You know you’ve entered a new realm of network security when “driving” becomes one of the intrusion efforts. This term actually originated from the days of old, when a similar method known as war dialing was in place. In the 1980s, most businesses connected offices through dialup connections, typically using modems. War dialing would consist of a hacker randomly dialing through the phone number range in his local area (for example, setting up his modem to dial numbers 100-0000 through 999-9999 in the U.S.). The dialing itself was not the hacking attempt; rather, it was a scan for phone numbers responding to modem signals.

War driving uses a similar concept. An intruder mounts an 802.11-compatible wireless antenna on his vehicle and drives through the city, identifying available wireless networks. When combined with a Global Positioning System (GPS) device, war-driving software (such as KisMet or KisMac) can be very accurate in pinpointing the available wireless networks on a map of the city. When the intruder returns home, he can analyze the available networks and plot his next steps of attack.

Keep in mind that war driving can discover wireless networks even if they are encrypted, authenticated, and/or using a “hidden” (nonbroadcast) SSID.

The direct hacking effort typically begins after the war-driving scan of the area is complete. The intruder then identifies what network(s) he wants to attack. The hacking effort can come in many forms:

Employee ignorance was the best term I could come up with for this category of security threat. Depending on the individual employee, I suppose you could substitute “insolence,” “rebellion,” or “stupidity” for the word “ignorance.” Here’s the concept: Your company policy dictates that you will not run wireless networking because of security threats. However, the “ignorant” employee has a laptop he really wants to use with wireless technology, which gives him the freedom to roam between areas while remaining connected to the network. The employee takes networking into his own hands and connects a low-end wireless access point to the network jack in his cubicle. With the click of a Cat 5 cable, your network security has been reduced to nothing, and a gaping hole into the network is now broadcast to the outside world. This same issue can occur even if your company provides a WLAN network and the user is just outside the range of the wireless signal. If appropriate detection measures are not taken, this massive hole in your network security can go undiscovered for months!

Objective:

When you’re ready for a technology roller coaster ride, begin studying the history of wireless encryption standards. I mentioned in the preceding chapter that wireless networking technology is so amazing that companies began using it long before the security standards were heavily tested and proven to withstand attacks. So, fasten your seat belt, and let’s ride through the evolution of wireless encryption standards, starting where it all began: with WEP.

Wired Equivalent Privacy (WEP)

The WEP standard was the first measure of security released for wireless networking. This encryption method was based on the simple concept of using preshared keys (PSKs) to generate an encryption algorithm. Here’s an overview of how the WEP encryption algorithm works: The WEP standard uses an encryption formula called RC4. This is essentially a mathematical formula that takes every piece of data you want to encrypt and scrambles it. The missing piece of this formula is the PSK, which you enter. This is visually demonstrated in Figure 16.1.

Figure 16.1. The mechanics of WEP encryption.

When the wireless access point receives data, it uses the reverse formula to decrypt the data. So, for WEP to work successfully, you must manually enter the PSK on both the wireless client and the wireless access point.

When WEP was originally released (in 1997), it used 64-bit encryption, which is considered weak by today’s standards. You can compare 64-bit encryption to a math formula with 64 steps. Each step scrambles the original data more and more.

Note

The more bits you use for encryption, the more complex your encryption algorithm, and the more difficult it is to break. However, the more bits you use for encryption, the harder it is for your network device to communicate because of the processing power needed. This may result in slower network communication.

Unfortunately, within a few years of WEP’s initial release, major security vulnerabilities were found. The wireless standards groups improved the strength of the WEP algorithm by releasing a 128-bit version in 2002, which some people refer to as WEP2. Although it makes the algorithm slightly more difficult to break, many flaws in the underlying design of WEP caused this security standard to crumble.

Wireless security was suffering in a huge way when WPA was released.

Tip

Remember that WEP offers 64-bit and 128-bit encryption strengths. Also, keep in mind that the WEP standard allows only static, preshared keys.

The wireless encryption we’ve discussed so far does indeed secure the data, but it has a couple of weaknesses. First, using a preshared key system means that you must go to every wireless device and accurately enter the PSK before the device can communicate on the network. Likewise, keeping the same PSK for an extended amount of time increases the chances of the encryption algorithm’s being hacked, so it’s a good idea to change the PSK on a regular basis. In a small network of 10 or so wireless devices, this may not be a big deal, but in a large network with hundreds or even thousands of wireless devices, this can be a full-time job. The second issue presented by a PSK system is the inability to remove access. For example, if you are using a PSK among your 50 laptop users on the network, and one of the users leaves the company, you must change the PSK for the 49 other wireless users to eliminate the security vulnerability from the former employee.

