Cisco Press
Rate your favorite Cisco Press books.
Objectives
Upon completing this chapter, you will be able to
Identify the security risks of VoWLAN systems.
Differentiate the various encryption and authentication solutions.
Understand tips for implementing VoWLAN systems.
Because VoWLAN systems make use of wireless technology, you must consider security issues and corresponding countermeasures. This chapter addresses security issues and provides an overview of the security mechanisms available for protecting VoWLAN systems.
Security Implications
To fully appreciate the need for security for VoWLAN systems, you need to understand the risks of not implementing security beyond the default wireless LAN configuration. The primary implications are unauthorized access, passive monitoring, and denial of service, as shown in Figure 5-1. When deploying a VoWLAN system, assess the potential harm that can be done based on these implications, and determine which security solutions will provide the most effective countermeasures.
Figure 5-1
Primary Wireless LAN Security Implications
Passive Monitoring
A wireless LAN access point set to factory defaults likely has no security mechanisms enabled. As a result, all data sent between the access point and the client device, such as a wireless Internet Protocol (IP) phone or a wireless-equipped computer, is sent “in the clear” without any encryption. Of course, this poses a significant security issue. A hacker using a packet-sniffing tool, such as Ethereal, can passively monitor the transmissions of the wireless clients and access points and capture passwords and contents of e-mails, documents, HTTP messages, and voice conversations. In addition, an access point with default configuration also has default usernames and passwords, which are well known. Also, firmware usually is outdated and needs updating to be fully secure.
A legitimate user, for example, may use her favorite username and password to log in to a fitness website. The hacker can record the packets containing the username and password as the data travels wirelessly from the user’s client device to the access point. The hacker likely doesn’t care about getting access to the fitness site but realizes that the user likely makes use of the same password for other, more important sites, such as banks and corporate applications. These systems generally encrypt the exchange of passwords, so the hacker wouldn’t be able to monitor them. But the hacker can continue to monitor the user’s transmissions and determine the address of where these logins take place. With the user’s favorite and likely common password, the hacker can then access the user’s bank account and applications.
To avoid falling into this trap, users should always use different passwords on each account. In addition, the wireless system should implement a strong form of encryption to ensure that hackers can’t make any sense of the wireless data that they may be monitoring.
Unauthorized Access
With no security enabled on an access point, just about anyone with a wireless-equipped laptop in the parking lot can connect to a wireless local-area network (LAN) located in an office building, manufacturing plant, or hospital. The unsecured access point continually broadcasts a beacon that the wireless laptop receives, and the Microsoft Windows operating system displays the Service Set Identifier (SSID) found within the beacon as an available wireless network. The laptop owner, possibly a hacker, can then readily connect to the access point, which makes the hacker part of the company’s network. This feature allows the hacker to use strategies and tools to steal and corrupt corporate data located on servers in the building. For example, the hacker could run a Transmission Control Protocol (TCP) port scanner and uncover unsecured HTTP administrative interfaces of applications and support tools on servers. This could allow the hacker to create an account on the system for himself and then start stealing and corrupting files and applications.
As a result, you must enable effective access control on the wireless LAN to block hackers from accessing the system.
Denial of Service
A denial of service (DoS) attack is an assault that can cripple or disable a wireless LAN. It blocks users from using their wireless IP phones. The possibility of such an attack occurring is something that all companies deploying wireless LANs should consider.
One form of DoS attack is the “brute-force” method, which can come in two forms: either a flood of packets uses up all the network’s resources and forces it to shut down, or a very strong radio signal dominates the airwaves and renders access points and wireless clients useless. A hacker can perform a packet-based brute-force DoS attack by using other computers on the network to send the useless packets to the server. This method adds significant overhead on the network and takes away useable bandwidth from legitimate users.
The use of very strong radio signals to disrupt the network is a rather risky attack for a hacker to attempt. Because a very powerful transmitter at a relatively close range must be used to execute this type of attack, the owners of the wireless LAN can find the hacker through the use of homing tools, such as AirMagnet.
Sometimes a DoS occurrence on a wireless network may not be intentional. The spectrum that 802.11b operates is very crowded. Other 2.4-GHz devices, such as cordless phones, microwaves, Bluetooth, and more, may cause a significant reduction in 802.11b performance.
To protect against DoS attacks, you must give careful attention to the design of the wireless LAN in a way that limits the propagation of radio waves into the company’s building.
