One of the traits of wireless networks is the way they work through the use of radio frequency (RF) or radio techniques. This is both a strength and a weakness because it allows wireless transmissions to reach out in all directions, enabling connectivity but also allowing anyone in those directions to eavesdrop. As opposed to the transmission of signals in traditional media such as copper or fiber, where someone must be on the "wire" to listen, wireless travels through the air and can easily be picked up by anyone with a device as simple as a notebook with a wireless card. This leads to a huge administrative and security headache and it immediately makes clear the need for additional security measures.

Emanations of a wireless network can be affected by a number of different factors that make the transmission go farther or shorter distances, including the following:

Wireless networks have become more and more common over the last few years, being shipped in all manner of devices and gadgets. From the early 2000s up to the current day, wireless technologies in the form of Bluetooth and Wi-Fi have become more common, with both features going from being an option to being standard equipment in notebooks and netbooks. This increased support of wireless technology can be seen even in cell phones, in which Bluetooth support became standard with Wi-Fi support following closely behind on the standard feature list of devices.

The widespread availability of wireless has made management and security much harder for the network and security administrator. With so many devices implementing wireless, it is now more possible that an employee of a company could bring in a wireless-enabled laptop or other device and attach it to the network without the knowledge of an administrator. In some situations, employees have decided that a company IT department that has said "No wireless" is just being unreasonable and, oblivious to the security risks, have taken it upon themselves to install a wireless AP.

The 802.11 standard was the first wireless standard that saw any major usage outside of proprietary or custom deployments. It was used mainly by large companies and educational institutions that could afford the equipment, training, and implementation costs. One of the biggest problems with 802.11 that led to limited usage was performance. The maximum bandwidth was theoretically 2 megabytes per second (Mbps). In practice, it reached at best only half this speed. The 802.11 standard was introduced in 1997 and saw limited usage, but quickly disappeared.

Its features included:

The first widely adopted wireless technology was 802.11b, introduced two years after the original 802.11 standard. It didn't take too long to be adopted by businesses and consumers alike. The most attractive feature of this standard is performance; 802.11b increased performance up to a theoretical 11 Mbps, which translated to a real-world speed of 6-7 Mbps. Other attractive features of the standard include low cost for the consumer and for the product manufacturer.

Its features include:

One downside of 802.11b is interference. 802.11b has a frequency of 2.4 Ghz, the same frequency as other devices such as cordless phones and game controllers, so these devices can interfere with 802.11b. Additionally, interference can be caused by home appliances such as microwave ovens.

When 802.11b was being developed, another standard was created in parallel: 802.11a. It debuted around the same time as 802.11b, but never saw widespread adoption due to its high cost and lesser range. One of the largest stumbling blocks that hampered its adoption was equipment prices, so the alternative 802.11b was implemented much more quickly and is seen in more places than 802.11a. Today 802.11a is rarely seen.

The 802.11a standard did offer some benefits over 802.11b, notably much greater bandwidth: 54 Mbps over 802.11b's 11 Mbps. Also, 802.11a offers a higher frequency range (5 Ghz), which means less chance for interference because fewer devices operate in this range. Finally, the signaling of 802.11a prevents the signal from penetrating walls or other materials, allowing it to be somewhat easily contained.

The 802.11a standard is not compatible with 802.11b or any other standard due to the way it is designed. APs that support 802.11a and other standards simply have internals that support both standards.

Its features include:

In response to consumer and business demands for higher performance, wireless networks 802.11g emerged. The 802.11g standard is a technology that combines the best of both worlds (802.11a and 802.11b). The most compelling feature of 802.11g is the higher bandwidth of 54 Mbps combined with the 2.4 Ghz frequency. This allows for greater range and backward compatibility with 802.11b (but not 802.11a). In fact, wireless network adapters that use the 802.11b standard are compatible with 802.11g APs, which allowed many business and users to migrate more quickly to the new technology.

Its features include:

Currently emerging in the marketplace of wireless technologies is 802.11n, which increased the amount of bandwidth that was available in previous technologies up to 600 Mbps in some configurations. The 802.11n standard uses a new method of transmitting signals known as multiple input and multiple output (MIMO), which can transmit multiple signals across multiple antennas. The 802.11n standard offers backward compatibility with 802.11g, so it will encourage adoption of the technology by consumers.

Its features include:

While wireless networking in the form of 802.11 is probably the best known by the average consumer, other wireless technologies are in widespread use, including Bluetooth and WiMax.

Bluetooth technology was designed to include some security measures to make the technology safer. Each mechanism that is employed can be part of a solution to make using the technology acceptable to individuals and businesses.

One of the big differences between wired and wireless is the way signals are transmitted and received on the network.

In networks based on the Ethernet standard (802.3), stations transmit their information using what is known as the Carrier Sense Multiple Access with Collision Detection (CSMA/CD) method. Networks that use this method have stations that transmit their information as needed, but collisions are possible when two stations transmit at the same time. To understand the method, think of the way a phone conversation works: Two people can talk and if they happen to talk at the same time, neither will be able to understand what is being said. In this situation, both talkers stop talking and wait to see who is going to talk instead. This is the same method that CSMA/CD uses. In this setup, if two stations transmit at the same time, a collision takes place and is detected; then both stop and wait for a random period of time before retransmitting.

