| Wireless Lan Security |
Article Index for Wireless |
Website Links For Wireless |
Information AboutWireless Lan Security |
| CATEGORIES ABOUT WIRELESS LAN SECURITY | |
| wireless networking | |
| lan | |
| computer network security | |
|
One issue with Wireless Networks in general, and WLANs in particular, involves the need for Security . Many early access points could not discern whether or not a particular user had authorization to access the network. Although this problem reflects issues that have long troubled many types of wired networks (it has been possible in the past for individuals to plug computers into randomly available Ethernet Jack s and get access to a local network), this did not usually pose a significant problem, since many organizations had reasonably good physical security. However, the fact that radio signals bleed outside of buildings and across property lines makes physical security largely irrelevant to War Drivers . CONCERNS Anyone within the geographical network range of an open, unencrypted wireless network can sniff on all the traffic, gain unauthorized access to internal network resources as well as to the Internet, possibly sending spam or doing other illegal actions using the owner's IP Address . The lack of default security in wireless connections is quickly becoming an issue, especially in the UK, where many Broadband ( ADSL ) connections are now offered together with a Wireless Basestation/ADSL Modem/ Firewall / Router access point. Further, many laptop PCs now have Wireless Networking built in (cf. Intel ' Centrino ' technology) thus eliminating the need for an additional plug-in ( PCMCIA ) card. These features might be enabled by default, without the owner ever realising it, thus broadcasting the laptop's accessibility to any computer nearby. Modern operating systems such as Linux , Mac OS , or Microsoft Windows XP as the 'standard' in home PCs makes it very easy to set up a PC as a Wireless LAN 'basestation' and using Internet Connection Sharing allows all the PCs in the home to access the Internet via the 'base' PC. However, lack of knowledge about the security issues in setting up such systems often means that someone nearby, such as a next-door neighbor, may also use the internet connection. This is typically done without the wireless network owner's knowledge; it may even be without the knowledge of the intruding user if his computer automatically selects a nearby wireless network to use as an access point. SOLUTIONS There are three quite different ways to secure a wireless network.
Access Control at the Access Point level One of the simplest techniques is to only allow access from known, approved MAC Address es. However, this approach gives no security against sniffing, and client devices can easily Spoof MAC addresses, leading to the need for more advanced security measures. Another very simple technique is to have a secret ESSID (id/name of the wireless network), though anyone will be able to sniff the ESSID. Today all (or almost all) access points incorporate Wired Equivalent Privacy (WEP) Encryption , but security analysts have criticized WEP's inadequacies, and the U.S. FBI has demonstrated the ability to break WEP protection in only 3 minutes. The alternate Wi-Fi Protected Access (WPA) security protocol was later created to address these problems. WPA has also been cracked, although more effort is needed with WPA than WEP. The second generation of the WPA security protocol (WPA2) is based on the final IEEE 802.11i amendment to the 802.11 standard and is eligible for FIPS 140-2 compliance. With all those encryption schemes, any client in the network knowing the keys can sniff on all the traffic. Restricted access networks Solutions include a newer system for Authentication , IEEE 802.1x , that promises to enhance security on both wired and wireless networks. Wireless access points that incorporate technologies like these often also have Router s built in, thus becoming Wireless Gateway s. End-to-End encryption One can argue that neither encryption in the router level nor VPN is good enough for protecting valuable data like passwords and personal emails; those technologies add encryption only to parts of the communication path, still allowing people to spy on the traffic if they have gained access to the wired network somehow. The solution may be to get the encryption and authorization done in the software layer using technologies like SSL , SSH , GnuPG , PGP and friends. The disadvantage with this approach is that it can be difficult to cover all the traffic - with encryption on the router level, or VPN, it's just one switch to get all traffic encrypted, while with end-to-end encryption, one has to "turn on encryption" for each and every service one wants to use, and quite often also for each and every connection. For sending emails, all the recipients must support the encryption and keys have to be exchanged. For web, it's not all web sites offering https - and even if using end-to-end-encrpytion on everything, the IP-addresses you communicate with will go in clear text. Say, if you frequent the Playboy Magazine , your mother-in-law may find it out, even if using https. Also, the most prized resource is often access to Internet; it's not trivial to enforce each user to authenticate himself for the router. OPEN ACCESS POINTS Today, there is almost full wireless network coverage in many urban areas - the infrastructure for the Wireless Community Network (which some people are considering to be the future of the internet) is already in place, and one could roam around and always be connected to Internet if all the nodes would be open to the public - but due to security concerns, most of the nodes are encrypted. Many people consider it to be proper etiquette to leave access points open to the public, allowing free access to Internet. The density of access points can even be a problem - there are a limited number of channels available, and they partly overlap. In situations where there are a lot of private wireless network near each other (for example, an apartment complex), the limited amount of data channels on the Wi-Fi range might cause overlapping problems. According to the advocates of Open Access Points, it shouldn't involve any significant risks to open up wireless networks for the public:
EXTERNAL LINKS
SEE ALSO |
|
|