Encryption
As shown in Figure 5-2, encryption is a process that alters data bits of packets before transmission. The opposite end of the wireless link decrypts the data. This process acts to “hide” the data from hackers.
Figure 5-2
Process of Encryption
Figure 5-3 illustrates the portion of the network that encryption protects, depending on whether the encryption is implemented by the wireless LAN or an end-to-end process. Wireless LAN encryption protects only data between the wireless client and the access point, whereas end-to-end encryption protects data between the wireless client and the endpoint of the system, such as a server within an enterprise system.
Figure 5-3
Differences Between Encryption Approaches
Encrypting the data flowing over the wired portion of a corporate network is not generally necessary because it is located within physically controlled space. As a result, wireless LAN encryption alone is generally sufficient. Someone connecting to the corporate network over a public wireless LAN, such as from within a hotel, should use a virtual private network (VPN) client that provides end-to-end encryption.
The following are several encryption techniques that wireless LANs use:
Wired Equivalent Privacy (WEP)
Temporal Key Integrity Protocol (TKIP)
Advanced Encryption Standard (AES)
Wi-Fi Protected Access (WPA)
802.11i
Virtual Private Network (VPN)
Each of the preceding techniques, except VPN, provide encryption only between the wireless client and the access point. The following sections examine each of these encryption techniques in more detail to show how you might use them to protect a VoWLAN system.
WEP
WEP is an encryption method using RC4 encryption. It has been part of 802.11 (as an option) since the standard was first ratified in 1997. WEP makes use of a common key to encrypt and decrypt data frame contents between 802.11 stations, such as wireless IP phones, at the data link layer. Each sending station encrypts the body of each frame with a WEP key before transmission, and the receiving station decrypts it using an identical key upon reception. This process reduces the risk of someone passively monitoring the transmission and gaining access to the information that the frames are carrying. Only 40-bit keys were implemented initially due to U.S. export limitations, but later 128-bit keys were added for additional security.
An issue is that the 802.11 standard doesn’t define a mechanism for distributing WEP keys to the stations. This requires the administrator or users to manually configure their wireless clients with the encryption key, and changing the key is not practical. Thus, WEP keys remain the same on most wireless LANs for months or years, which gives a hacker enough time to exploit the vulnerabilities of WEP and crack the encryption.
WEP has been a target for hackers for several years. In fact, tools freely available from the Internet, such as WEPCrack and Airsnort, can crack the WEP encryption mechanism using either 40- or 128-bit keys. Another problem is that someone can steal a wireless client configured with WEP and then access the network. An administrator won’t know that the device is stolen until it is reported, giving someone enough time to steal and possibly corrupt corporate data. As a result, WEP is not strong enough for enterprise security.
Note – For more information on the weaknesses of WEP, refer to the paper at the following link: https://www.isaac.cs.berkeley.edu/isaac/wep-faq.html.
TKIP
TKIP fixes the key distribution problem of WEP. The TKIP process begins with a 128-bit “temporal key” shared among clients and access points. TKIP combines the temporal key with the client’s Media Access Control (MAC) address and then adds a relatively large 16-octet initialization vector to produce the key used to encrypt data. This procedure ensures that each station uses different key strings to encrypt data.
TKIP uses RC4 to perform the actual encryption of data frames, which is the same as WEP. A major difference from WEP, however, is that TKIP changes temporal keys periodically according to a setting configured in the access point by an administrator. This feature provides a dynamic distribution method that significantly enhances network security and makes cracking it very difficult, if not impossible, for a hacker.
AES
AES offers much stronger encryption than WEP and TKIP. In fact, the U.S. Commerce Department’s National Institute of Standards and Technology (NIST) chose AES to replace the aging Data Encryption Standard (DES). AES is now a Federal Information Processing Standard, FIPS Publication 197. It defines a cryptographic algorithm for use by U.S. Government organizations to protect sensitive, unclassified information. The Secretary of Commerce approved the adoption of AES as an official government standard in May 2002. Some of the older access points and client cards, however, do not support AES because of requirements of a specialized math coprocessor. Keep in mind that regulations exist that prohibit exporting wireless LAN equipment with AES to some countries.
WPA
Before the ratification of the 802.11i standard, the Wi-Fi Alliance released the WPA (version 1) standard that most wireless LAN vendors rapidly adopted. WPA is actually a snapshot of the preratified 802.11i standard involving TKIP and IEEE 802.1x standards. Eventually, the Wi-Fi Alliance released WPA version 2 (WPA2), which includes AES. This mirroring of standards has been effective for end users because the Wi-Fi Alliance requires special interoperability testing before a wireless LAN vendor can claim that its wireless clients and access points are Wi-Fi certified.
