802.11 insecurity

Security is still the main problem holding back deployment of all 802.11 products.

Many efforts are being made to solve the security issue, including encryption enhancements, VPN, authentication and the IEEE 802.11i standard. However, many users are still in "wait-and-see" mode because the security solutions are too expensive, too difficult to manage and not yet standardized enough.

Security issues for 802.11 have focused on Wired Equivalent Privacy encryption, which was demonstrated in 2001 to be hackable.

Here's an analysis of the available security options:

Media access control (MAC) attacks: One solution that is easy to implement -- but, unfortunately, fairly easy to defeat -- is configuring access points to permit only particular MAC addresses onto the network. Limiting permissible MAC addresses is a useful precaution. However, MAC addresses are easy to fake.

IEEE 802.1X: This standard, supported by Windows XP, defines a framework for MAC-level authentication. Unfortunately, two University of Maryland researchers recently noted serious flaws in client-side security for 802.1X.

VPNs: An approach that has great theoretical appeal is using a VPN to encrypt data on wireless networks. However, VPNs require a lot of management and client configuration.

The ABGs of wireless LANs
Technology tussle

Authentication: Another potential defense against airborne hackers is user authentication. Handspring experimented with software from Vernier Networks for authenticating users, as well as assigning rights for accessing the network based on factors such as location, time and job title. The system was useful, but Handspring decided that authentication alone, without strong encryption, was insufficient.

TKIP: The IEEE 802.11i committee has defined the Temporal Key Integrity Protocol (TKIP) as an interim standard, compatible with existing wireless networks, and designed to provide "good enough" security, pending a stronger standard. TKIP has been tested intensively, but has had a shorter testing period than usual for a critical security standard.

AES: Stronger wireless security will likely come with a 802.11i standard that includes Advanced Encryption Standard (AES) encryption. Unfortunately, an AES-based standard has yet to be approved and will require new hardware.

Nonstandard solutions: A number of small companies offer wireless security solutions that might be effective but have not been standardized or widely deployed. For instance, NextComm provides "key-hopping" technology that can change the encryption key as often as every few seconds. The idea is that by the time a perpetrator can extract a key, a different key will be in use.

802.11 insecurity

Related Links