Simply relying on a shared PSK among all devices is not a secure or scalable solution for business. What was needed was a method of wireless authentication. This would allow you to have a system of granting or restricting access based on a variety of criteria, such as usernames and passwords or certificates. The industry responded with the ultimate authentication method, which we now know as 802.1x.

Usually when we think of network authentication, we think of accessing an operating system. For example, when you log into a Microsoft Windows domain, you must authenticate using a username and password to gain access to shared resources on the Windows-based servers. When you Telnet to a Cisco device, you must authenticate to gain access to manage the device using the Cisco IOS. 802.1x takes authentication to an entirely new level. Now, you must authenticate to gain access to the Layer 2 LAN network fabric. Now, to access the wireless access point and use the 802.11 network, you must authenticate. You can also apply 802.1x to LAN network switches. When a device plugs into an Ethernet port, it must authenticate before it gains access to that port and, thus, the network.

Think of the possibilities as soon as you begin using network authentication! When a user leaves the company, you can negate her user account on a Microsoft Windows server. This will cause her to lose the ability to log on to the Windows workstation and, at the same time, lose the ability to even plug into a switch port or attach to the wireless network! Talk about cutting off a user! Now, let me give you the basics of how this works.

802.1x designates three network devices that participate in network authentication: the supplicant, the authenticator, and the authentication server. Figure 16.2 shows the placement of these devices.

Figure 16.2. Equipment participating in 802.1x authentication.

When the user wants to access the network, he must first send his authentication credentials (such as a username and password) to the authenticator, which forwards them to the authentication server. When the authentication server receives the credentials, it checks them against its database and then tell the authenticator whether the device has passed authentication. If the device fails authentication, its access to the network is terminated or severely limited, depending on how you (as the administrator) decide to restrict the device. If the device passes authentication, the supplicant and authentication server generate a dynamic encryption key known as the session key. This provides the same security as the PSK but does not require you to enter a PSK on the client or wireless access point.

I could say much more about network authentication, but, as I said at the beginning of this section, this is a 10,000-foot overview of the concepts. You now know what network authentication is all about and what it is used for. It’s now up to you to continue past the CCNA in your Cisco studies to determine the best method to implement network authentication. Proceed into that world with a grave warning: Don’t let the EAP monsters eat you alive! Don’t worry; you’ll know what I mean when you get there.

By using wireless network authentication and encryption, we have addressed the concerns of war driving and network hackers. But what about those pesky users who plug unauthorized wireless access points into the network? For that we have wireless IPS. You can think of IPS as introducing a variety of detection lasers into your network. I think back to the 1996 movie Mission Impossible with Tom Cruise. In one scene, Cruise (well, Ethan Hunt, to be exact) must retrieve a chip from a secured computer room by twisting and contorting his body through a variety of lasers projected around the room. In the same sense, deploying wireless IPS for your network sets up a variety of “sensors” that detect when a policy has been violated. The minute a rogue access point shows up in the network, the system can alert you, pinpointing the location of the access point on a map of your campus. Amazing!

Network-wide IPS can detect a variety of additional suspicious movements around the network, in both the wired and wireless worlds. However, discussing the rest of those detections is part of the Cisco Certified Security Professional (CCSP) certification.

Webster’s Dictionary defines “topology” as a branch of mathematics concerned with properties of geometric configurations (such as point sets) that are unaltered by elastic deformations (as stretching or twisting) that are homeomorphisms. The CCENT and CCNA exams stop short of requiring a full understanding of homeomorphism (or elastic deformation, for that matter). However, the exams do require you to have some knowledge of the placement of wireless access points in your corporate network. The first piece to understand is that anyone can deploy a wireless network in one of two forms: ad hoc or infrastructure.

Ad hoc wireless networks technically use an Independent Basic Service Set (IBSS) topology. This means that each wireless device independently manages the wireless network. This type of wireless network originates from and includes the wireless device, as shown in Figure 16.3.

Figure 16.3. Ad hoc wireless networking.

This type of network can be created by users on-the-fly to share files or services with others. For example, someone on an airplane might want to share a folder of files with the person next to her. She can create an ad hoc wireless network and allow the other person to join and access the shared files over a network connection.

Ad hoc networks typically are very limited in range and security capabilities. You may want to consider restricting laptops in your corporation from starting ad hoc wireless networks, because they could be considered a potential security vulnerability.

Infrastructure wireless networks are a far more common topology. This involves using a dedicated piece of equipment (typically a wireless access point) to initiate and manage the wireless network. Wireless access points can be configured to use one of two infrastructure modes: Basic Service Set (BSS) or Extended Service Set (ESS). The BSS is the simplest form of wireless network. It includes a single wireless access point managing a group of clients, as shown in Figure 16.4.

Figure 16.4. A single basic service set design.

