1 Wireless LAN Security Kim W. Tracy NEIU, University Computing

2 Outline l Threats to LANs & Wireless LANs l Wireless LAN Security Techniques l Summary

3 Fundamental Premise l Security cannot be considered in isolation and to be effective must consider the entire system l That is, network and LAN security must be: l Consistent with other security mechanisms l E.g. application, data, hardware, and physical l Supportive of other security mechanisms

4 Threats

5 LAN Threats Network Traffic Protecting Integrity Protecting Secrecy Protecting Availability

6 Specific LAN Threats l Availability l Worms/Virus DoS l Errant applications creating lots of traffic/malformed traffic l Authentication l Spying devices on LAN l For example, a contractor connecting to LAN l Secrecy l Sniffers being connected to the LAN to collect passwords, etc.

7 Authentication

8 Current State of LAN Authentication l Usually none! l If in the building can plug in to the LAN l Can cause severe problems: l Using LAN for illegal purposes (company/person may be liable) l Can more easily compromise servers l For example, send spam from your mail servers l Wireless LANs are bringing issue out

9 Authentication services l 802.1X – IEEE standard for LAN authentication l Can use PKI certificate-based authentication l Kerberos (closed environment) l Single login (once per session) l To multiple servers/domains l ‘Ticket’ for each server l X.509 (open environment) l Based on public key infrastructure l Used in SSL, IPSEC, S/MIME, SET… l One-way, two-way or three-way authentication

10 Kerberos

11 X.509 Authentication [Ta, Ra, B, EkpubB(Kab) ] sgnA [Tb, Rb, A, Ra, EkpubA(Kab) ] sgnB [Rb] sgnA One-way authentication Two-way authentication Three-way authentication [Ta, Ra, B, EkpubB(Kab) ] sgnA [Tb, Rb, A, Ra, EkpubA(Kab) ] sgnB AB

12 IEEE 802.1X Terminology Controlled port Uncontrolled port Supplicant Authentication Server Authenticator 802.1X created to control access to any 802 LAN used as a transport for Extensible Authentication Protocol (EAP, RFC 2284)

X Model Associate EAP Identity Request EAP-Success STA AP Authentication Server EAP Auth Response EAP Auth Request EAP Identity Response Authentication traffic Normal Data Port Status: EAP-Success

14 Wireless LAN Security

15 Introduction l standard specifies the operating parameters of wireless local area networks (WLAN) l History: , b, a, g, i l Minimal security in early versions l Original architecture not well suited for modern security needs l i attempts to address security issues with WLANs

b l Wired Equivalent Privacy (WEP) l Confidentiality l Encryption l 40-bit keys (increased to 104-bit by WEP2) l Based on RC4 algorithm l Access Control l Shared key authentication + Encryption l Data Integrity l Integrity checksum computed for all messages

b l Vulnerabilities in WEP l Poorly implemented encryption l Key reuse, small keys, no keyed MIC l Weak authentication l No key management l No interception detection

b l Successful attacks on b l Key recovery - AirSnort l Man-in-the-middle l Denial of service l Authentication forging l Known plaintext l Known ciphertext

i l Security Specifications l Improved Encryption l CCMP (AES), TKIP, WRAP l 2-way authentication l Key management l Ad-hoc network support l Improved security architecture

i Authentication Source: Cam-Winget, Moore, Stanley and Walker

Encryption Source: Cam-Winget, Moore, Stanley and Walker

i – Potential Weaknesses l Hardware requirements l Hardware upgrade needed for AES support l Strength of TKIP and Wrap questionable in the long term l Authentication server needed for 2-way authentication l Complexity l The more complex a system is, the more likely it may contain an undetected backdoor l Patchwork nature of “fixing” b

23 No Control over WLAN? l Often you want to connect to a wireless LAN over which you have no control l Options: l If you can, connect securely (WPA2, i, etc.) l If unsecured, connect to your secure systems securely: l VPN – Virtual Private Network l SSL connections to secure systems l Be careful not to expose passwords l Watch for direct attacks on untrusted networks

24 WLAN Security - Going Forward l i appears to be a significant improvement over b from a security standpoint l Vendors are nervous about implementing i protocols due to how quickly WEP was compromised after its release l Only time will tell how effective i actually will be l Wireless networks will not be completely secure until the standards that specify them are designed from the beginning with security in mind

25 Summary l Wireless LAN Security is not independent of the greater network security and system security l Threats to the Wireless LAN are largely in terms of being available and in providing a means to attack systems on the network l That is, not many folks attack routers (yet)

26 References l ftp://ftp.prenhall.com/pub/esm/web_marketing /ptr/pfleeger/ch07.pdf - Charles & Shari Pfleeger’s chapter on network security ftp://ftp.prenhall.com/pub/esm/web_marketing /ptr/pfleeger/ch07.pdf l - To request the Computer Security Institute/FBI yearly survey results (widely referenced)