesses are now deploying guest Wi-Fi networks for corporate visitors. Other businesses, such as cafes and restaurants, are offering free Wi-Fi network access for their patrons as a competitive advantage to draw more clients. Even towns are now offering municipal Wi-Fi networks to draw more high tech businesses to their towns.

As Wi-Fi networking continues to grow, it is extremely likely that a typical user will have access to many different wireless networks from their laptop. Often, a laptop user at his/her house or office location can find five or more Wi-Fi networks in range. With great availability and easy access, wireless networking re-introduces old security issues while introducing new security challenges. The security challenges for a Wi-Fi network can be broken down into the following categories:

• External environment: The Wi-Fi networks that are not provided by a user or their organization. For example, the Wi-Fi network of a person living in the apartment across the street that is reachable from anywhere inside the same building.
• Internal environment: The security controls that are placed on one’s own wireless network and Wi-Fi users.
• Policy issues: What is the policy on people setting up their own Wi-Fi networks? If it is not allowed, how is that enforced?

As easy as it is to deploy a Wi-Fi network, it is just as easy for people to breach your security perimeter. In fact, whether or not your corporate policy sanctions Wi-Fi, unmonitored networks can be lurking within – or leaking into – your perimeter ‘airspace’. And despite the introduction of the 802.1x protocol, which provided sub-protocols and methods for better protecting authentication and data transmission, this standard does nothing to stop people from connecting to unauthorized access points.

Technology Behind Wi-Fi Networks

Wireless technology is both convenient and insidious at the same time. It allows for Internet on demand in any location. At the same time it can be an invisible conduit that allows for traffic to bypass all your physical security devices – such as firewalls or routers – and even the walls of your building. Unless you are using a Faraday cage, controlling wireless signal is difficult. Since humans tend to work together – in openplan offices – physical deterrents aren’t feasible. Understanding the physics behind Wi-Fi networks will help you identify threats and minimize risks with tools available on the market today.

Wi-Fi networks allow any client (e.g. a laptop equipped with a wireless card) to make a connection with any access point (AP) within range. That connection is a ‘conversation’ and it refers to the relationship between any access point and client.

Every client equipped with a wireless card and not connected to a wireless network is continuously sending out ‘probe request’ packets, which are asking: ‘Is there an AP to connect to?’ Each of these probe packets also contain SSID information (network name) as well as the frequency or channel that it is seeking.

On the flip side, APs transmit ‘beacons’ to advertise their availability – and usually their network names. When a probe request from a client comes within the transmission perimeter of the AP, the AP offers a ‘probe response’, which accepts or rejects the request. If the request is rejected – no offer to ‘associate’ is made and therefore no conversation can take place. If accepted, the client is offered an ‘association request’ to attach to the AP, which is identified by network name. The first time that the client and access point ‘meet’, the user is asked to accept or reject this association request.

However, once an association request is accepted, that network name is automatically added to the client’s profile list as a previously approved network. In the future, when the client is looking for an AP, it will be shouting out this list to any listening access points. If any AP network name matches one in the client profile, the client will accept the association request without the user’s knowledge.

What’s in a Name?

The challenge with maintaining a list of pre-approved names is that network names tend to be fairly generic, or worse, the default names given by manufacturers. Once your client has attached to a client named Linksys or Default, it will be looking to join any wireless networks named Linksys or Default.

This is an important concept. As administrators, we put security on our AP to keep unauthorized clients off our networks. But the converse is not available. If the client’s wireless card is active, the card is seeking connections – with or without the knowledge of the client – or the AP administrator.

Hackers know this, so they will attempt to create a hotspot within your perimeter with one of these popular default names. (Open source tools such as Karma make this easy to do.) Furthermore, since monitoring a wireless conversation makes it easy to obtain all of the necessary, pertinent information, such as logical network name, SSID and Mac address, it is easy for a hacker to set up a rogue access point ‘spoofing’ a legitimate access point.

Type I Risks

As discussed, radio frequencies do not care about your company’s physical boundaries. Your signal may be transmitting into the parking lot, so a person in a car can actually attach to your network, and through the use of ‘sniffers’, can listen to conversations. The risks are nearly eliminated through the use of encryption such as WEP, LEAP, WPA or VPNs.

Type II Risks

Employees or consultants may connect their own wireless base stations to your corporate network, which creates two alarming scenarios. The first allows traffic to bypass your firewall and proxy servers – meaning information can be leaving your company without your knowledge.

The second scenario is that this base station will be leaking beyond your perimeter. Again, picture the person sitting in the car with the sniffer. This time, they may be capturing passwords of employees trying to access sensitive servers or pop mail, who have deliberately or inadvertently connected to the wrong network.

The only way to thwart these two scenarios is by physically finding the devices. It has been suggested that if it is known that a card transmits at 100 mw, and you are receiving a signal at 10 mw, the approximate positioning should be able to be calculated. However, this method is extremely imprecise because signals are absorbed and reflected in a complete 360 degree area.

The only successful means is to walk along the gradient, searching on all three bands (A, B and G) and all possible channels in the A band as well as in the B/G band, recording signal strength. Tools such as an AP finder can report a signal strength of 100% when you are within three feet of the device.

Type III Risks

Just as signals can leak out of your buildings, they can also leak in. This situation is particularly troubling because it is not feasible to find a hotspot that your employees (and consultants) may be deliberately or inadvertently attaching to – if it is in the building across the street.

It is important to understand that not all employees who may be attached to a hotspot are doing so deliberately. It is very possible for employees to attach themselves to unauthorized networks inadvertently. It stems from the fact that many people don’t change the generic name for the base station preset from the factory. If a client has connected once to an AP with a name like Linksys, Default, Netgear, et al, in the future it will probe for AP with those names.

As mentioned earlier, it is now easy for hackers to simulate the access point of just about any wireless network. Firewalls and encryption offer little help in this situation. Organizations must use the necessary tools to identify rogue AP that are transmitting in your airspace – and block conversations between clients and access points.

Organizations must categorize certain types of conversations between clients and access points based on the signal strength of each. Consider that signal strength becomes a clear indicator to determine proximity and likely behaviours.

Managing Wireless Conversations

Conversations are wireless connections made between participants – which are clients and (usually) an AP. Organizations should actively observe and monitor these conversations – and can identify the participants using the MAC address. By monitoring these conversations, organizations can properly categorize the types of conversations and take further action if necessary. Additionally, as rogue access points and intruding clients are identified, administrators can add these unauthorized devices to a blocked list. Managing wireless networks on a conversation basis allows us to improve both the usefulness and the security of our wireless infrastructure.

This allows a mechanism to be created for safely using Wi-Fi and clearly categorizing and blocking threats, organizations can be assured that their same strict security standards are met. By not giving Wi-Fi the security attention it requires, organizations can easily fall victim to this ever-increasing security hole.

Conversation categorizations can be easily based on a process that looks at the power levels of both the client and the APs. Any conversation that is not explicitly allowed can automatically fall into one of four categories below. Everything that shows up in any of the four categories refers to any entity that was not explicitly allowed. Entries on an allow list would never be categorized as any of these possible threats:

• Rogue: Unapproved AP is in your building being accessed by clients within your perimeter.
• Hotspot: Client in your building is accessing an AP believed to be outside your building.
• Outsider: Unapproved AP is most likely inside your building and being accessed by someone outside.
• Suspicious: Unapproved client and/or AP are most likely outside your building.

By creating a mechanism for safely using Wi-Fi and clearly categorizing and blocking threats, organizations can be assured that their same strict security standards are met.