By Lisa Phifer

November 26, 2001

As the vulnerabilites of 802.11b wireless networks become widely known and exploits are made available, ISPs need to improve security. We examine tools and basic security procedures that are available to everyone.

Over the past year, much has been written about the vulnerabilities of 802.11b wireless LANs. Researchers from AT&T; Labs, UC Berkeley, Intel, and University of Maryland have identified holes in Wired Equivalent Privacy (WEP) that let attackers learn the keys used to encrypt 802.11b traffic.

Tools like NetStumbler exploit 802.11b behavior, sniffing the airwaves to discover cards, access points, and the peer-to-peer or infrastructure networks in which they participate. AirSnort and WEPCrack even use captured traffic to recover crypto keys. Today, anyone armed with one of these shareware tools, a wireless card, antenna, and GPS is capable of “war driving”.

First, acknowledge the problem

802.11b vulnerability assessment products are finding opportunity in WEP’s misfortune. One company, Cigital, offers assessment services that survey 802.11b access points, identifying correctable configuration weaknesses that range from default Service Set IDs (SSIDs) to risk factors for ARP cache poisoning.

NetStumbler and AirSnort are also handy for self-assessment. By roaming around your building or campus, you may discover underground WLANs that you didn’t know about. For more systematic, ongoing introspection, consider commercial products like the ISS Internet Scanner and RealSecure IDS, recently enhanced to spot and monitor 802.11b wireless-borne attacks.

Next, make the best of WEP

War drivers report that just 30 to 40 percent of discovered WLANs now use WEP. For heaven’s sake, enable WEP and change your keys frequently! Consider using 802.11b products with dynamic key generation, like Agere’s ORiNOCO AS-2000 or NextComm’s R7210. Configure long, hard-to-guess SSIDs. Apply MAC filters or use VLANs to restrict access to authorized cards. Track inventory to make sure those cards stay in employee hands, and please block MACs that belong to lost or stolen cards. Lock down access point management interfaces, just as you would on any perimeter router or firewall. Use anti-virus and personal firewall software to keep the wireless client clean, preventing back-channels.

By combining firewall defense with IPsec, SSH, or SSL, you can better prevent wireless eavesdropping and block access by unauthenticated clients. For example, many companies have already deployed a SafeNet or Ashley-Laurent VPN client on laptops for secure remote access. The same client can often tunnel IPsec over wireless to a VPN gateway located between the access point and the rest of the corporate network. Alternatively, consider an access point with built-in IPsec, available from vendors like Colubris Networks.

When roaming, wireless cards often use DHCP to obtain a new IP from each access point. This can be a problem for network layer solutions like IPsec. If roaming is essential to your 802.11b deployment, consider wireless “VPN” solutions from companies like NetMotion, Columbitech, or Ecutel. These products use servers that run proprietary, WTLS, or Mobile IP protocols to avoid session interruption when a wireless client changes its address. They also offer user-level authentication, which may or may not be present in your IPsec VPN today.

For Windows XP, consider using 802.1x

802.11b Open System Authentication is no authentication at all. The alternative, Shared Key Authentication, depends on secrecy of the shared WEP key which can be disclosed or cracked. If your wireless clients happen to run Windows XP, a stronger alternative is available: IEEE 802.1x.

802.1x defines a generic framework for port-based authentication and key distribution. By using the Extensible Authentication Protocol (EAP), an “authenticator” (an Ethernet switch or wireless access point) authenticates a “supplicant” (an Ethernet or wireless NIC) by consulting an authentication server (RADIUS or Kerberos). 802.1x can be implemented with different EAP types, including EAP-MD5 for Ethernet LANs and EAP-TLS for 802.11b WLANs.

802.1x also provides a carrier for secure delivery of session keys used to encrypt traffic between the supplicant and authenticator, addressing another serious omission in the WEP standard. For example, session keys might be created “on the fly” by the access point or supplied by a RADIUS server. If a war driver with AirSnort recovered keys from WEP session traffic, the keys would be of no value for other sessions.

The catch

802.1x products are just now hitting the market. As of this writing, the only operating system with 802.1x support is Microsoft Windows XP (and XP Pro). 802.11b wireless card and access point vendors that support 802.1x today include Agere, Cisco, and Enterasys. Of course, you’ll also need an authentication server that supports EAP (Microsoft IAS, Funk Steel-Belted RADIUS, Interlink RAD-P) or LEAP (Cisco ACS).

What if your entire client base isn’t running XP? One alternative is deploying an access point with mixed-mode support, like Agere’s ORiNOCO AP-2000. For example, the AP-2000 can be configured to authenticate XP clients with 802.1x and other OS clients with Agere’s “Closed System Authentication”, assigning static IPs to known MAC addresses and denying access to all others.

If you run a Cisco shop, consider using Cisco’s proprietary 802.1x derivative, LEAP now available with drivers for other operating systems.

Credentials are another consideration when adopting 802.1x authentication. EAP-TLS requires both the supplicant and authenticator to possess digital certificates, enabling mutual strong authentication. But certificates must be issued by a Certificate Authority more required infrastructure.

Those that prefer (weaker) password authentication may prefer to wait for EAP-SRP (Secure Remote Password), now being defined. Note that 802.1x authenticates MAC addresses, not users. IEEE 802.11i is still working on 802.1x extensions for wireless, including higher level (user) authentication.

Windows XP users seeking wireless public Internet access can give 802.1x a trial run without enterprise rollout. Wayport and Microsoft conducted an 802.1x trial at Seattle-Tacoma airport this summer.

Through the end of January, 2002, Windows XP clients with 802.11b cards get a “free ride” when visiting Wayport-enabled hotel and airport common areas.

There must be a better WEP

Windows XP and 802.11b gear now using 802.1x authentication and key distribution still use WEP for payload encryption. To “fix” the vulnerabilities inherent in WEP, the IEEE is actually defining a brand new encapsulation protocol. This new protocol is expected to use a stronger cipher the Advanced Encryption Standard (AES) in Offset Codebook (OCB) mode. We can hope that it will replace WEP next year, providing industrial-strength data integrity and privacy for 802.11 wireless.

Learn more at the 802.11 wireless conference

When researching this story, I drew upon insights shared by colleagues who will be speaking at the 802.11 Conference on November 28, 2001, in Santa Clara.

To learn more about WEP vulnerabilities and the complementary security measures you can put into place today, attend Protecting Today’s Wireless Networks, presented by Mandy Andress (ArcSec Technologies) and Phil Cox (System Experts).

To learn more about 802.1x and other anticipated authentication, encryption, and encapsulation advances, attend Enhanced Security: Keeping Bandwidth Wolves At Bay, presented by Dorothy Stanley (Agere) and Jesse Walker (Intel). I will be moderating both sessions.

If you can’t make it to the conference, another excellent resource is Bernard Aboba’s Unofficial Wireless Security website. Forewarned is forearmed: by all means, venture forth with 802.11b wireless just do so with eyes wide open and best-available security measures in place.