| Wireless Lan Security |
Article Index for Wireless |
Website Links For Wireless |
Information AboutWireless Lan Security |
| CATEGORIES ABOUT WIRELESS LAN SECURITY | |
| wireless networking | |
| lan | |
| computer network security | |
|
CONCERNS Anyone within the geographical network range of an open, unencrypted wireless network can sniff on all the traffic, gain unauthorized access to internal network resources as well as to the Internet, possibly sending spam or doing other illegal actions using the owner's IP Address , all of which are rare for home routers but may be significant concerns for office networks. If router security is not activated, or if the owner deactivates it for convenience, it creates a free Hotspot . Further, virtually all laptop PCs now have Wireless Networking built in (cf. Intel ' Centrino ' technology), thus rendering redundant the need for a third-party adapter (usually a PCMCIA Card or USB dongle). These features might be enabled by default, without the owner ever realizing it, thus broadcasting the laptop's accessibility to any computer nearby. Modern operating systems such as Linux , Mac OS , or Microsoft Windows XP as the 'standard' in home PCs make it very easy to set up a PC as a Wireless LAN 'basestation' and using Internet Connection Sharing , thus allowing all the PCs in the home to access the Internet via the 'base' PC. However, lack of knowledge about the security issues in setting up such systems often means that someone nearby, such as a next-door neighbor, may also use the internet connection. This is typically done without the wireless network owner's knowledge; it may even be Without The Knowledge Of The Intruding User if his computer automatically selects a nearby unsecured wireless network to use as an access point. Conversely, weak as the default encryption of most routers may be, it often defeats a user's attempt to use his own laptop wirelessly at home. SECURITY OPTIONS There are three principal ways to secure a wireless network.
Access Control at the Access Point level One of the simplest techniques is to only allow access from known, approved MAC Address es. However, this approach gives no security against sniffing, and client devices can easily Spoof MAC addresses, leading to the need for more advanced security measures. Another very simple technique is to have a secret ESSID (id/name of the wireless network), though anyone who studies the method will be able to sniff the ESSID. Today all (or almost all) access points incorporate Wired Equivalent Privacy (WEP) Encryption and most wireless routers are sold with WEP turned on. However, security analysts have criticized WEP's inadequacies, and the U.S. FBI has demonstrated the ability to break WEP protection in only 3 minutes using tools available to the general public (see Aircrack ). The Wi-Fi Protected Access (WPA and WPA2) security protocols were later created to address these problems. If a weak password, such as a dictionary word or short character string is used, WPA and WPA2 can be cracked. Using a long enough random password (e.g. 14 random letters) or Passphrase (e.g. 5 Randomly Chosen Words ) makes Pre-shared Key WPA virtually uncrackable. The second generation of the WPA security protocol (WPA2) is based on the final IEEE 802.11i amendment to the 802.11 standard and is eligible for FIPS 140-2 compliance. With all those encryption schemes, any client in the network that knows the keys can read all the traffic. Restricted access networks Solutions include a newer system for Authentication , IEEE 802.1x , that promises to enhance security on both wired and wireless networks. Wireless access points that incorporate technologies like these often also have Router s built in, thus becoming Wireless Gateway s. End-to-End encryption One can argue that neither encryption in the router level nor VPN is good enough for protecting valuable data like passwords and personal emails; those technologies add encryption only to parts of the communication path, still allowing people to spy on the traffic if they have gained access to the wired network somehow. The solution may be encryption and authorization in the software layer, using technologies like SSL , SSH , GnuPG , PGP and similar. The disadvantage with this approach is that it can be difficult to cover all the traffic - with encryption on the router level, or VPN, it's just one switch to get all traffic encrypted (even UDP and DNS lookups), while with end-to-end encryption, one has to "turn on encryption" for each and every service one wants to use, and quite often also for each and every connection. For sending emails, all the recipients must support the encryption and keys have to be exchanged. For web, not all web sites offer https - and even if using end-to-end-encryption on everything, the IP-addresses you communicate with will go in clear text. Say, if you frequent the Playboy Magazine , your mother-in-law may find it out, even if https hides the contents. The most prized resource is often access to Internet. An office LAN owner seeking to restrict such access will face the non trivial enforcement task of having each user authenticate himself for the router. OPEN ACCESS POINTS Today, there is almost full wireless network coverage in many urban areas - the infrastructure for the Wireless Community Network (which some consider to be the future of the internet) is already in place. One could roam around and always be connected to Internet if the nodes were open to the public, but due to security concerns, most nodes are encrypted and the users don't know how to disable encryption. Many people consider it proper etiquette to leave access points open to the public, allowing free access to Internet. Others think the default encryption provides substantial protection at small inconvenience, against dangers of open access that they fear may be substantial even on a home DSL router. The density of access points can even be a problem - there are a limited number of channels available, and they partly overlap. Each channel can handle multiple networks, but places with many private wireless networks (for example, apartment complexes), the limited number of Wi-Fi radio channels might cause slowness and other problems. According to the advocates of Open Access Points, it shouldn't involve any significant risks to open up wireless networks for the public:
EXTERNAL LINKS
SEE ALSO |
|
|