Blog

• CWNP
• September 16, 2009
• 

Hot Off the Press: Arbitration Whitepaper

One of CWNP’s instructors and CWNEs, GT Hill, has what might be labeled a “fetish” with 802.11 arbitration.  Some people like shoes, others like gadgets, but GT likes teaching 802.11 arbitration.  He’s a Wi-Fi geek among the best of us.  ;)  If you get the chance, taking him up on the lesson would be a good use of your time.  If you don’t get the chance, the next best thing may be the 802.11 arbitration whitepaper that CWNP just published.   

• CWNP
• September 11, 2009
• 

New Attacks on WPA - Move Calmly Toward the Exits

Recently, two announcements were published that detailed successful attacks against the integrity functions of the 802.11 wireless security mechanism known as TKIP (Temporal Key Integrity Protocol). These procedures do not reveal surprises, but instead highlight the known vulnerabilities inherent with the TKIP/Michael protocol since its inception. To be clear, these attacks are not designed to recover the encryption keys or to reveal the private data contained within TKIP protected frames.  Instead, they focus on known weaknesses in the Michael integrity check algorithm, which could enable an intruder to insert customized test packets into a LAN from the wireless side in order to probe for traditional wired-side vulnerabilities. In addition, the new attacks could also be used to stage nuisance, denial-of-service attacks against WLANs and could hasten the advent of future exploits on the encryption keys.

• CWNP
• September 11, 2009
• 

Curriculum Director - WirelessTrainingSolutions.com

New Attacks on WPA - Move Calmly Toward the Exits

Rick Murphy

Now that cryptographic researchers Beck – Tews and Ohigashi – Morii have demonstrated practical attacks that allow intruders to jam their feet in the door of TKIP/Michael protected systems, it is clear that the final push towards a complete CCMP upgrade should be planned and executed by SOHO, SMB, and Enterprise users of WLANs within the near future. However, this is not so much a clarion call as it is a gentle reminder that WPA was only intended to be a band-aid for an insufficient confidentiality mechanism (WEP) and that the real solution was and still is, CCMP. If TKIP were a movie theater, then we have our first whiff of smoke. Its time to start calmly moving towards the exits.

• CWNP
• September 09, 2009
• 

Real Free WiFi

OK, I like Free WiFi.

NOT the kind that makes you pay per minute.
NOT the kind where you watch lots of adverts.
NOT the kind where all web pages go through something that puts an advert on every page.
NOT the kind where you have to put in some special code.
NOT the kind where they block ports so you can't get your e-mail, VPN, etc.
NOT the kind where they throttle the connection to a crawl.
NOT the kind where you can only be in lobby to get net access.

Just REAL Free WiFi!
Continue reading...

• CWNP
• September 03, 2009
• 

Push-Button Pen Testing

Push-Button Pen Testing: That's my phrase.  I came up with it yesterday.  It's a whole new class of automated hacking...uh, I mean penetration testing...products.  I got to see Silica-U from Immunity yesterday.  This thing is slick.  They finally ported it over from a Nokia N810 Internet tablet to a desktop Linux version (which I got to see running on my favorite Linux distribution - Ubuntu).  It worked just as described.  No longer do you have to remember WEP keys, WPA passphrases, LEAP usernames and passwords (in a future release).  Isn't that great?

• CWNP
• September 01, 2009
• 

Attacks on WiFi: Reflections on Recently Revealed Vulnerabilities

In the last couple of weeks, we've witnessed a flurry of activities in the wireless security space. Security researchers have revealed a couple of new attacks on WiFi infrastructure – Skyjacking and an improved attack on WPA-TKIP. This post provides a high level overview of both of these attacks.

• CWNP
• August 25, 2009
• 

No TKIP or No Certification

OK, so here's the thing.  The Wi-Fi Alliance's board approved, on March 26, 2009, additional testing to disallow the use of TKIP with HT MCS rates.  Tests were started the next day, and by Sept 1, 2009, all devices must comply.  Big whoop, right?  Well, not with the fact that 18 of 18 APs and 10 of 14 STAs have failed to date.  I wonder how the Wi-Fi Alliance is going to handle that?  Do they suddenly decertify equipment?  Do they extend the deadline?  Do they re-evaluate their decision to make this "feature" mandatory?

• CWNP
• August 21, 2009
• 

MediaFlex-o-matic

I'm talking about Ruckus's MediaFlex.  Everything is automagic.  No, seriously.  Plug it in, wait a few seconds, and poof: you have an automatically-selected 5 GHz (40 MHz) UNII channel moving HD IPTV.  Coverage?  Not a problem with Transmit Beamforming (TxBF) - Ruckus's trademark feature.  The AP was downstairs in the basement, and the two TVs were upstairs.  Without TxBF, there's no way this could've happened in 5 GHz.  Clarity?  As good as the RG59 cable that our AT&T U-verse receivers were using prior to testing the Ruckus MediaFlex 7000 series system...and yes, I unplugged the RG59 cables before testing! :-)

• CWNP
• August 19, 2009
• 

Rogue AP Prevention: Duping (802)Dot1X Access Control

“You can't solve social problems with software” – Marcus Ranum

We have covered two sources of WiFi threats in my previous blog posts – Rogue AP and Client mis-configurations. It has been encouraging to see quality comments from readers – some of them have pointed out why 802.1X is the “preferred” way to mitigate the Rogue AP problem. In this post, we will dig a little bit deeper into this. IEEE 802.1X port-based access control provides an authentication mechanism for devices wishing to communicate via a port (e.g., a LAN port). If the authentication fails, it disallows further communication via the port. 802.1X is a simple form of Network Access Control (NAC) solution – a generalized NAC can provide additional functionality such as fine-grained access control, identity management, access management, and quarantining non-compliant clients (e.g., ones without proper anti-virus protection).

I think that 802.1X is a good first step in securing your network from Rogue APs. It does provide some control on the relatively deterministic part of the problem – the wire. However, as I had hinted in my earlier post, I believe that 802.1X (or even a generalized NAC, for that matter) alone is not sufficient for mitigating Rogue APs. Here are my reasons:

• CWNP
• August 17, 2009
• 

Determinism

Call it what you will: Deterministic, Utility, or Automatic.  I don't really care what you call it if you can make Wi-Fi "just work."  Every vendor will tell you a different story to tell on how to build "Wi-Fi that works" based on their own networking philosophy and feature sets, and every network administrator has a different view of what "Wi-Fi that works" means.