802.11i
The 802.11i standard was ratified and became final in mid-2004. The final version specifies the use of TKIP with 802.1X (refer to the later section “IEEE 802.1X”), as well as AES as an option. WPA2 is the same as 802.11i.
Virtual Private Networks
To fully secure wireless connections, many companies require the use of VPN software on each user device. This software encrypts all communications between the user device and the remote system at higher layers. The use of VPN software is especially important when users are communicating over public wireless LANs. Public Wi-Fi hotspots, for example, do not implement any encryption over the wireless portion of the network. In this case, the VPN protects the data traffic.
In fact, some companies treat all wireless users as though they are operating from a public network, even though users are inside the company’s building. In this case, the wireless LAN access points connect to a distribution system that falls outside the firewall. This approach, however, might require an impractical number of VPN connections, which can be costly to deploy and support. For internal communications, fully securing wireless users is possible through the use of mechanisms, such as WPA, that encrypt data only between the wireless client and access point.
Authentication
Authentication is a process that identifies a particular person or network component based on credentials, as shown in Figure 5-4. Authentication makes sure that a particular user or component is authorized to communicate with another user or device. This process is analogous to someone showing his driver’s license when entering a secure facility. The guard ensures that the person’s name is on the access list and verifies that the photo on the license matches the person. If everything checks out okay, the guard opens the door so that the person can enter the facility. A network implements authentication in a very similar manner, except identification is given through the use of a password, digital certificate, or some other element that verifies identity. In addition, an authentication server provides the means for authorizing access to the network.
Figure 5-4
Process of Authentication
Network systems go a step further and implement mutual authentication. In this case, an access point verifies that a wireless client device wanting access is authorized, and the client device ensures that the access point is legitimate. If this authentication were not done, a hacker could power up a fake access point near the user and issue a special 802.11 packet that disconnects the user’s client device from the legitimate access point. The user’s client device then reconnects to the hacker’s fake access point. It’s possible that the hacker can configure this access point to funnel the user’s data traffic (unknown to the user) to the hacker’s computer, giving the hacker access to possibly sensitive information, such as passwords. The implementation of mutual authentication, though, can prevent this breach from happening.
The following are several authentication techniques that wireless LANs use:
Open system authentication
Shared key authentication
IEEE 802.1X
Cisco LEAP
The next few sections cover each of these authentication techniques and uncover which ones might make sense for protecting a VoWLAN system.
Open System Authentication
Open system authentication is the default mode that 802.11 uses for authenticating wireless clients to an access point, as shown in Figure 5-5. In this mode, a wireless client sends an authentication frame to the access point, and the access point returns an authentication response.
Any wireless client with the correct SSID can authenticate. This is easily done by the user selecting the applicable wireless network through the Microsoft Windows Wireless Network Connection feature if the SSID is broadcast. Or it can be found through sniffing 802.11 association frames from other users if the SSID is not broadcast. This form of authentication provides an open system, not really a form of authentication. It is mainly part of the standard as a baseline operational mode.
Figure 5-5
Open System Authentication
With open system authentication, no credentials except the SSID are passed to the access point; however, some vendors might implement provisions that must be met to authenticate stations when using 802.11 open system authentication. For example, most access points do not allow wireless clients configured for open system authentication to connect with the access point unless a valid WEP key is provided. This form of authentication is primarily used when the wireless LAN is to implement WEP encryption. For smaller networks, MAC address filtering can be fairly effective at allowing only authorized users (ones having acceptable MAC addresses) to access the network. MAC address filtering on larger networks can be difficult to manage, however, due to difficulties in adding new users.
Shared Key Authentication
The 802.11 shared key authentication goes a step further than open system authentication by using the common WEP key to authenticate wireless clients. It is a four-way handshaking process, as shown in Figure 5-6:
The wireless client sends an authentication request.
The access point responds with an authentication frame containing challenge text, which is a string of unencrypted text.
The wireless client encrypts the challenge text with the WEP key and sends the result to the access point.
The access point decrypts the challenge text with the common WEP key. If the challenge text is the same as the access point initially sent, the access point assumes that the wireless client has the correct WEP key and that the wireless client is a legitimate user.
