1. Security and Wireless LANsOr
Fun and Profit With Your Neighbor’s Bandwidth
Chris Murphy
MIT Information Systems

2. The Problem Wireless LANs broadcast your network connections
Radio doesn’t care about firewalls
Data can be captured without physical access
Network resources can be hijacked

4. 802.11 Protocol Family 802.11 – 2.4Ghz, 2Mbit specification
802.11a – 5Ghz, 54Mbit specification
802.11b – 2.4Ghz, 11Mbit specification
Currently the predominant, available technology
802.11d – regulatory issues
802.11e – addresses QoS
802.11f – inter-access-point protocols
802.11g – 2.4Ghz, ~20Mbit specification
802.11h – frequency allocation
802.11i - security

5. The Solution? Access Control Data Encryption
By MAC addresses
By network names (SSID)
Data Encryption
WEP (Wired Equivalent Privacy)
Can also be used for access control
All these schemes have limits and flaws

6. MAC Address Access Control
Access Points have a list of allowed MAC addresses
Often stored in each Access Point
Limited to about 500 addresses
Some products use a server-based list, using systems like RADIUS
Easily defeated by sniffing for an allowed address

7. SSID Access Control Normally, the SSID is broadcast in beacon packets
A “closed” network does not include the SSID in beacons
NOT part of the standard
Has a fatal flaw…..

8. Normal open network

9. “Closed” network (SSID “PEAKABOO”)

10. Now a client wants to join the network…..

11. …and an access point responds.

12. Data Encryption WEP – Wired Equivalent Privacy
40 bit RC4, 128 bit optional
Most APs support up to 4 keys
How do you manage keys in a large organization?
This assumes all users are “good guys”

13. Data Encryption A group at Berkeley has published some flaws in WEP
Outlines a number of design flaws in WEP
A number of (currently theoretical) attacks are outlined in the referenced document
A response from the IEEE group chair is available at

14. LANs – Standards – 802.11 Security
Scott Fluhrer, Itsik Mantin, and Adi Shamir have identified weaknesses in the RC4 algorithm used by WEP
Attack only requires cyphertext
On the order of 100Mb – 1Gb needed
Compute time scales linearly with key size
The paper is available at
An implementation of this attack is available at

15. Spread Spectrum as Security?
Spread Spectrum technology, while touted as difficult to intercept, offers little here as NICs are preprogrammed with the spreading sequences and can talk to each other out of the box.

16. So What Are Our Options?
While flawed, the described methods can provide some protection from casual abuse
Treat wireless clients as remote clients
Place APs outside firewalls
Use VPNs to access internal network
And as always, use secure protocols

17. Future Wireless Security
802.11i should provide a standards-based path for actual user authentication, and negotiation of user and session specific encryption keys
This group is working in conjunction with the 802.1x group, relating to per-port network access control