An ESS is a wireless topology (note the word change from “network” to “topology”) that includes two or more wireless access points providing extended wireless coverage across the network, as shown in Figure 16.5.

Figure 16.5. An extended service set design.

In Figure 16.5, notice that the wireless coverage overlaps. Wireless best practices state that you should have a 10 to 15% overlap in your wireless coverage. This allows you to implement seamless roaming, allowing a wireless client to move between access points with no service interruption. This is not as critical for data clients, such as laptops. Rather, real-time wireless clients such as 802.11-compatible cell phones, cordless VoIP phones, and some PDAs benefit from the overlapping coverage. Imagine dropping a phone call anytime you moved more than 300 feet in the network! More steps are involved in implementing seamless wireless roaming, but the 10 to 15% overlapping coverage is the starting point.

The second thing to notice in Figure 16.5 is that the channels are different on the two wireless access points. One of the wireless access points uses Channel 11, and the other uses Channel 6. This prevents the two wireless access points from interfering with each other. This channel concept is more fully discussed in Chapter 15, “Understanding Wireless Networking.”

So you purchased a new 802.11g wireless access point and implemented it with clients running 802.11g cards. 54Mbps of pure wireless speed—right? Wrong! You may have purchased an access point capable of handling 54Mbps, but you will never reach that speed. Never! Repeated performance tests have revealed that actual data rates are about half of the theoretical data rate, on average. This means that your 802.11b access point typically averages about a 5Mbps actual data rate. 802.11g usually is in the 20Mbps range. You might be wondering why the standard says that you can handle 54Mbps when the actual throughput is much less. Well, there are many reasons.

Suppose you travel to the moon in an oxygen-free environment. You carry a single wireless access point and a single wireless card plugged into a single solar-powered laptop that does nothing but run the wireless card (no Bluetooth, no electrical interference). You sit with the wireless access point about 2 feet from the laptop and only send or receive data (never both). You might get close to the 54Mbps capability. But even that is stretching it. When you move from the world of cables into the world of wireless, you open yourself to an entirely different style of communication. One of the first considerations that you’ll notice is the truth behind the range of the access point. Yes, in an obstruction-free environment, the 802.11b/g wireless signal can travel 300 feet. But couple that fact with the idea that higher data rates (11Mbps for 802.11b and 54Mbps for 802.11g) require stronger signals. You’ll find that the data rates step down the farther you go from the access point. The following steps are defined for each standard:

So, when you picture wireless data rates coming from your wireless access point, think of them as a radial circle for each rate, with the rates continually decreasing the farther you go. This is represented in Figure 16.6.

Figure 16.6. Wireless data rates.

You’ll notice that no exact measurement is attached to each of the radial circles dictating speed around the wireless access point. That’s because range is not the only criterion to consider when determining wireless data throughput. From Chapter 15, you’ll remember that wireless shares the unlicensed FCC frequency bands with many other pieces of equipment. Bluetooth, other 802.11 wireless clients, cordless phones, and microwave ovens are just a few that can cause interference. Couple that with typical obstructions such as walls, cubicles, desks, and so on, and you have a wireless signal that varies from business environment to business environment. It is impossible to say just how far and “clean” the signal will be in your specific environment. Many companies make testing equipment that displays the signal strength and data rate to a laptop or PDA screen. This gives you a good idea of how wireless will fare in your environment.

The saving grace of wireless data rates is the fact that most users will not notice. Most devices that use a wireless signal are used for lower-bandwidth communication. For example, a wireless VoIP phone consumes about 100Kbps of bandwidth. Laptops used in wireless environments typically surf the net or check email. Most devices that handle large data file transfers or other high-bandwidth communication typically are hardwired.

With all those considerations floating around your mind, here are the general steps to implement wireless:

Working through these four steps, you have established a baseline for your wireless network. As you add more features or security standards on top of the existing foundation, you can return to a “last known good” configuration if something goes wrong.

Objective:

Wireless troubleshooting is far more complex than typical wired troubleshooting. Physical problems are much more elusive, because they deal primarily with interference rather than a simple cable break or failing switch port. For example, I recently deployed in a business a wireless network that worked great until 4 in the afternoon. As soon as we crossed the 4 p.m. barrier, all wireless connectivity was lost. After doing some spectrum analysis, we found that a nearby airport was using a device (we still aren’t sure what it was) that completely flooded the 2.4GHz frequency range. The company decided to move to 802.11a (which was a fairly large network upgrade) to avoid this interference.

Likewise, wireless technology is fairly new to the industry. You may find that firmware for your access point has bugs and needs to be upgraded to a newer version to avoid persistent crashing (this happens far more often than you may realize). The following wireless troubleshooting checklist may be helpful as you attempt to diagnose the issue.