Table of Contents

Copyright Page

About the Authors

I. Wireless Technology

Chapter 1. Wireless Fundamentals

1.1. The Wireless Medium

1.1.1. Radio Propagation Effects

1.1.2. Hidden Terminal Problem

1.1.3. Exposed Terminal Problem

1.1.4. Bandwidth

1.1.5. Other Constraints

1.2. Wireless Networking Basics

1.2.1. Wireless Local Area Networks

1.2.1.3. Advantages and Disadvantages of WLANs

Chapter 2. Wireless Network Logical Architecture

2.1. The OSI Network Model

2.2. Network Layer Technologies

2.2.1. IP Addressing

2.2.2. Private IP Addresses

2.2.3. Internet Protocol Version 6 (IPv6)

2.2.4. Address Resolution Protocol

2.2.5. Routing

2.2.6. Network Address Translation

2.2.7. Port Address Translation

2.3. Data Link Layer Technologies

2.3.1. Logical Link Control

2.3.2. Media Access Control

2.3.3. Media Access Control in Wired Networks

2.3.4. Media Access Control in Wireless Networks

2.4. Physical Layer Technologies

2.4.1. Physical Layer Technologies—Wired Networks

2.4.2. Physical Layer Technologies—Wireless Networks

2.5. Operating System Considerations

2.6. Summary

Chapter 3. Wireless Network Physical Architecture

3.1. Wired Network Topologies—A Refresher

3.2. Wireless Network Topologies

3.2.1. Point-to-Point Connections

3.2.2. Star Topologies in Wireless Networks

3.2.3. Mesh Networks

3.3. Wireless LAN Devices

3.3.1. Wireless Network Interface Cards

3.3.2. Access Points

3.3.3. Wireless LAN Switches or Controllers

3.3.4. Lightweight Access Point Protocol

3.3.5. Wireless LAN Arrays

3.3.6. Miscellaneous Wireless LAN Hardware

3.3.7. Wireless LAN Antennas

3.4. Wireless PAN Devices

3.4.1. Wireless PAN Hardware Devices

3.4.2. Wireless PAN Antennas

3.5. Wireless MAN Devices

3.5.1. Fixed Wireless MAN Devices

3.5.2. Fixed Wireless MAN Antennas

3.5.3. Mobile Wireless MAN Devices

Chapter 4. Radio Communication Basics

4.1. Mechanisms of Radio Wave Propagation

4.2. Open Field Propagation

4.3. Diffraction

4.4. Scattering

4.5. Path Loss

4.6. Multipath Phenomena

4.7. Flat Fading

4.7.1. Rayleigh Fading

4.8. Diversity Techniques

4.8.1. Space Diversity

4.8.2. Frequency Diversity

4.8.3. Polarization Diversity

4.8.4. Diversity Implementation

4.8.5. Statistical Performance Measure

4.9. Noise

4.10. Communication Protocols and Modulation

4.10.1. Baseband Data Format and Protocol

4.10.2. Baseband Coding

4.10.3. RF Frequency and Bandwidth

4.10.4. Modulation

4.10.5. RFID

4.11. Summary

References

Chapter 5. Infrared Communication Basics

5.1. The Ir Spectrum

5.2. Infrared Propagation and Reception

5.2.1. Transmitted Power Density—Radiant Intensity

5.2.2. Emitter Beam Pattern

5.2.3. Inverse Square Loss

5.2.4. Ir Detector Sensitivity

5.2.5. Ir Link Distance

5.3. Summary

Chapter 6. Wireless LAN Standards

6.1. The 802.11 WLAN Standards

6.1.1. Origins and Evolution

6.1.2. Overview of the Main Characteristics of 802.11 WLANs

6.2. The 802.11 MAC Layer

6.2.1. Wireless Media Access

6.2.2. Discovering and Joining a Network

