Solving the Security Risks of WLAN

1
Solving the Security Risks of WLAN

• Tuukka Karvonen
• 23.3.2016

2
Outline

• General Guidelines
• Radio Interface
• Access Point Configuration
• Client Configuration
• TKIP
• Honey pot Fake AP
• Links

3
General Guidelines

• Know the risks War-Driving, Insertion Attacks,
  Monitoring, SNMP services, weak WEP algorithm,
  etc.
• The default configuration of the devices usually
  lacks security
• Clients and access points should be configured
  well
• Organizations need a wireless security policy,
  which everyone should follow

4
Radio Interface

• Provide coverage only to the areas where it is
  needed
• Adjust transmitting power
• use directional antennas
• Unintentional and intentional jamming is possible
  -gt have an alternative, if its important to have
  your connection working
• Notice, it is fully legal for anybody to disturb
  your WLAN on the license-free ISM band

5
Access Point Configuration

• Turn of the broadcasting of SSID and dont use
  the default one
• Provide DHCP (Dynamic Host Configuration
  Protocol) only if needed
• Require Wired Equivalent Privacy and strengthen
  it with IEEE 802.1X and TKIP
• Original WEP algorithm is weak, so keys need to
  be changed frequently

6
Client Configuration

• Disable unnecessary services (i.e. Windows file
  sharing)
• Install Personal Firewall
• Use higher level security (IPsec, VPNs, SSL, SSH
  etc.)
• Use WEP and if possible strengthen it

7
Temporal Key Integrity Protocol (TKIP)

• Devices using WEP can be upgraded to TKIP with
  firmware patches
• Uses temporal key, which is changed every 10000
  packets with help of 802.1X
• Combines the temporal key with the client's MAC
  address before adding a initialization vector -gt
  every device has own encryption key
• Inserts message integrity code into each packet
  to avoid forgeries

8
Honey Pot Fake AP

• Confuses war drivers
• Hides the real access point by generating
  thousands of counterfeit 802.11b access points
• Sends Beacon frames with random SSIDs and MAC
  addresses
• Advanced version would also need to create real
  traffic
• http//www.blackalchemy.to/project/fakeap/

9
Links

• Information
• http//www.iss.net/wireless/WLAN_FAQ.php
• http//www.80211-planet.com/
• Access point maps
• http//www.wifimaps.com/
• http//www.netstumbler.com/
• Tools
• http//freshmeat.net/projects/airsnort/
• http//www.netstumbler.com/
• Wireless Scanner http//www.iss.net/download/