In the name of “save planet”, “green atmosphere”, “green energy” slogans which are very subtle issues and should be continued for betterment of all living creature, I somehow sense companies making all efforts to increase their sales revenues. Being a wireless guy, I would provide at least one example to prove my nous.
Have you heard about “Clean Air Technology” announced by Cisco systems? If not, you may get yourself familiar to this new technology here.
http://www.cisco.com/en/US/netsol/ns1070/networking_solutions_package.html
http://www.youtube.com/watch?v=y0vcTlXifOs
The technology has been introduced to detect RF interference faced by wireless devices from Cordless phone, Microwave, Wireless Camera, Bluetooth devices etc. Cisco has designed an AP which contains a dedicated radio to detect interference in both 2.4 and 5 GHz bands. Additionally, it can also be used to do spectrum analysis.
In the next few paragraphs, we will analyze whether presence of a dedicated radio which comes at an additional cost and powered all the time is justified or not and does it really solve a problem. Does the RF interference problem clean air technology intend to solve real?
Rebuttal # 1: AP detects RF interference experienced by clients
In a typical WLAN deployment, one can imagine one AP serving several clients simultaneously. These clients could be spatially distributed around Access Point. In such scenario, it’s not necessary that RF interference experienced by a client is equally experienced by an AP. In fact it might also possible that AP never experiences RF interference while clients do.
Rebuttal #2: AP detects microwave, cordless phone and wireless camera
Microwave causes problem with 2.4GHz wireless communication. Normally, the location of this interfering device is known and if it cannot be re-located (e.g. Microwave operating in the neighbourhood, unlikely to cause interference but considering here for completeness) then a careful deployment of dual band AP near pantry area can solve the problem.
Even if we believe cordless phone causes degradation of wireless network throughput, do we really need high end AP to detect it and that too all over? It can be banned by enforcing right policy.
Wireless camera causes jamming on a channel. Again, problem arising from wireless camera can be solved by the use of dual band AP.
Rebuttal #3: Clean Air Technology equals Green Atmosphere
A dedicated radio powered al l the time just to detect sporadic interference doesn’t qualify to be green technology. What’s the use of a dedicated RF interference detection radio after you clean your air? Just think!
Conclusion
Instead of having a dedicated radio, present in all APs and powered all the time to detect RF interference, ideally such intelligence should be present in APs and clients. Some WLAN vendors are already making progress in this direction and adding RF interference detection capabilities in APs and clients. In long term wireless monitoring systems can also play important role by providing RF interference detection intelligence along with high value security solution.
Showing posts with label WIPS. Show all posts
Showing posts with label WIPS. Show all posts
Thursday, August 26, 2010
Friday, September 4, 2009
A First Line of Defense against Cisco’s Over-The-Air-Provisioning (OTAP) Protocol Vulnerability
You may have heard that researchers at AirMagnet’s Intrusion Research Team have uncovered the vulnerability in Cisco’s proprietary OTAP protocol that allows an attacker to take control of an authorized light weight APs (LAPs).
Interestingly, the advisories that have come from both AirMagnet and Cisco have different severity level assigned to the reported problem. Also, the safeguards proposed in these advisories are either too involved or time consuming. For a network and security administrators, what matters is a first line of defense that can buy them some time to implement a real safeguard. But what is a real safeguard and how they can be implemented are also unclear to many.
In order to find an answer, I decided to do a self investigation of the OTAP vulnerability. I read a few docs which were relevant to Cisco’s OTAP protocol implementation:
Doc 1: Understanding Over−the−Air Provisioning (OTAP), Document ID: 100516
Doc 2: Lightweight AP (LAP) Registration to a Wireless LAN Controller (WLC), Document ID: 70333
Here are key findings of OTAP protocol implementation:
1. LAP uses Over−the−Air Provisioning (OTAP) feature to discover WLCs. LAPs support OTAP only when they have a full LWAPP Cisco IOS image.
a. Out−of−the−box LAPs are shipped from the factory with a stripped−down version of lightweight Cisco IOS® Software that is called the LWAPP Recovery Cisco IOS image and does not support OTAP.
b. Out−of−the−box 1510s and 1520 APs have a full image installed in flash. (See Doc 1)
2. OTAP process utilizes Radio Resource Management (RRM) neighbor packets. The RRM neighbor packets are transmitted without any encryption (See Doc 1)
3. The OTAP feature is enabled on a WLC by default. (See Doc 2). OTAP enabled on the controller indicates to the controller whether or not to respond to discovery requests with the OTAP bit set. It does not prevent the LAPs already joined to the controller from the transmission of the management IP address of the controller in the clear in RRM neighbor packets.
With this information available on OTAP protocol, I hope; now it would be much easier to make a judgment on AirMagnet’s and Cisco’s advisories or for that matter anybody’s advisory on this topic. Some of the frequently discussed queries are answered below:
I. Skyjacked LAP provides a direct access to a corporate WLAN
True.