Unfortunately, shared key authentication is easy to crack. In fact, a hacker can use freely available tools to readily find even the WEP key by detecting both the unencrypted challenge text and the WEP-encrypted challenge text. As a result, not using shared key authentication is strongly advised.
Figure 5-6
Shared Key Authentication
IEEE 802.1X
The use of IEEE 802.1X offers an effective framework for authenticating and controlling user traffic to a protected wired or wireless network, as well as dynamically varying encryption keys. 802.1X ties a protocol called EAP (Extensible Authentication Protocol) to both the wired and wireless LAN media and supports multiple authentication methods, such as token cards, Kerberos, one-time passwords, certificates, and public key authentication. For details on EAP specifically, refer to Internet Engineering Task Force (IETF) RFC 2284.
Initial 802.1X communication begins with an unauthenticated supplicant (that is, client device) attempting to connect with an authenticator (that is, 802.11 access point). The access point responds by enabling a port for passing only EAP packets from the client to an authentication server located on the wired side of the access point. The access point blocks all other traffic, such as Hypertext Transfer Protocol (HTTP), Dynamic Host Configuration Protocol (DHCP), and Post Office Protocol 3 (POP3) packets, until the access point can verify the client’s identity using an authentication server, such as Remote Authentication Dial-In User Service (RADIUS). After authentication, the access point opens the client’s port for other types of traffic.
To get a better idea of how 802.1X operates, the following are specific interactions that take place among the various 802.1X elements:
The client sends an EAP-start message, which begins a series of message exchanges to authenticate the client. Think of this process as a group of visitors approaching the front gate of a theme park and the group’s leader (the client) asking the gatekeeper (the access point) whether they can enter.
The access point replies with an EAP-request identity message. In the case of the theme park, the gatekeeper asks the leader for his name and driver’s license.
The client sends an EAP-response packet containing the identity to the authentication server. The leader in our example provides his name and driver’s license, and the gatekeeper forwards this information to the group tour manager (the authentication server), who determines whether the group has rights to enter the park.
The authentication server uses a specific authentication algorithm to verify the client’s identity. This could be through the use of digital certificates or another EAP authenti-cation type. In our example, this process simply involves verifying the validity of the leader’s driver’s license and ensuring that the picture on the license matches the leader. For this example, assume the leader is authorized.
The authentication server sends either an accept or reject message to the access point. The group tour manager at the theme park tells the gatekeeper to let the group enter.
The access point sends an EAP-success packet (or EAP-reject packet) to the client. The gatekeeper informs the leader that the group can enter the park. Of course, the gatekeeper would not let the group in if the group tour manager had rejected the group’s admittance.
If the authentication server accepts client, the access point transitions the client’s port to an authorized state and forwards additional traffic. This process is similar to the gatekeeper automatically opening the gate to let in only people belonging to the group cleared for entry.
The basic 802.1X protocol provides effective authentication. Most major wireless LAN vendors, however, offer proprietary versions of dynamic key management using 802.1X as a delivery mechanism. If configured to implement dynamic key exchange, the 802.1X authentication server can return session keys to the access point along with the accept message. The access point uses the session keys to build, sign, and encrypt an EAP key message that is sent to the client immediately after the success message is sent. The client can then use the contents of the key message to define applicable encryption keys. In typical 802.1X implementations, the client can automatically change encryption keys as often as necessary to minimize the possibility of eavesdroppers having enough time to crack the key in current use.
It is important to note that 802.1X does not provide the actual authentication mechanisms. When using 802.1X, you need to choose an EAP type, such as Transport Layer Security (EAP-TLS) or Tunneled Transport Layer Security (EAP-TTLS), that defines how the authentication takes place.
The important point to know at this point is that the software supporting the specific EAP type resides on the authentication server and within the operating system or application software on the client devices. The access point acts as a “pass through” for 802.1X messages, which means that you can specify any EAP type without needing to upgrade an 802.1X-compliant access point. As a result, you can update the EAP authentication type as newer types become available and your requirements for security change.
The use of 802.1X has become the industry standard for an authentication framework for networks, and you would be wise to include it as the basis for your wireless LAN security solution. Microsoft Windows XP implements 802.1X natively, and some vendors support 802.1X in their 802.11 access points.
Note – To download the 802.1X standard, go to https://www.ieee802.org/1/pages/802.1x.html.