6.2.3. Station Services

6.2.4. Distribution System Services

6.3. 802.11 PHY Layer

6.3.1. 802.11a PHY Layer

6.3.2. 802.11b PHY Layer

6.3.3. 802.11g PHY Layer

6.3.4. Data Rates at the PHY and MAC Layer

6.4. 802.11 Enhancements

6.4.1. Quality of Service (802.11e Specification)

6.4.2. Spectrum Management at 5 GHz (802.11h)

6.4.3. Network Performance and Roaming (802.11k and 802.11r)

6.4.4. MIMO and Data Rates to 600 Mbps (802.11n)

6.4.5. Mesh Networking (802.11s)

6.5. Other WLAN Standards

6.5.1. HomeRF

6.5.2. HiperLAN/2

6.6. Summary

Chapter 7. Wireless Sensor Networks

7.1. Introduction to Wireless Sensor Networks

7.2. Individual Wireless Sensor Node Architecture

7.3. Wireless Sensor Networks Architecture

7.3.1. Star Network (Single Point-to-Multipoint)

7.3.2. Mesh Network

7.3.3. Hybrid Star-Mesh Network

7.4. Radio Options for the Physical Layer in Wireless Sensor Networks

7.4.1. IEEE802.11x

7.4.2. Bluetooth (IEEE802.15.1 and .2)

7.4.3. IEEE 802.15.4

7.4.4. ZigBee

7.4.5. IEEE1451.5

7.5. Power Consideration in Wireless Sensor Networks

7.6. Applications of Wireless Sensor Networks

7.6.1. Structural Health Monitoring – Smart Structures

7.6.2. Industrial Automation

7.6.3. Application Highlight – Civil Structure Monitoring

7.7. Future Developments

II. Security Defi nitions and Concepts

Chapter 8. Attacks and Risks

8.1. Threats to Personal Privacy

8.2. Fraud and Theft

8.3. Internet Fraud

8.4. Employee Sabotage

8.5. Infrastructure Attacks

8.6. Malicious Hackers

8.7. Malicious Coders

8.8. Industrial Espionage

8.9. Social Engineering

8.9.1. Educate Staff and Security Personnel

8.9.2. Crafting Corporate Social Engineering Policy

Chapter 9. Security Defined

9.1. What Is Security?

9.2. What Can We Do?

9.3. Access Control and the Origins of Computer Security Theory

9.4. Security Policies

9.4.1. Cryptography

9.4.2. Symmetric Cryptography

9.4.3. Public-Key Cryptography

9.5. Data Integrity and Authentication

9.5.1. Message Digests

9.5.2. Digital Signatures

9.5.3. Digital Certificates

9.5.4. Public-Key Infrastructures

9.6. Recommended Reading

Chapter 10. Standardizing Security

10.1. Protocol Madness

10.2. Standardizing Security—A Brief History

10.3. Standardized Security in Practice

10.3.1. Cryptographic Algorithms

10.3.2. Cryptography in Practice

10.4. Cryptography and Protocols

10.5. Other Security Protocols

10.5.1. SSH

10.5.2. IPSEC

10.5.3. Other Protocols

10.5.4. Wrap-Up

Chapter 11. Secure Sockets Layer

11.1. SSL History

11.2. Pesky PKI

11.3. PKI Alternatives

11.4. SSL under the Hood

11.5. The SSL Session

11.6. SSL in Practice

Chapter 12. Cryptography

12.1. Do We Need Cryptography?

12.2. Hashing—Low Security, High Performance

12.2.1. Is Hashing Considered Dangerous?

12.3. To Optimize or Not to Optimize…

12.3.1. Optimization Guidelines: What NOT to Optimize

12.3.2. Optimization Guidelines: What Can We Optimize?

12.4. Choosing Cryptographic Algorithms

12.5. Tailoring Security for Your Application

Chapter 13. Managing Access

