Wireless Security

Wireless Security Survey

By Adrian Lane

'Rich forwarded me the RSA Wireless Security Survey for 2008 that was just released this morning. The cities that they scanned were Paris, London & New York.

Public hotspots — designed to allow anyone with a wireless device to access the Internet on a pay-as-you-go or pre-paid basis — continue to grow in prevalence across all three cities, and in each case the growth of available hotspots accelerated significantly in 2008 compared with development in the preceding year. Paris saw the largest jump, with numbers increasing by over 300% and comfortably outstripping the comparative growth in New York City (44%) and London (34%). However, New York City remains the leader in regards to its concentration of hotspots. At 15%, New York City is well clear of London where just 5% of wireless access points were found to be hotspots. In Paris, hotspots represented 6% of all the access points we located.

It is interesting to compare the year over year changes, and to see what kind of encryption is being employed. It's certainly worth a review, and a little vendor hype is to be expected, but there are two things that worry me about survey's like this. First, the public perception that if the connection is encrypted that all is safe. Unless there is a shred secret or some other type of protection, most of these systems are vulnerable to man-in-the-middle attacks. Second is that the rogue hotspots are difficult to detect, which is the de-facto method for wireless man-in-the-middle.

If your an IT manager, you have very little way to assess risk from this report, so just assume wireless hotspots are compromised and that you need to deploy a system to thwart these attacks on externally accessible corporate WiFi. And as an end users, if you think you are safe just because you have established an encrypted connection at Starbucks, think again. The guy in the tiny corner apartment overlooking the store makes his living by sniffing personal information and passwords.

–Adrian Lane

Your WPA-PSK Wireless Network Is At Risk… If You Are An Idiot

By Rich

There was some great hype in the wireless security world this weekend thanks to an article that made it on to Slashdot, and some FUD pumping so-called security consultants. Elcomsoft issued a press release that they can now crack WPA keys WAY faster using the GPUs (Graphics Processing Units) on the latest video cards.

It's kind of cool, and for wireless pen testing the tool sounds useful, but some of the quotes in the article from the security firm GSS (who I never heard of) are the typical garbage:

"This breakthrough in brute force decryption of Wi-Fi signals by Elcomsoft confirms our observations that firms can no longer rely on standards-based security to protect their data," said GSS managing director David Hobson. "As a result, we now advise clients using Wi-Fi in their offices to move on up to a VPN encryption system as well." ... Hobson added that the development could spur a step back from wireless to wired network connection in sensitive installation, such as financial services organisations, particularly concerned about data privacy.

Idiots.

These guys are forgetting two things- first, this method doesn't work AT ALL against an enterprise installation (RADIUS) of WPA. George Ou has more on this.

Second, as the original article added as an update, this attack only speeds up brute forcing. Use a long, strong passphrase for your WPA key and you're fine. Rob Graham also has more on this.

WPA-PSK still sucks to manage, and keys go stale, but use a good one and you're fine. GCC should go back to playing Team Fortress or something with those video cards, because they were either misquoted, or clueless.

–Rich

iPhone Security Tip: Never Memorize Wireless Networks

By Rich

Update: See Update To The iPhone Security Tip. Encrypted networks are safe to remember.

The other day I was wandering around San Francisco on a work trip, and I freaked out when I noticed the WiFi indicator on my iPhone was showing an active connection to some random network. I never have my phone set to connect to unknown networks, so I quickly jumped into the settings to see what the heck was going on.

Turns out I was connected to "tsunami" which is a common default name on Cisco wireless gear. Like the Cisco gear in our community center, which just a week or so before I was playing with. And that got me thinking.

Many of you probably connect to wireless networks with common names- like Linksys, 2WIRExx, tsunami, or whatever. In other words, either default networks, or names (like those used at conferences and airports) that are in common use or easy to find. But when you remember those on your iPhone (or computer for that sake), it only remembers the network ID (SSID), not that actual network!

Your iPhone doesn't know the difference between "tsunami" in your community center, "tsunami" in an office building, and "tsunami" running on some bad guy's laptop to see what naive fools will connect to it. When you trust a network you're just trusting a name anyone can use, not something really unique to that network. Your iPhone will then connect to any network using that name.

Why is that bad? Go read this article I wrote at Dark Reading. An attacker can set up his or her laptop to broadcast that name, then perform a man in the middle attack to anyone who connects. They can sniff and modify any traffic going to your iPhone. Why is this more serious on an iPhone than your laptop? Because you walk around with your phone all the time, often checking things like email in the background.

Another problem with the iPhone is that its VPN doesn't automatically reconnect if the connection drops. Thus, even if you connect via a secure VPN, you might find your connection got dropped and your phone happily continues, sending all your traffic unencrypted.

Here are my best practices for iPhone wireless security:

1. Turn on "Ask to join networks".
2. If you have a home wireless network, use an obscure name with some random numbers in it. This reduces the odds you'll ever hit another one with the same name unless someone specifically targets you.
3. On your home network, don't broadcast the SSID (sure, easy to figure out, but we're just trying to reduce our risks).
4. If you need to connect to a public wireless network, use a VPN to protect your traffic. In the VPN settings, after you configure your connection, turn on the "Send all traffic" option.
5. When you're done with the network, click on the "Forget this network" button in your WiFi settings.

On my phone I only have it set to connect at home (a weird name), and I use AT&T EDGE when I'm out of my house. I have a VPN server set up at home for those rare occasions I connect from a conference network.

The good news is that your iPhone doesn't send out "probes" for known networks. This would be an easy way for a bad guy to know even those obscure SSIDs you use at home. Good move on Apple's part- now I just want them to make the VPN connections persistent.

–Rich