Cisco LEAP
Cisco’s LEAP wireless authentication process helps eliminate security vulnerabilities by supporting centralized, user-based authentication and the ability to generate dynamic WEP keys. LEAP is easy to implement and contains compelling features:
Mutual authentication—In wired networks, a direct physical connection exists between the client and device; therefore, the client is relatively sure that it is communicating with the right network. This is not the case, however, in a wireless LAN. Because no physical connection exists between the two, the client must authenticate the network, and the network needs to authenticate the client—hence mutual authentication. With LEAP, mutual authentication is provided by a shared secret, which is the user’s network password.
User-based authentication—Traditional 802.11 authentication verifies only radio devices, not actual users. Because of this, an unauthorized user can very easily access the network through a preauthorized piece of equipment—for example, an employee’s laptop. LEAP eliminates this vulnerability by authenticating the user through usernames and passwords, rather than just the device.
Dynamic WEP keys—Cisco LEAP uses 802.1X to continually generate unique WEP keys for each user. Every 802.1X session timeout forces clients to reassociate to the network, which is when the new WEP keys are generated. The reassociations are not noticeable by users and are very important to keep all sensitive data constantly encrypted.
The following steps take place with LEAP:
The client device associates with the access point. This is done via the regular 802.11 connection process, often referred to as the association process.
The access point blocks client device access to the network, and a LEAP-compliant RADIUS server, such as the Cisco Access Control Server (ACS), issues an authentication challenge to the client device.
The user provides login credentials, which is a user-supplied password. LEAP performs a one-way hash of the password before sending it to the RADIUS server.
The RADIUS server authenticates the user by verifying the user’s credentials located in the database.
The user authenticates the RADIUS server similarly to how the RADIUS server authenticated the user. After this task is completed, the RADIUS server sends an EAP-success message to the client device.
The client device and RADIUS server derive a unicast WEP key.
The RADIUS server delivers the unicast WEP key to the access point.
The access point delivers a broadcast WEP key encrypted with the unicast WEP key to the client device.
The client device and access point activate WEP and use the broadcast and unicast WEP keys.
When deploying the ACS, be sure to minimize the delays between the access points and the ACS. Doing so is necessary because the LEAP authentication process must take place every time the client device roams to another access point. Cisco IOS Release 12.2(11)JA introduced support for the Cisco access point to authenticate LEAP users without having to access an external ACS. This functionality supports up to 50 usernames for small deployments. In addition, the Cisco ACS can either store the username and password database locally, or it can access that information from an external Microsoft Windows NT directory. If users are fairly mobile and roam between access points frequently, not using an external database is best, because associated delays may cause poor voice quality.
Also, segment the voice and data traffic by placing the voice traffic on one VLAN and data traffic on the other VLAN. With the voice traffic pointed to only a particular VLAN, a hacker who steals a wireless IP phone cannot use the phone’s password to access the data network—assuming, of course, that the user has a different password on the phone compared to the one used on the data network.
Note – When using LEAP, be certain to use strong passwords, which have between 10 and 12 characters and can include a mix of uppercase, lowercase, and special characters. Also, use passwords on wireless IP phones that are different than other passwords. Doing so helps make the overall system more secure, because wireless IP phones, containing the user’s phone password, may be compromised if the phone is stolen or lost.
Cisco freely licenses its wireless LAN security suite, which includes LEAP, to chipset and wireless client manufacturers. Because not all 802.11 products support LEAP, though, you may run into interoperability issues in a mixed-vendor environment. If you are sure that all products on the network will support LEAP—for example, a Cisco-only network—LEAP is a viable security measure. Keep in mind, however, that LEAP does have some issues. The asleap tool threatens the security of LEAP by exploiting the challenge/response technique when authenticating a client connecting to the wireless network. The tool enables a hacker to run a dictionary attack against the system and uncover the network passwords. For more details, refer to https://asleap.sourceforge.net/.
Cisco 7920 IP Phone Security – The Cisco 7920 wireless IP phone has the following security features:
40- and 128-bit WEP
TKIP
WPA
IEEE 802.1X
EAP-LEAP
EAP-FAST
Optional password prompt at power up
Automatic key lock
When WEP or WPA is implemented, the signaling (Skinny Client Control Protocol [SCCP]) and media (Real-time Transport Protocol [RTP]) data is encrypted between the Cisco 7920 phone and the access point.
