Living in Wireless Denial

CIOs must understand Wi-Fi's risks in order to mitigate them

In May, news came from Australia that caught the world's Wi-Fi users completely off guard: A trio of PhD students at the Queensland University of Technology had discovered an indefensible denial-of-service flaw in the 802.11b network protocol. The group, led by Associate Professor Mark Looi, had accidentally uncovered the vulnerability back in November 2003 while investigating a previously known wireless flaw. Looi immediately contacted the Australian Computer Emergency Response Team (AusCERT), and that group, in turn, contacted other computer security organizations around the globe, including US-CERT. After eight weeks of verifying that the flaw was indeed fatal, Looi notified the major wireless LAN vendors in January 2004. Working under a nondisclosure agreement, Looi, his team, the CERTs and WLAN vendors tried to find a fix.

They couldn't.

The vulnerability lay in the 802.11 wireless network protocol, which uses a Clear Channel Assessment (CCA) algorithm to determine whether radio channels are clear so that network devices can use them to transmit data. The group discovered that the CCA algorithm, which works in conjunction with Direct Sequence Spread Spectrum (DSSS) transmission, was vulnerable to an attack by specially crafted radio signals that would trick the algorithm into thinking a channel was busy. As a result, no device in range of the jamming signal would be able to transmit data. All an attacker needed was to be within a couple of hundred feet of his target and to have enough know-how to work his PDA and $50 wireless card. "Prior to this [discovery], all denial-of-service wireless attacks have relied on specialist equipment," Looi says. "This denial-of-service attack needs nothing more than easily available consumer-grade hardware."

Unlike other Wi-Fi vulnerabilities, this one was not a product of bad security or human error. Any 802.11 DSSS device was vulnerable (including the newer 802.11g when running at lower speeds). And six months after the flaw's discovery, AusCERT and US-CERT issued a worldwide alert on May 13. But the response from the Wi-Fi community to Looi's thunder from down under was more akin to heat lightning - a flash but no boom.

It appears that too many people have too much riding on the Wi-Fi wave for anything to slow it down, even an unfixable flaw. But what, in fact, is essential to good Wi-Fi security? If you're thinking about a rollout or even if you already have Wi-Fi up and running, here's what you need to worry about and what you can do to ease your anxiety.

Wireless Worries

Rogue users connecting their unauthorized Wi-Fi access points to your network. Attackers launching a coordinated denial-of-service attack from your company's parking lot. Intruders sneaking onto the network through a back door left open by a user. Those are just some of the things that UPS's director of global network services John Killeen worries about.

UPS has been using wireless since well before the 802.11b standard arrived and - with some 90,000 wireless devices in service - has woven the technology into its operations. "With the 802.11b rollout, IT was directly involved in implementing the solution," says Killeen. "Having IT involved has made security easier, but an organization the size of UPS is no different from any other organization."

Killeen was very much aware of the recent Wi-Fi news from Australia. "It certainly got our attention," he says. "We worked with our integrator, Symbol Technologies, in evaluating that the vulnerability was real, and whether or not it could impact us." It was real, and an attack could hurt the mobile infrastructure at one of UPS's facilities. But Killeen also knows that a lone intruder exploiting the flaw could affect only one access point, and his infrastructure has multichannel and redundancy capabilities to mitigate the attack. UPS is currently in the middle of a huge Wi-Fi deployment - with some 15,000 access points in 1700 facilities - and security is atop Killeen's mind.

Closing the Doors

Images such as the attacker in the parking lot or the intruder in a building just across the street have become mainstays in Wi-Fi security lore. But for those attackers to break in, they need an entry point. And that's where your users come in. Gene Fredricksen, CISO of Raymond James, a financial services company, is in the throes of implementing Wi-Fi at the corporate headquarters, with plans to roll it out to the rest of the field offices. His security concerns are mostly user-driven: unauthorized access points, misconfigured devices and impatient users. Fredricksen points out that as soon as you can buy a Wi-Fi device at a consumer electronic outlet - such as a Harvey Norman or Harris Technology - the end user can't understand why the technology department isn't deploying it. "We're currently trying to seek out and disable rogue access points," says. "And that's anything that's not approved by the company - those access points are a concern."

Not surprisingly, users can create other worries. How about the mobile user who brings his wireless-enabled laptop back into the office after using his Wi-Fi connection at his home? If his home Wi-Fi setup doesn't have the appropriate security measures - that is, he isn't using a personal firewall or VPN encryption - then chances are if anyone is scanning your office, probing for a vulnerable connection, his laptop can provide the bridge to the company's network.

"Everyone's been focusing on the access point as the intrusion point. But no one's looking at the client," says Ryan Crum, a wireless security specialist at PricewaterhouseCoopers. "It's just as big of an issue because everybody's mobile these days." Crum mentions a tactic called wireless phishing, where a hacker sets up a fake T-Mobile access point while sitting in a retail establishment that offers a T-Mobile hot spot. The fake log-in screen looks similar to the Wi-Fi users, so they naturally log in their corporate ID and password. "How do you know that it's not authentic?" asks Crum.

Together, those are enough nightmares to keep CIOs who are venturing down the Wi-Fi path awake at night. Here's how to get some rest.