Based on some media reports, you might think that wireless technologies are riddled with security holes that are almost impossible to plug. There have been reports of “hackers” driving around town, laptops in hand and large antennas sticking from their cars, who are able to penetrate any wireless network with the click of a button. Although there is some truth to these reports, most of the time they are chock full of sensationalism. In this book, you’ll learn the technical details of wireless vulnerabilities as well as how to actually exploit them. I’ll also present real-world solutions and mitigating controls to minimize these security risks.

If you are tasked with managing the security of your company’s existing wireless network or with evaluating the risks associated with implementing a new wireless network, you will find in this book the resources necessary to make sound decisions in managing the risks associated with wireless technologies. Although this book is geared toward the IT professional who wishes to get up to speed quickly on securing his wireless network, if you have interest in current wireless security threats, how to exploit them, and how to defend against them, you will likewise find this book interesting and enlightening. The foundation for mitigating security risks is always a sound education. Your education begins now.

You will, however, find the information you need to quickly get up to speed on the security issues and mitigating defenses for wireless technologies. You will also find easy-to-follow real-world examples of attacks against wireless technologies and examples of the applicable mitigating defenses. In addition, you will find real-world solutions to common objectives for wireless networks. Whether you need a refresher in securing wireless networks or want to add a new skill set to help advance your career, you will find the information easy to digest and, above all, relevant to the real world.

Following are the 11 principles you will find relevant to any security process you participate in. You will find most of these principles relevant to any security discussion, regardless of the technology, whether it’s wireless networking, Bluetooth, network security, or even physical and nontechnical security practices.

Suppose you have some personal papers that you lock in a small safe. To make it more secure, you lock that safe in a larger safe. Now whenever you wish to access these papers, you have the added inconvenience of needing to open two safes in addition to having to remember two separate combinations.

However, a paradox manifests itself in the real world, as illustrated in Figure 1-1, which shows what I like to call the security convenience bell curve. Typically, as you increase the inconvenience factor, you also increase security, but there comes a point when this inconvenience has an adverse effect on security.

An example of the security convenience bell curve would be a company’s “password change frequency” policy. At first, the company’s policy requires users to change their passwords every six months. In an attempt to make the company even more secure, the policy is modified so that users must change their password every three months. However, after a few times of changing their passwords, users find it difficult to remember them and start writing them on sticky notes that are then stuck to their monitors or under their keyboards. This is obviously not a good place for confidential data and ultimately makes the business less secure.

That’s relatively straightforward, so what’s all the confusion about? The confusion comes from the fact that many people think that for a given security issue, there is a “fix” that completely eliminates any risk from that issue. You must understand that it is, without a doubt, 100 percent impossible to eliminate all risk from any technology, system, or even situation. For every mitigating control there is a discrete level of risk, no matter how minute. Risk is inherent in everything we do, in every choice we make, every single day. The idea of risk versus return on investment (ROI) has been intimately involved in the decision-making process of business owners for centuries; this same knowledge can be applied to our latest technologies in the security realm.

This is best understood by looking at an example. As kids we were told to look both ways before crossing the street, so let’s look at the risks associated with crossing the street.

It should also be noted that the purpose of analyzing risk is not always to choose the path with the least risk. Rather, it is to make an informed decision that best suits the person or organization. More on this later.

Quantitative costs are anything you can put a hard number to. For example, in quantitative terms, the cost to replace a $100 phone is—you guessed it—$100.

Qualitative costs are much more subjective and harder to define and may be drastically different between persons or organizations. The easiest way to understand qualitative costs is to think of the emotional costs of an incident. For example, if you have a special gift that was given to you, it may be worth only a few dollars if you were to try and sell it, but it might cause a lot of emotional pain if it were lost. Thus, the qualitative cost of replacing it might be very high. This is an extremely simplistic way to look at qualitative cost, but it should help you grasp the concept quickly.

Here are few examples of quantitative impacts:

And here are a few examples of qualitative impacts:

To use the risk matrix in Figure 1-2 you simply identify the likelihood and impact of a potential threat. For example, the likelihood of someone stealing a server might be low and the impact might be low (if you encrypt your hard drives). You would then plot this threat as existing in the lower left quadrant and have an overall threat of low. You could then compare this to other threats and deal with them as your business dictates.

The actual naming convention or the numbers used in the calculation of each component can be essentially arbitrary as long as the same system is used for each calculation. For example, it doesn’t matter if you calculate probability in months, years, or decades, as long as you use the same period for each calculation.

If you’re developing a security program for your own company, feel free to start from scratch and come up with a numeric or naming system that fits your business. The key here is consistency: As long as you’re identifying risk levels using a common system, you’ll be able to identify areas that you wish to mitigate first. You can find plenty of examples to choose from on the Internet, so look for one that fits your business. The Department of Homeland Security provides many good resources at www.dhs.gov.

Now let’s use our previous examples to calculate the risk level associated with each. We’ll define an arbitrary system for each component first. Impact will be a number between 1 and 10, with 1 being the lowest impact and 10 being the highest. Probability will be a yearly probability based on statistical information.

As you can see, the risk level from distracted drivers is much greater than that of falling airplanes. Therefore, you might want to protect yourself from distracted drivers before worrying about falling airplanes.

The difficult part here is that different people might define different probabilities or different vulnerability levels to the same threat. For example, the probability of getting struck by a car while crossing the street is much higher for someone living in New York City than it is for someone living in a rural community in Kansas.