Note – Cisco recommends that you design the security of the wireless LAN based on the Cisco SAFE architecture. Refer to the following document for more information: https://www.cisco.com/en/US/netsol/ns340/ns394/ns171/ns128/networking_solutions_package.html.
Tips for Enhancing Security
The use of effective encryption and authentication mechanisms goes a long way toward securing a wireless LAN. But good overall security results from a combination of many elements. The more roadblocks you put in the way, the tougher it is for a hacker to harm your company through the network. Consider implementing the tips given throughout this section when deploying a VoWLAN system.
SSID Broadcasting
Some access points, such as the Cisco 1200, allow administrators to disable the access point from broadcasting the SSID. The 802.11 standard specifies that the access point include the SSID in the body section of beacon frames, which the access point broadcasts regularly. When SSID broadcasting is disabled, the access point does not include the SSID in beacon frames. As a result, Windows cannot obtain the SSID and display it to the user as a possible wireless network to associate with. This feature is beneficial to corporate networks to keep “casual snoopers” and war drivers from finding the network. For example, a user with a Windows-based laptop would not see that the applicable company has a wireless network.
In addition, with SSID broadcasting disabled, each user must manually configure his or her wireless client device with the correct SSID that matches the one configured in the access point to associate with the access point. This is why disabling SSID broadcasting with public wireless hotspots is not desirable. Public hotspots need users to easily find the right network to connect to. In fact, the SSID is a form of advertising for hotspots. For example, T-Mobile uses the SSID “T-Mobile” to inform users (through Windows) that its network is available and to distinguish its service from competitors. The disabling of SSID broadcasting in public networks would keep users from finding out that wireless LAN coverage for a particular service provider is available.
For corporate networks, the disabling of SSID broadcasting is not a strong security mech-anism. A hacker, for example, can easily monitor 802.11 frames on the wireless LAN and wait until an association frame is sent by a wireless client when a user connects to an access point or when the user roams from one access point to another. The hacker can find the SSID in the association request frames and some probe requests even when SSID broadcasting is disabled on the access point. In fact, wireless LAN analyzers, such as AirMagnet, Cain & Able, and Ethereal, look inside association frames and automatically display SSIDs when they are found.
When deploying VoWLAN systems in corporate environments, disabling SSID broad-casting is a good idea, primarily to keep causal snoopers from finding the network. Doing so provides some added protection. However, keep in mind that it is not a full-proof security technique.
Systems Management
The following are several security tips related to the management of the VoWLAN system:
Choose strong SNMP community strings—The community string is sort of a Simple Network Management Protocol (SNMP) security password that allows administrators (and hackers) to configure network components, such as access points. Most SNMP agents have default community strings of “public” and “private,” which a hacker will try first when trying to break into a network. As a result, be certain to change the community strings of all network components to “strong” community strings. Use strings that would not be easy to guess, are at least six characters in length, and use a mix of alphanumeric and uppercase/lowercase characters. Also, be sure to change the community strings often.
If practical, configure all SNMP ports as Read Only—Some hackers attempt to change the configuration of access points by turning off security, which then allows the hacker to associate with the access point without needing to know encryption keys or passwords. The hacker then has access to the rest of the corporate network and can possibly harm servers and users. With the SNMP ports set to Read Only, a hacker may be able to read the configuration information, but she will not be able to change it. Thus, the security of the access point will stand unchanged, keeping the hacker from getting onto the corporate network.
Use secure management protocols—For example, Secure Shell Protocol 2 (SSH2) offers a very secure way of configuring network components, such as access points. SSH provides an encrypted tunnel between the administrator’s computer and the network component.
Keep software and hardware up to date—Track updates of software and firmware for phones, access points, and other network components to be sure that you have the latest, most secure versions. When security holes are found, vendors often write patches to fix the problems. The vendor then includes these patches in future updates. Cisco, for example, noticed that its 7920 wireless IP phone had SNMP service with fixed community strings, which could allow remote users (such as hackers) to read, write, and erase the phone’s configuration. Cisco then made free software available to address these vulnerabilities for affected customers. Therefore, keep an eye on the updates!
Access Point Installation
When installing the network, consider concealing the access points. A good location to install the access points is above the ceiling tiles, referred to as the plenum. In most cases, even the antennas can be mounted above the ceiling tiles without significantly disturbing radio signal propagation. The idea is to ensure that an unauthorized person cannot locate the access point and cause damage or connect a terminal cable from a laptop and disable security settings. Of course, when hiding access points, you must keep an accurate record of the locations to find them later for support purposes.