13.1. Access Control

13.1.1. Purpose of Access Control

13.1.2. Access Control Entities

13.1.3. Fundamental Concepts of Access Control

13.1.4. Access Control Criteria

13.1.5. Access Control Models

13.1.6. Uses of Access Control

13.1.7. Access Control Administration Models

13.1.8. Access Control Mechanisms

13.1.9. Techniques Used to Bypass Access Controls

13.2. Password Management

13.2.1. SmartCards

13.2.2. Biometric Systems

13.2.3. Characteristics of Good Passwords

13.2.4. Password Cracking

13.2.5. Password Attack Countermeasures

Chapter 14. Security and the Law

14.1. The 1996 National Information Infrastructure Protection Act

14.2. President’s Executive Order on Critical Infrastructure Protection

14.3. The USA Patriot Act of 2001

14.4. The Homeland Security Act of 2002

14.5. Changes to Existing Laws

14.5.1. Authority to Intercept Voice Communications

14.5.2. Obtaining Voice-Mail and Other Stored Voice Communications

14.5.3. Changes to Wiretapping Procedures

14.5.4. Scope of Subpoenas for Electronic Evidence

14.5.5. Clarifying the Scope of the Cable Act

14.5.6. Emergency Disclosures by Communications Providers

14.5.7. Pen Register and Trap and Trace Statute

14.5.8. Intercepting Communications of Computer Trespassers

14.5.9. Nationwide Search Warrants for E-Mail

14.5.10. Deterrence and Prevention of Cyberterrorism

14.6. Investigations

14.7. Ethics

Chapter 15. Intrusion Process

15.1. Profiling To Select a Target or Gather Information

15.2. Social Engineering

15.3. Searching Publicly Available Resources

15.4. War-Driving, -Walking, -Flying, and -Chalking

15.4.1. WLAN Audit and Discovery Tools

15.4.2. Network Discovery Tools

15.4.3. Networking Utilities

15.5. Exploitable WLAN Configurations

15.6. How Intruders Obtain Network Access to a WLAN

15.6.1. WLAN Attacks

15.6.2. WEP Decryption Tools

15.6.3. MAC Address Spoofing and Circumventing Filters

15.6.4. Rogue AP Exploitation

15.6.5. Exploiting Confidentiality Weaknesses

15.6.6. Exploiting Data Integrity Weaknesses

15.6.7. Exploiting Authentication Weaknesses of the Service Set Identifier

15.6.8. Exploiting Cryptographic Weaknesses

15.7. Password Gathering and Cracking Software

15.7.1. WinSniffer

15.7.2. Ettercap

15.7.3. L0phtCrack

15.7.4. Lucent Registry Crack

15.7.5. Wireless Protocol Analyzers

15.8. Share Enumerators

15.9. Using Antennas and WLAN Equipment

15.9.1. Antennas

15.9.2. Wireless Cards

15.10. Denial-of-Service Attacks and Tools

15.10.1. RF Jamming

15.10.2. Data Flooding

15.10.3. Client Hijacking

15.11. Rogue Devices as Exploitation Tools

15.11.1. Access Points

15.11.2. Wireless Bridges

References

Chapter 16. Security Policy

16.1. Best Practice #1

16.2. Best Practice #2

16.3. Best Practice #3

III. Wireless Network Security

Chapter 17. Security in Traditional Wireless Networks

17.1. Security in First Generation TWNs

17.2. Security in Second Generation TWNs

17.2.1. Anonymity in GSM

17.2.2. Key Establishment in GSM

17.2.3. Authentication in GSM