II. OTAP vulnerability will simply cause Denial-of-Service (DoS) problem
False. A Skyjacked LAP can act like a rogue device physically connected to
a corporate LAN. Once skyjacked an attacker gets full control of a LAP and he
can open a backdoor entry to your corporate LAN.
III. Disabling OTAP feature can solve this problem
False.
IV. Only out-of-the-box LAPs are vulnerable
False. All LAPs (primarily 1100 and 1200 series) running full Cisco IOS®
Software are vulnerable.
V. My LAPs are Up and connected. Are they vulnerable?
Yes. The attack works whenever a LAP reboots. If your LAPs are up and running they are safe but reboot of a LAP can be observed in the network e.g. whenever you change mode of a LAP say from “local” to “monitor” (used in location based service, LBS) it reboots.
A First Line of Defense
Network administrators can stop vulnerable LAPs from getting hijacked by blocking LWAPP communication ports (UDP port no 12222 and 12223) in a network firewall.
• A WLAN customer with a locally deployed WLC system can block LWAPP Data and Control ports.
• A WLAN customer with a WLC present on WAN link (including REAP/H-REAP mode deployment) can apply firewall rule to allow communication on LWAPP Data and Control ports only with authorized controllers (WLCs) IP address.
Conclusion
Wi-Fi networks are known to have security flaws. Zero-day problem like “OTAP vulnerability” will keep on surfacing. If you are lucky you will find a first line of defense but what, if you fail to find one? Network compromise and huge Data loss Right! But the answer also depends on whether or not your WLAN deployment is equipped to protect against potential exploits of zero-day vulnerability. Use of an independent overlay Wireless Intrusion Prevention System (WIPS) adds that extra layer of security which prevents WLANs against any potential misuse.
Isn’t it a right time to think of an independent shell of security for WLANs? Choice is yours!
Interestingly, the advisories that have come from both AirMagnet and Cisco have different severity level assigned to the reported problem. Also, the safeguards proposed in these advisories are either too involved or time consuming. For a network and security administrators, what matters is a first line of defense that can buy them some time to implement a real safeguard. But what is a real safeguard and how they can be implemented are also unclear to many.
In order to find an answer, I decided to do a self investigation of the OTAP vulnerability. I read a few docs which were relevant to Cisco’s OTAP protocol implementation:
Doc 1: Understanding Over−the−Air Provisioning (OTAP), Document ID: 100516
Doc 2: Lightweight AP (LAP) Registration to a Wireless LAN Controller (WLC), Document ID: 70333
Here are key findings of OTAP protocol implementation:
1. LAP uses Over−the−Air Provisioning (OTAP) feature to discover WLCs. LAPs support OTAP only when they have a full LWAPP Cisco IOS image.
a. Out−of−the−box LAPs are shipped from the factory with a stripped−down version of lightweight Cisco IOS® Software that is called the LWAPP Recovery Cisco IOS image and does not support OTAP.
b. Out−of−the−box 1510s and 1520 APs have a full image installed in flash. (See Doc 1)
2. OTAP process utilizes Radio Resource Management (RRM) neighbor packets. The RRM neighbor packets are transmitted without any encryption (See Doc 1)
3. The OTAP feature is enabled on a WLC by default. (See Doc 2). OTAP enabled on the controller indicates to the controller whether or not to respond to discovery requests with the OTAP bit set. It does not prevent the LAPs already joined to the controller from the transmission of the management IP address of the controller in the clear in RRM neighbor packets.
With this information available on OTAP protocol, I hope; now it would be much easier to make a judgment on AirMagnet’s and Cisco’s advisories or for that matter anybody’s advisory on this topic. Some of the frequently discussed queries are answered below:
I. Skyjacked LAP provides a direct access to a corporate WLAN
True.
II. OTAP vulnerability will simply cause Denial-of-Service (DoS) problem
False. A Skyjacked LAP can act like a rogue device physically connected to
a corporate LAN. Once skyjacked an attacker gets full control of a LAP and he
can open a backdoor entry to your corporate LAN.
III. Disabling OTAP feature can solve this problem
False.
IV. Only out-of-the-box LAPs are vulnerable
False. All LAPs (primarily 1100 and 1200 series) running full Cisco IOS®
Software are vulnerable.
V. My LAPs are Up and connected. Are they vulnerable?
Yes. The attack works whenever a LAP reboots. If your LAPs are up and running they are safe but reboot of a LAP can be observed in the network e.g. whenever you change mode of a LAP say from “local” to “monitor” (used in location based service, LBS) it reboots.
A First Line of Defense
Network administrators can stop vulnerable LAPs from getting hijacked by blocking LWAPP communication ports (UDP port no 12222 and 12223) in a network firewall.
• A WLAN customer with a locally deployed WLC system can block LWAPP Data and Control ports.
• A WLAN customer with a WLC present on WAN link (including REAP/H-REAP mode deployment) can apply firewall rule to allow communication on LWAPP Data and Control ports only with authorized controllers (WLCs) IP address.