Something to keep in mind, however, is that a wireless LAN based on wireless switches can automatically detect an access point being configured by an unauthorized person. The wireless switch is smart enough to keep track of the configuration of the access points and alert an administrator when the configuration of the access point does not match security policies. In addition, the switch can block access to the network through the affected access point until an administrator has time to investigate and correct the problem.
Rogue Access Points
One of the most critical security concerns of IT managers today is the possibility that rogue wireless access points may be present on the corporate network. A rogue access point is one that the company does not authorize for operation. The trouble is that a rogue access point often does not conform to wireless LAN security policies. This enables an open, insecure interface to the corporate network from outside the physically controlled facility, as shown in Figure 5-7.
Within a properly secured wireless LAN, rogue access points are more damaging than rogue users. Unauthorized users trying to access a wireless LAN likely will not be successful at reaching valuable corporate resources if effective authentication mechanisms are in place. Major issues arise, however, when an employee or hacker plugs in a rogue access point. The rogue allows just about anyone with an 802.11-equipped device on the corporate network, which puts them very close to mission-critical resources.
Figure 5-7
Open Access via a Rogue Access Point
Employees have relatively free access to a company’s facility, which makes it possible for them to inadvertently (or mischievously) install a rogue access point. An employee, for example, may purchase an access point at an office supply store and install it without coordinating with the IT organization to support wireless printing or access to the network from a conference room. Also, developers working on wireless applications may connect an access point to the corporate network for testing purposes.
In most cases, employees installing these types of access points do not understand the security issues involved. These scenarios often lead to access points that do not conform to adequate security practices. As a result, the corporate network is left wide open for a casual snooper or criminal hacker to attack the network by stealing corporate information or Internet service.
To avoid this situation, implement security policies that mandate conformance with effective security controls and coordination with the IT organization before installing access points. This method is effective only if you clearly inform employees of the policies.
A hacker can install a rogue access point to provide an open, nonsecure interface to a corporate network. To do so, he must directly connect the access point to an active network port within the facility, which requires him to pass through physical security. However, this task is easy to do in most companies. It is unlikely that a hacker would go to this trouble if the company has worthwhile resources. But many others would be willing to give this technique a try just to enable access to free wireless Internet service through the corporate system.
Really, no effective way exists to eliminate the possibility of a rogue access point from cropping up on your network. As a result, you must implement processes and mechanisms to constantly monitor for rogue access points as part of your ongoing security assessments.
One method of detecting rogues involves the use of wireless sniffing tools that capture information on access points that are within range of where you are using the tool. This method requires you to walk through the facilities to capture the data. With this method, you can scan the entire facility, but doing so can be very time-consuming for larger companies with many buildings or that span a large geographical area. Neverless, consider performing these types of scans each week.
Capturing data in this fashion is valid only at the time of capture. Someone could activate a rogue seconds after you turn off the sniffing device, and you will not have any idea that it is present. Still, this method is often the most common and least expensive way of finding rogues. It just takes a lot of time and effort.
When using wireless sniffing tools, look for access points that have authorized MAC addresses, vendor names, or security configurations. Create a list of MAC addresses of the authorized access points on the LAN and check whether each one you find is on the list. An access point with a vendor name different from your authorized access points is the first alert you to a possible rogue. Improper security settings (that is, WEP disabled) could indicate a rogue, but it may also be authorized but wrongly configured.
If you find an access point that looks suspicious, consider it to be a rogue, and then try locating it through homing techniques. To do so, walk in directions that cause the signal strength of the access point’s beacons to increase. Eventually, you can narrow down the location to a particular room, which often requires you to do some looking. In some cases, the “rogue” is simply an active access point that is not connected to the corporate network—which doesn’t cause any security harm. When you find one that actually interfaces to the corporate network, immediately shut it off.
The ideal method of detecting rogue access points is to use a central console attached to the wired side of the network for monitoring. Some of the more advanced wireless management tools have this feature. This feature eliminates the need to walk through the facilities.
Low-Cost Centralized Method for Finding Rogues – A fairly crude but inexpensive method for finding potential rogue access points from the wired side of the network is to use a free TCP port scanner, such as SuperScan, that identifies enabled TCP ports from various devices connected to the network. You run the software from a laptop or desktop PC connected to the corporate network. The tool uncovers all Port 80 (HTTP) interfaces on the network, which includes all web servers, some printers, and nearly all access points. Even if an access point’s Port 80 interface is disabled or protected by a username and password, the access point generally responds to the port scanner’s ping with the vendor name and its corresponding IP address.