17.2.4. Confidentiality in GSM

17.2.5. What’s Wrong with GSM Security?

17.3. Security in 2.5 Generation TWNs

17.3.1. WAP

17.3.2. Code Security

17.4. Security in 3G TWNs

17.4.1. Anonymity in UMTS

17.4.2. Key Establishment in UMTS

17.4.3. Authentication in UMTS

17.4.4. Confidentiality in UMTS

17.4.5. Integrity Protection in UMTS

17.4.6. Putting the Pieces Together

17.4.7. Network Domain Security

17.5. Summary

Chapter 18. Wireless LAN Security

18.1. Introduction

18.2. Key Establishment in 802.11

18.2.1. What’s Wrong?

18.3. Anonymity in 802.11

18.4. Authentication in 802.11

18.4.1. Open System Authentication

18.4.2. Shared Key Authentication

18.4.3. Authentication and Handoffs

18.4.4. What’s Wrong with 802.11 Authentication?

18.4.5. Pseudo-Authentication Schemes

18.5. Confidentiality in 802.11

18.5.1. What’s Wrong with WEP?

18.6. Data Integrity in 802.11

18.7. Loopholes in 802.11 Security

18.8. WPA

18.8.1. Key Establishment

18.8.2. Authentication

18.8.3. Confidentiality

18.8.4. Integrity

18.8.5. The Overall Picture: Confidentiality + Integrity

18.8.6. How Does WPA Fix WEP Loopholes?

18.9. WPA2 (802.11i)

18.9.1. Key Establishment

18.9.2. Authentication

18.9.3. Confidentiality

18.9.4. Integrity

18.9.5. The Overall Picture: Confidentiality+Integrity

Chapter 19. Security in Wireless Ad Hoc Networks

19.1. Introduction

19.2. Bluetooth

19.2.1. Bluetooth Basics

19.2.2. Security Modes

19.2.3. Key Establishment

19.2.4. Authentication

19.2.5. Confidentiality

19.2.6. Integrity Protection

19.2.7. Enhancements

Chapter 20. Implementing Basic Wireless Security

20.1. Introduction

20.2. Enabling Security Features on a Linksys WAP11 802.11 b Access Point

20.2.1. Setting a Unique SSID

20.2.2. Disabling SSID Broadcast

20.2.3. Enabling WEP

20.3. Filtering by Media Access Control (MAC) Address

20.4. Enabling Security Features on a Linksys BEFW11 SR 802.11 b Access Point/Router

20.4.1. Setting a Unique SSID

20.4.2. Disabling SSID Broadcast

20.4.3. Enabling WEP

20.4.4. Filtering by Media Access Control (MAC) Address

20.5. Enabling Security Features on a Linksys WRT54G 802.1 lb/g Access Point/Router

20.5.1. Setting a Unique SSID

20.5.2. Disabling SSlD Broadcast

20.5.3. Enabling WEP

20.5.4. Filtering by Media Access Control (MAC) Address

20.6. Enabling Security Features on a D-Link DI-624 AirPlus 2.4 GHz Xtreme G Wireless Router with 4-Port Switch

20.6.1. Setting a Unique SSID

20.6.2. Enabling Wired Equivalent Privacy

20.6.3. Filtering by Media Access Control (MAC) Address

20.6.4. Disabling SSID Broadcast

20.7. Configuring Security Features on Wireless Clients

20.7.1. Configuring Windows XP Clients

20.7.2. Configuring Windows 2000 Clients

20.7.3. Configuring Linux Clients

20.8. Summary

20.9. Solutions Fast Track

20.9.1. Enabling Security Features on a Linksys WAP11 802.11b AP, Linksys BEFW11SR 802.11b AP/Router, WRT54G 802.11b/g AP/Router, and D-Link DI-624 AirPlus 2.4 GHz Xtreme G Wireless Router with 4-Port Switch