In wireless networks based on the 802.11 standard, the method is a little different, and is called Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA). Networks that use this method "listen" to see whether any other station is transmitting before they transmit themselves. This would be like looking both ways before crossing the street. Much as with CSMA/CD, if a station "hears" another station transmitting, it waits a random period of time before trying again.

An item that is present in wireless networks but not in wired networks is the access point (AP). An AP is a device that wireless clients associate to in order to gain access to the network (more on that later). In order for a wireless client to gain access to the services offered on the wired network on which the AP is connected, it must first associate to it.

APs come in many different types, with a diverse range of capabilities from the consumer to commercial grade. The choice of an AP can have a substantial impact on the overall performance and available features of the network, including range, security, and installation options.

A detail that is universally available in wireless networks is the service set identifier (SSID). The SSID is used to uniquely identify a network, thereby ensuring that clients can locate the correct wireless local area network (WLAN) that they should be attaching to. The SSID is attached to each packet as it is generated and is represented as a 32-character sequence uniquely identifying the network.

The SSID is one of the first details that wireless clients will "see" when connecting to a network, so a few things should be considered. First, in most APs the SSID is set to a default setting such as the manufacturer's name (for example, "Linksys" or "dlink"), which should be changed to something more appropriate. Second, considerations should be made to turn off broadcast of the SSID where appropriate. By default in most networks the SSID broadcast is turned on, which means that the ID will be broadcast, unencrypted, in beacon frames. These beacon frames allow clients to much more easily associate with their AP, but also have the side effect of allowing software such as Netstumbler to identify the network and find its physical location.

Before a wireless client can work with a wireless network, a process known as association must take place. This process is actually quite simple, at least for our purposes, because association occurs when a wireless client has the SSID preconfigured for the network it is supposed to be attaching to. When it is configured in a wireless client, it will look for and then associate to the network whose value has been configured.

While not required, it is desirable to make sure that only those clients that you want to attach to your wireless network can do so. In order to restrict this access, authentication is performed prior to the association process. Authentication can be performed either in an open or preshared key situation, both offering features that may be desirable. With open keys, no secure authentication is performed and anyone can connect. When using this mode, no encryption is performed, so all information is sent in the clear unless another mechanism provides this feature. In preshared key (PSK) situations, both the AP and client have the same key entered ahead of time and therefore can authenticate and associate securely. This also has the benefit of encrypting traffic as well.

In some organizations it is possible that you may have existing tools or infrastructure in place that can be used to authenticate wireless clients. One of these options is RADIUS or Remote Authentication Dial-In User Service.

The RADIUS service is one that is designed to centralize authentication, authorization, and accounting, or AAA. The service allows user accounts and their authorization levels to be stored on a single server and have all authentication and authorization requests forwarded to this location. By consolidating management in this manner it is possible to simplify administration and management of the network by making a single location to carry out these tasks.

In practice when a user connects to wireless access point, his or her connection request can be forwarded to a RADIUS server. This request is then authenticated, authorized, and recorded (accounted), and access takes place as authorized.

Wireless networks and APs can relate in two ways: ad hoc or through infrastructure. Each of these options has advantages and disadvantages that make them attractive options. The following sections show you how they work.

Wardriving is the process of an attacker traveling through an area with the goal of detecting wireless APs or devices. An attacker who wants to engage in wardriving can do so with very basic equipment, usually a notebook with a wireless card and special software designed to detect wireless networks. In most cases those engaging in wardriving are looking to get free Internet access; however, it is more than possible for them to do much worse, such as accessing computers on the network, spreading viruses, or even downloading illegal software on someone else's dime.

Wardriving has led to a family of so-called "war" attacks that are all variations of the same concept:

Every AP, piece of software, or associated hardware has recommended security settings provided by the vendor by default or in the instruction booklet. In a vast number of cases, such as residential or small businesses, APs end up getting implemented without these most basic of settings configured. In some cases, such as with consumer-grade APs, the default settings on the equipment allow the device to work "out of the box," meaning that those that don't know otherwise will assume that everything is OK as is.

Another concern with wireless security is what employees or users may be attaching to. It has been shown that at least 25 percent of business travelers attach to unsecured APs in locations such as hotels, airports, coffee shops, and other locations. This number is expected to increase as companies allow more individuals to travel and work in the field with the associated notebooks and similar devices. The concern with this situation is twofold: what users are transmitting and what is stored on their systems. Transmitting information over an unsecured AP can be extremely problematic and users who leave wireless access such as Bluetooth enabled on a notebook or cell phone may open themselves up to data theft or other dangerous situations.

