WLAN Security Issues

In the past, security on WLANs was not a major concern. This lack of concern was, in large part, because WLANs were restrictive. Some of these restrictions involved bandwidth, proprietary systems, and the inability to manage the WLAN as part of the LAN. The most common methods of securing the WLAN were service set identifiers (SSIDs) and the authentication process.

A rogue access point is an access point that has been placed on a WLAN and that might be used to interfere with normal network operations (for denial-of-service [DoS] attacks, for example). If a rogue access point is programmed with the correct WEP key, client data may be captured. The access point may also be configured to provide unauthorized users with information about the network, such as MAC addresses of clients (both wireless and wired), the ability to capture and spoof data packets, and at worst, access to servers and files.

The SSID is a network-naming scheme and configurable parameter that both the client and the access point must share. If the client does not have the proper SSID, it is unable to associate with the access point and would have no access to the network. The SSID feature serves to logically segment the users and access points that form part of a wireless subsystem. Under 802.11 specifications, an access point may advertise, or broadcast, its SSID. During the association process, any 802.11 wireless client with a null string (no value entered in the SSID field) requests that the access point broadcast its SSID. If the access point is so configured, it sends the SSID to the client. The client then uses this SSID to associate with the access point. For these reasons, the SSID should not be considered a security feature of WLAN products.

A client connecting to an access point must go through the process of authenticating and associating. Some WLANs support filtering using a MAC address. Tables are manually constructed on the access point to allow or disallow clients based on their physical hardware address. However, MAC addresses may be relatively easily spoofed, and MAC address filtering is not considered a security feature either.

6-30 Optimizing Converged Cisco Networks (ONT) v1.0 © 2006 Cisco Systems, Inc.

Basic 802.11 WEP security is designed to guard against the threat to network security from unauthorized 802.11 devices outside the LAN. Any device with a valid WEP key is considered a legitimate and authorized user. If the WEP key was obtained through hardware loss, theft, or a wireless security exploit, the network and wireless users are rendered vulnerable, and keys must be changed. Note that persistent WEP keys may be assigned to a client adapter (keys stored in nonvolatile memory on the card itself) via most WLAN client utilities.

Basic 802.11 WEP security provides only one-way authentication. The client is authenticated with the access point (the WEP key is checked), but not vice versa. The client has no way of knowing whether the access point is a legitimate part of the WLAN or a rogue device (that uses same WEP key).

© 2006 Cisco Systems, Inc. Implement Wireless Scalability 6-31

WEP Attacks

In 2000 and 2001, several documented weaknesses in the 802.11 authentication method were made public, as were weaknesses in the data frame encryption method (WEP).

The main problem identified with WLAN security was that very few WLANs were implementing any form of security at all. Any user with an 802.11 client card could potentially attach to one of these WLANs, and, as a result, attach to the LAN.

A hacker using shared key authentication could capture the challenge text packet that was sent to the client and then capture the encrypted response, thus allowing the hacker to derive the WEP key being used. And, using a WLAN sniffer, a hacker could capture enough packets to crack the security and derive the WEP keys, no matter which method of authentication was being used.

A passive or weak initialization vector (IV) is another reason for attacks. The purpose of the IV is to ensure that the same plaintext data frame will never generate the same WEP-encrypted data frame. The method of changing the IV depends on the vendor implementation. (Cisco Aironet wireless products change the IV on a per-packet basis.)

The IV is transmitted as plaintext, and a user "sniffing" the WLAN could see it. Using the same IV over and over with the same WEP key, a hacker could capture the frames and derive information about the data in the frame and data about the network.

Static WEP keys have proven to be highly vulnerable to this type of attack, and that is why it is recommended that WLANs not use static WEP but instead use the more advanced security features implementing 802.1x.

Cisco Aironet access point firmware includes features to improve RC4 and WEP security by hashing WEP keys, thus protecting against weak IVs.

Care must be taken when configuring WLAN security to protect against this type of attack. Configuring the WEP key timeout on the authentication server provides protection. This practice forces wireless clients to reauthenticate, resulting in the generation of a new WEP key.

6-32 Optimizing Converged Cisco Networks (ONT) v1.0 © 2006 Cisco Systems, Inc.

The result of the shorter timeout period is that wireless clients do not use the same WEP key long enough for a hacker to capture the number of frames needed to deduce the WEP key.

Most password-based authentication algorithms are susceptible to online (active) and offline (passive) dictionary attacks. During a dictionary attack, an attacker tries to guess a password and gain network access by using every "word" in a dictionary of common passwords or possible combinations of passwords. A dictionary attack relies on the fact that a password is often a common word, name, or concatenation of words or names with a minor modification such as a trailing digit or two. Longer passwords with a variety of characters (such as 4yosc10cP!) offer the greatest protection against dictionary attacks.

During an online dictionary attack, an attacker tries to actively gain network access by trying possible combinations of passwords for a specific user. Online dictionary attacks can be prevented using lockout mechanisms available on RADIUS servers to lock the user out after a certain number of invalid login attempts. Online attacks also provide some evidence that a breach or compromise is being attempted, allowing you to take corrective measures.

An offline dictionary attack is carried out in two phases to uncover a password. In the first phase, the attacker captures the challenge and response messages between the user and the network. In the second phase, the attacker looks for a password match by computing a list of possible challenge response messages (using a precomputed dictionary, usually with the aid of a password-cracking program) and comparing these messages against the captured challenge and response messages. The attacker uses known authentication protocol vulnerabilities to reduce the size of the user password dictionary. A strong password policy and requirement that users periodically change their passwords significantly reduce the potential for a successful offline attack using these tools. Unlike online attacks, offline attacks are not easily detected.

© 2006 Cisco Systems, Inc. Implement Wireless Scalability 6-33

Continue reading here: Cisco LEAP Authentication

Was this article helpful?

0 0