20.9.2. Configuring Security Features on Wireless Clients

Chapter 21. Implementing Advanced Wireless Security

21.1. Introduction

21.2. Implementing Wi-Fi Protected Access (WPA)

21.2.1. Configuring the D-Link DI-624 AirPlus 2.4 GHz Xtreme G Wireless Router with 4-Port Switch

21.2.2. Configuring the Linksys WRV54G VPN Broadband Router

21.2.3. Configuring Windows XP Wireless Clients for WPA

21.3. Implementing a Wireless Gateway with Reef Edge Dolphin

21.3.1. Installing Dolphin

21.3.2. Configuring Dolphin

21.3.3. Improving the User Experience

21.3.4. Dolphin Review

21.4. Implementing a VPN on a Linksys WRV54G VPN Broadband Router

21.4.1. Preparing Windows 2000 or XP Computers for Use with the WRV54G

21.4.2. Enabling the VPN on the Linksys WRV54G

21.5. Implementing RADIUS with Cisco LEAP

21.5.1. LEAP Features

21.5.2. Building a LEAP Solution

21.5.3. Installing and Configuring Steel Belted RADIUS

21.5.4. Configuring LEAP

21.5.5. Windows Active Directory Domain Authentication with LEAP and RADIUS

21.5.6. LEAP Review

21.6. Understanding and Configuring 802.1X RADIUS Authentication

21.6.1. Microsoft RADIUS Servers

21.6.2. The 802.1X Standard

21.6.3. Configuring 802.1X Using EAP-TLS on a Microsoft Network

21.7. Summary

21.8. Solutions Fast Track

21.8.1. Implementing WiFi Protected Access (WPA)

21.8.2. Implementing a Wireless Gateway with Reef Edge Dolphin

21.8.3. Implementing a VPN on a Linksys WRV54G VPN Broadband Router

21.8.4. Implementing RADIUS with Cisco LEAP

21.8.5. Understanding and Configuring 802.1X RADIUS Authentication

IV. Other Wireless Technology

Chapter 22. Home Network Security

22.1. Introduction

22.2. The Basics of Wireless Networks

22.2.1. 802.11b

22.2.2. 802.11a

22.2.3. 802.11g

22.2.4. Next-Generation Protocols

22.3. Basic Wireless Network Security Measures

22.3.1. Secure Your Home Wireless Network

22.3.2. Change the SSID

22.3.3. Configure Your Home Wireless Network

22.3.4. Restrict Access to Your Home Wireless Network

22.3.5. Use Encryption in Your Home Wireless Network

22.3.6. Review Your Logs

22.3.7. Use Public Wireless Networks Safely

22.3.8. Install Up-to-Date Antivirus Software

22.3.9. Install a Personal Firewall

22.4. Additional Hotspot Security Measures

22.4.1. Verify Your Hotspot Connection

22.4.2. Watch Your Back

22.4.3. Use Encryption and Password Protection

22.4.4. Don’t Linger

22.4.5. Use a VPN

22.4.6. Use Web-Based E-mail

22.5. Summary

22.6. Additional Resources

Chapter 23. Wireless Embedded System Security

23.1. Wireless Technologies

23.1.1. Cellular Technologies

23.1.2. 802.11 (Wi-Fi)

23.1.3. WPA Key Management

23.1.4. WPA Authentication

23.1.5. Drowning in Acronyms

23.1.6. Do You Really Need 802.11?

23.2. Bluetooth

23.3. ZigBee

23.4. Wireless Technologies and the Future

Chapter 24. RFID Security

24.1. Introduction

24.2. RFID Security in General

24.3. RFID Radio Basics

24.4. Why Use RFID?

24.5. RFID Architecture

24.5.1. Tag/Label

24.5.2. Reader

24.5.3. Middleware

24.6. Data Communications

24.6.1. Tag Data

24.6.2. Protocols

24.7. Physical Form Factor (Tag Container)

24.7.1. Cards

24.7.2. Key Fobs

24.7.3. Other Form Factors

24.8. Threat and Target Identification

24.8.1. Attack Objectives

24.8.2. Blended Attacks

24.9. Management of RFID Security

24.9.1. Risk and Vulnerability Assessment

24.9.2. Risk Management

24.9.3. Threat Management

24.10. Summary

24.11. Links to Sites