A problem with wireless is the appearance of rogue APs that have been installed without authorization. The problem with rogue APs comes on a few fronts because they are unmanaged, unknown, and unsecured in most cases. Rogue APs that are installed without the knowledge of the IT department are by their very nature unmanaged and have no controls placed upon them. They are known only to specific individuals, both good and bad. Finally, APs installed in this situation are frequently subject to little or no security, leading to unrestricted access by any party that locates the AP.

A new twist on rogue APs adds an element of phishing. In this attack, an attacker creates a rogue AP with a name that looks the same or is the same as a legitimate AP with the intention that unsuspecting users will attach to it. Once users attach to this AP, their credentials can be captured by the attacker. By using the same method, an attacker can even capture sensitive data as it is transmitted over the network.

Promiscuous clients are APs that are configured to offer strong signals and the offer of good performance. The idea behind these types of APs is that a victim will notice the AP and how strong the signal is and how good the performance is, and then attach to it. When these APs are nearby, they may be owned by an attacker who has the same goals as the malicious owner of a rogue AP: to capture information.

Viruses exist that are specifically designed to leverage the strengths and weaknesses of wireless technologies. Wireless viruses are different because they can replicate quickly using the wireless network, jumping from system to system with relative ease. For example, a virus known as MVW-WIFI can replicate through wireless networks by using one system to detect other nearby wireless networks; it then replicates to those networks, at which point the process repeats.

Protection on a wireless network is absolutely essential to consider and consider carefully. There are several techniques that you may use to protect yourself and your employees from harm, these include:

Netstumbler is one of the more common tools for locating wireless networks of the 802.11 persuasion. The software is designed to detect any wireless network that your wireless network adapter supports (802.11a, 802.11b, 802.11g, and so on). The software also has the ability to interface with a USB global positioning system (GPS) to map out the location of the APs it detects, usually within a good distance of the actual AP. Netstumbler does not have many options and is very simple to use (see Figure 8-1).

While Netstumbler software offers a good amount of functionality, it is not the only product that can perform wireless network scanning. Another piece of software that can do the same thing is inSSIDer. Metageek, the makers of inSSIDer, describe the benefits of their tool as follows.

Features unique to inSSIDer include:

The inSSIDer tool can do the following:

Figure 8-2. The inSSIDer interface

The inSSIDer interface is shown in Figure 8-2.

Once a target has been identified and its identifying information noted, the attack can begin.

Every AP ships with certain defaults already set; these should always be changed. Every manufacturer includes some guidance on what to configure on its APs; this advice should always be followed and mixed with a healthy dose of experience in what is best. Not changing the defaults on an AP can be a big detriment to security because the defaults are generally posted on the manufacturer's Web site.

Placement of a wireless AP can be a potent security measure if undertaken properly. An AP should be placed to cover the areas it needs to, and not as much of the ones it doesn't. For example, an AP should not be located near a window if the people that will be connecting to it are deeper inside the building or only in the building. Positioning an AP near a window gives the signal more distance to emanate outside the building.

Of course, other issues with placement need to be addressed, in particular the issue of interference. Placement of APs near sources of electromagnetic interference (EMI) can lead to unusable or unavailable APs. EMI can lead to APs being available to clients, but with such poor performance that it makes the technology worthless to the organization.

Not much can be done about emanations in wireless network, but there is something that can be done to control the scope and range of these emanations. In some cases, wireless directional antennas can be used to concentrate or focus the signal tightly into a certain area instead of letting it go everywhere. One type of antenna is the Yagi antenna, which can focus a signal into a narrow beam, making it difficult to pick up by others outside the select area.

Rogue APs are somewhat tough to stop, but they can be detected and deterred. The first action to address with rogue APs is the installation of unauthorized ones by employees. In this case, education is the first line of defense; let employees know that installation of rogue APs is not allowed and why. Additionally, perform site surveys using tools such as Netstumbler, Kismet, or any number of commercial wireless site survey packages to detect rogue APs.

The second issue to deal with is individuals connecting to the wrong or to unauthorized APs. In these cases education is again key. Let employees know the names of company-controlled APs and give them information about the dangers of connecting to unknown APs.

By its very nature, wireless data is transmitted so that anyone who wants to listen in can do so. In order to protect wireless networks an appropriate authentication technology should be used. The three that are currently in use are:

Using the appropriate protection for a wireless network is important because it can protect the network from eavesdropping and other attacks in which an attacker can see network traffic. Of course, just having a good protection scheme does not make for a safe environment by itself; there are other factors. In the case of WPA and WPA2, the keys in use make a major difference for how effective the technology is. Using poorly chosen or short passwords (or keys) can weaken the protection and make it breakable by a knowledgeable attacker. When choosing a key it should be random, be of sufficient length, and adhere to the rules for complex passwords.

Media access control (MAC) address filtering is a way to enforce access control on a wireless network by registering the MAC addresses of wireless clients with the AP. Because the MAC address is supposed to be unique, clients are limited to those systems that have their MAC preregistered. To set up MAC filtering you need to record the MAC addresses of each client that will use your AP and register those clients on the AP.