Wireless Security Techniques: An Overview Wireless Security Techniques: An Overview

Bhagyavati Wayne C. Summers Anthony DeJoie

Columbus State University Columbus State University Telcordia Technologies, Inc. bhagyavati@colstate.edu summers_wayne@colstate.edu tony@research.telcordia.com

AgendaAgenda

1. Introduction 1. Introduction

2. First Generation WLANs 2. First Generation WLANs

3. Second Generation WLANs 3. Second Generation WLANs

4. Curricula Issues 4. Curricula Issues

5. Conclusions 5. Conclusions

IntroductionIntroduction

• Ubiquitous wireless networks– Uncontrolled media / self-deploying network– Wired vs. Wireless networks– Early WLANs slow and not very secure– Today’s WLANs have more choices for

enhanced security, but are still flawed

• Need to incorporate WLAN and WLAN security concepts in our curriculum

WLANsWLANs

• Ad-Hoc [Independent Basic Service Set (IBSS)] - computers talk directly to each other.

• Basic Infrastructure [Basic Service Set (BSS)] Network - all traffic passes through a wireless access point.

• Infrastructure [Extended Service Set (ESS)] Network - traffic passes through multiple wireless access points.

First Generation WLANsFirst Generation WLANs

• The IEEE 802.11 - specification allows for the wireless transmission of raw data at indoor distances from several dozen to several hundred feet and outdoor distances of several to tens of miles using Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) – 802.11b - 11 Mbps using the 2.4 GHz– 802.11a – 54 Mbps using the 5 GHz band– 802.11g – 54 Mbps using 2.4 GHz– 802.11n – 540 Mbps (supports MIMO)

First Generation WLANsFirst Generation WLANs

– Minimal set of security features in 802.11b standard

• Service Set Identifier (SSID)• Medium Access Control (MAC) address filters• Wired Equivalent Privacy (WEP) encryption

– 64-bit RC4 data encryption (flawed) [128-bit WEP also available]

– Does prevent casual “eavesdropping” (if turned on)– Requires a sharing of the key between each mobile

device and the access point– No procedure for key management

First Generation WLANsFirst Generation WLANs

– Main Security Vulnerabilities• Security settings are not enabled by default• By default, access points broadcast SSID in clear

text• MAC address of valid client can be “sniffed” and

then spoofed• WEP is easily broken, only authenticates client• Rogue access points are easy to deploy• Man-in-the-middle attacks• WLANs are easily crashed by DoS attacks

First Generation WLANsFirst Generation WLANs

– Security Controls• Turn off the broadcast SSIDs• Use automated MAC-based access control

mechanisms• Enable WEP encryption• Lower power levels of access points / limit

transmission rates (11 / 5.5 Mbps)

Second Generation WLANsSecond Generation WLANs

• WPA (Wi-Fi Protected Access) – interim encryption standard: FLAWED

• 802.11i– Temporal Key Integrity Protocol (TKIP)

• uses RC4• generates new key every 10 Kb• hashes Initialization Vector• Message Integrity Check

– Advanced Encryption Standard (AES)

Second Generation WLANsSecond Generation WLANs

• 802.1X: Framework for Authentication(EAP – Extensible Authentication Prototcol)

– Transport Layer Security (EAP-TLS): used in 802.1X clients for Windows XP

– Lightweight EAP (LEAP): CISCO product used in Aironet products (dynamic WEP)

– Protected EAP (PEAP): CISCO/Microsoft/RSA – doesn’t require certificates; supports dynamic WEP

– Tunneled Transport Layer Security (EAP-TTLS): Funk Software/Certicom – only requires server certification

Second Generation WLANsSecond Generation WLANs

• VPN (Virtual Private Network)

• Wireless Gateway (simplifies roaming and provides opportunity to implement QoS)

• AirDefense – WLAN Monitoring

• AirFortress – provides for encryption at the MAC layer, hiding data and network information

Policies, Training, & AwarenessPolicies, Training, & Awareness

• Physical location of access points• Logical location of access points (in DMZ)• Ban rogue access points (monitor)• Disable ad-hoc (peer-to-peer) mode on all

clients• Properly configure all devices• Standardize on one vendor• Perform frequent site surveys• Monitor logs• Keep patches up to date

Curricula IssuesCurricula Issues

• Where?

– Networking and Network Management Courses

– Introductory Security Courses– Network Security Courses– Cryptography Course (look at RC4/WPA/AES

encryption algorithms)

Curricula IssuesCurricula Issues

• What?

– Policy Standards for wireless networks– Designing wireless networks– Securing wireless networks– look at encryption algorithms (RC4, WPA,

AES)– Look at standards (802.11i, 802.1X)

Curricula IssuesCurricula Issues

• How?

– Design Wireless Network Policy– Work with University IT Department to help

survey security for campus wireless network– Installing and testing wireless networks– War-driving (discuss ethical issues)– Attack / Defend Exercises

ConclusionsConclusions

• Ubiquitous wireless networks– Home use– Coffee shops, local communities– IEEE 802.16 (WiMAX) - 75 Mb/sec, up to 30

miles

• Need to teach students how to secure them

ResourcesResources

• Wireless Security Blackpaper - http://arstechnica.com/paedia/w/wireless/security-1.html

• Wireless LAN Security FAQ - http://www.iss.net/wireless/WLAN_FAQ.php

• The Unofficial 802.11 Security Web Page -http://www.drizzle.com/~aboba/IEEE/

• Wireless Network Security802.11, Bluetooth and Handheld Devices -

http://csrc.nist.gov/publications/nistpubs/800-48/NIST_SP_800-48.pdf

Questions?Questions?