You can download a free copy of SuperScan at the following link: https://www.foundstone.com/resources/proddesc/superscan.htm.
You can scroll through the list of found Port 80 interfaces and discover potential rogues if their vendor names are different from those authorized in your wireless LAN. With the IP address of a suspected access point, attempt to open its administration screen. You will quickly notice whether an access point is legitimate. The difficult chore is determining the physical location of the rogue; router table entries may help.
In addition, consider using APTools, which is available at https://winfingerprint.sourceforge.net/aptools.php.
Signal Propagation
Another method to increase the security of a wireless LAN is to control the transmission and reception of the radio signals. The idea is to significantly reduce or eliminate signal coverage in areas outside the physically controlled area of the facility. These areas are where hackers may be lurking and possibly attempting to access your wireless LAN.
The ability to control radio signal propagation depends a great deal on the construction of the facility. For example, a building with exterior walls made of steel-reinforced concrete introduces a much greater amount of attenuation between the wireless LAN inside the building and potential hackers outside the building. A facility located inside a large physically controlled area also provides some protection, because radio signals need to propagate over greater distances before getting outside the controlled area.
To reduce signal transmission and reception of access points, set the access points near the perimeter of the building to lower transmit power and use lower-gain antennas. Directional antennas aimed inward focus more of the transmission and reception of radio signals inside rather than outside the building. This focus makes the radio cell of the access point smaller. To fully take advantage of this approach, however, you also need to decrease the transmit power of the client devices. Otherwise, the client device will still transmit radio signals outside the physically controlled area.
Another method to improve security is to paint the interior or exterior walls of the building with a metallic-based paint. For example, Force Field Wireless makes a special latex paint that significantly attenuates RF signals. You can paint the walls and ceiling of a room with this paint and block wireless LAN signals from escaping outside and keep RF interference and jamming signals from getting in. Also available is metallic-based film for putting on windows. The use of these protection measures, though, leaves your cellular phones useless inside the building because the cell phone system signals will no longer penetrate the walls and windows.
By carefully controlling signal propagation, you can decrease the chance of DoS attacks; however, the only completely effective way to counter DoS attacks is to isolate your computer in a room with heavy security and unplug it from all networks, including the Internet. Of course, this means not using a wireless network. The U.S. government uses this method to protect its most sensitive data, but this solution is not practical for any enterprise or home application where benefits exist for deploying wireless networks.
The most fundamental protection is developing and maintaining strong security practices. Actions such as implementing and updating firewalls, maintaining updated virus protection, installing up-to-date security patches, ensuring strong passwords, and turning off network devices when they are not needed should be routine practices for all companies.
After installing and configuring the wireless LAN, be sure to run tests to determine how far the signal actually leaks outside the building and then adjust transmitter power until the leakage is eliminated or reduced to the point that it would not be easy for a hacker to access the system.
Chapter Summary
When deploying a VoWLAN system, implementing effective security mechanisms is very important. The most important elements are encryption and authentication. Some encryption methods, such as WEP, are not very secure. Others, such as WPA and 802.11i, ensure that a hacker cannot compromise the data and voice being sent over the wireless network. Authentication plays a crucial role on a wireless network as well by significantly minimizing the possibility that a hacker can gain access to the network.
In addition to encryption and authentication, you should strive to harden the wireless network through effective configuration of the access points and control of the radio signals. The disabling of SSID broadcasting, for example, can keep your network more secure by reducing its exposure to potential hackers. In addition, adjusting the transmit power on access points and using directional antennas can help keep signals inside the building and out of the hands of unauthorized people.
Chapter Review Questions
What are the primary security implications of a wireless LAN?
When WEP is implemented, all users of the wireless LAN must use the same encryption key. True or false?
What encryption type does TKIP use?
What version of WPA implements AES encryption?
What is the primary difference between WPA and 802.11i?
What part of the network do WEP, WPA, and AES protect?
Which two forms of authentication are part of the 802.11 standard and are not effective for protecting wireless LANs?
The disabling of SSID broadcasting prevents a hacker from obtaining the SSID of the wireless LAN. True or false?
Why should you use strong SNMP community strings?
What are methods that you can use to keep the radio signals inside the building?
Copyright © 2007 Pearson Education. All rights reserved.