You could construct a house for a few million dollars that could withstand the impact from a falling plane, but when you consider the extremely remote possibility of a falling plane striking your house, you’ll probably come to the conclusion that it’s not worth the cost. Yes, this is just another extreme example, so let’s look at a very simple business example.

A new regulation has come out that affects your business. If you fail to comply with the regulation, you will be fined $5,000 every year. You’ve hired an external firm to assess the cost to make you compliant with the regulation and they think at a bare minimum it will cost you $2,000,000. It’s not hard to see here that it makes more business sense to just pay the fine and not try to make your business compliant.

Four main approaches can be taken to manage risk: You can accept the risk, avoid the risk, transfer the risk, or mitigate the risk. In the two previous examples, we’ve chosen to accept the risk associated with each scenario. Now let’s look at our other options for dealing with the risk of the new regulation.

You may hear many reports stating that the majority of security breaches come from internal personnel. Now, although I agree with this statement in theory, a little speculation might help to clarify exactly what is meant by it. Here are the key points:

The IEEE identifies each standard with a letter. For example, 802.11a is different from 802.11b. Although there are some commonalities between technologies, there are also differences, as well as advantages and disadvantages to choosing one technology over the other. For the most part, the differences between standards are in speed, modulation techniques, and whether they are backward compatible and a security technique that works for one will work for the others. For example, even though 802.11g was developed after 802.11b, it still supports WEP to ensure backward compatibility.

However, keep in mind that some specific tools will only work for a specific standard. For example, if a program is written specifically to work with 802.11b, it might not work for 802.11a or even 802.11g. Because the underlying protocols for how data is handled are the same across standards, the attacks and defense in theory will be identical.

The 802.11 standards prescribe which frequencies these technologies use as well as the channels available to them. For example, the 802.11b standard operates in the 2.4 GHz frequency and, in the United States, has 11 unique channels available for use (labeled Channels 1 through 11). These unique channels assist in allowing networks to be physically close and not interfere with each other. However, depending on the country, the channels available for use may be different. For example, in Japan the channels are actually 1 through 14. This has security implications because an access point operating on Channel 14 may go completely unnoticed in the U.S. More on this later.

The following is a simple cheat sheet of the 802.11 standards.

Various wireless LAN technologies are fairly similar, which is understandable considering that each new generation of standard is typically backward compatible with its predecessor. Technologies that are unique to a specific generation of wireless technologies will be noted as such.

Wireless networks can operate in one of two basic modes: Infrastructure and Ad-Hoc. In Infrastructure mode, clients connect to an access point. In Ad-Hoc mode, no access point is involved; instead, clients communicate with each other (or end nodes). We’ll use the term end node because nowadays a client can be anything from a laptop to a cell phone to a printer with a built-in wireless network card.

Access points have come a very long way since their introduction. Many new features (some existing and new) have been added to access points. For example, captive web portals have existed for a long time before wireless networks became popular but they’ve been implemented in many access points. We will not discuss every feature available, but definitely keep in mind that from a security perspective all this added functionality comes with its own inherent risks. For example, whereas you once could only configure an access point from a web interface or a limited command line, now you have an almost full-fledged command line with common network tools. Thus, tools such as Ping, Telnet, SSH, and Traceroute make an access point an even more appealing target for an attacker to leverage his position and infiltrate deeper into a network. Also keep in mind that with added complexity comes a greater chance to misconfigure an access point. More knowledge is required to securely configure an access point with more features. We’ll go over this in more detail in Chapter 6.

A management system would typically be installed on a server (or desktop) and would simply interact with existing management protocols, thus allowing administrators to automate some of the more mundane tasks. Existing management protocols include tools such as Telnet, SSH, and SNMP. An administrator could, for example, create a template profile with a specified SSID, encryption method, and authentication method and apply this template to an access point.

The management system would then telnet (or connect using another management protocol) to the access point and apply the configuration. This, of course, requires that first the administrator configure basic IP connectivity on the access point and enable Telnet. Therefore, a level of administrative burden is associated with adding new access points.

To make things even easier on administrators, we have a new generation of access points that are commonly referred to as lightweight access points. A few protocols deal with lightweight access points, mainly the Cisco proprietary LWAPP (Lightweight Access Point Protocol) and CAPWAP (Control And Provisioning of Wireless Access Points), which is a standard, interoperable protocol based on LWAPP. It is not necessary to understand the specifics of these protocols; they will be discussed in greater detail later.

Lightweight access points generally allow an administrator to perform 99 percent of the configuration ahead of time, thus greatly reducing the total administrative effort. An administrator can create a profile that completely configures an access point. When a new access point is added to the network, it “discovers” the controller and “automagically” downloads and applies the appropriate configuration. A myriad of different options are available for how the access point discovers the controller and how it downloads its configuration. We will be reviewing these options in Chapter 11. The important thing to note is that you don’t even need an IP address configured on your lightweight access points. You can literally take your shiny new lightweight access point out of the box, plug it into your network, and it will be configured automagically and provide wireless services within minutes.

Think about how beneficial this would be for large-scale deployments. However, although this is the latest and greatest technology for configuring wireless access points, it is not necessary for all new wireless deployments. You must still evaluate the return on investment. In many cases, just configuring (a few) access points by hand can be a much more cost-effective solution. We will evaluate the different options for using a controller-based system in a few test scenarios in later chapters.