Conclusion
Wi-Fi networks are known to have security flaws. Zero-day problem like “OTAP vulnerability” will keep on surfacing. If you are lucky you will find a first line of defense but what, if you fail to find one? Network compromise and huge Data loss Right! But the answer also depends on whether or not your WLAN deployment is equipped to protect against potential exploits of zero-day vulnerability. Use of an independent overlay Wireless Intrusion Prevention System (WIPS) adds that extra layer of security which prevents WLANs against any potential misuse.
Isn’t it a right time to think of an independent shell of security for WLANs? Choice is yours!
Saturday, June 27, 2009
Why Your Weakest Security Link May Remain Invisible to You Forever
In a poor economy condition, layoffs, downsizing and low morale brings worst out of a trusted insiders as more and more IT professionals admitting they’re tempted to abuse their access privileges looking to profit off of proprietary intellectual property, trade secrets, human resource databases and any other sensitive information, according to a survey report published on darkreading.com.
It’s not that security administrators are not taking right measures to minimize newly emerged security risks from trusted insiders. Traditional way to stop data theft by improving physical security, disabling access to media drives, CD, USB or applying controls on the network side e.g. email filtering for attachments or access to limited Internet sites are definitely necessary actions to take but these are not sufficient to reduce the data security risk in today’s world.
With the proliferation of different wireless technology (e.g. GSM/GPRS, Bluetooth, WiFi, WiMax), human interactions with electronic gadgets, to share data, music, videos etc. has completely changed. Now all these contents are shared over wireless medium.
In fact WiFi has become the most popular wireless technology for local area data network and hence most of the modern mobile gadgets have inbuilt support for this technology. The technology also offers a very good range. Low deployment cost involved in it has made it an optimal choice especially for enterprises, to roll out corporate LAN in a most favorable time.
But there are some caveats for those who use this technology and those who don’t. WiFi medium can be a weakest security link for your enterprise and may remain invisible to you forever if you have not implemented right controls to manage WiFi enabled devices. Having the strongest authentication or encryption configuration possible in place for the corporate WiFi network is not enough to guarantee security of the network or the data that resides on the network.
The WiFi threats
Here are the top three WiFi threats we must know:
1. Presence of rogue, mis-configured or unmanaged WiFi gears
Presence of any rogue, mis-configured or unmanaged access points on corporate network may open a backdoor entry for an unauthorized or a malicious user and leave the network vulnerable. Such devices come into existence onto corporate network mostly by a trusted employee who sets up his own private WLAN.
2. Backdoor entry through WiFi enabled client machines
WiFi enabled clients can also serve as a point to access corporate network. Such backdoor can easily be created by a trusted insider on any WiFi enabled machine by simply creating a bridge interface on top of wired and wireless interface. An unauthorized user can establish peer to peer or adhoc mode connection with a trusted client machine from outside the building and have all data transferred on his machine.
3. RF spillage from neighbor’s networks
RF spillage from neighboring open WiFi networks e.g. a cyber caffe or WiFi Internet service provider can defeat the purpose of a corporate firewall or built-in access controls which are implemented to protect leakage of corporate data or sensitive information through Internet.
The solution
Presence of above mentioned threats can only be discovered if we monitor the airspace. Hence, there is a need to continuously monitor the airspace in and out of a corporate building, 24/7 and 365 days. Believing that legacy wired network monitoring systems or tools can also monitor wireless devices is a big misapprehension. In a wired network, all devices are physically connected to the network with the help of a copper cable. While in a wireless network, devices connect and communicate in the air with the help of radio frequency (RF) and hence monitoring such devices requires a system which can understand RF communication.
In a technical terminology such systems are known as Wireless Intrusion Detection and Prevention Systems (WIPS). In the absence of such systems, it is impossible to visualize the presence of WiFi enabled devices especially clients or data exchange done by these clients. Hence, threats arising from WiFi may remain invisible forever.
The conclusion
So the conclusion is that in a looming economic condition, corporate data and sensitive information residing on the network demands for more tightened security, which means, ensuring that corporate policies are effectively enforced and corporate networks, authorized client devices, and wireless medium are properly monitored round the clock. This is only possible if enterprises have successfully implemented right controls to manage the risk that is inherent with their employee’s use of wireless technology.
It’s not that security administrators are not taking right measures to minimize newly emerged security risks from trusted insiders. Traditional way to stop data theft by improving physical security, disabling access to media drives, CD, USB or applying controls on the network side e.g. email filtering for attachments or access to limited Internet sites are definitely necessary actions to take but these are not sufficient to reduce the data security risk in today’s world.
With the proliferation of different wireless technology (e.g. GSM/GPRS, Bluetooth, WiFi, WiMax), human interactions with electronic gadgets, to share data, music, videos etc. has completely changed. Now all these contents are shared over wireless medium.
In fact WiFi has become the most popular wireless technology for local area data network and hence most of the modern mobile gadgets have inbuilt support for this technology. The technology also offers a very good range. Low deployment cost involved in it has made it an optimal choice especially for enterprises, to roll out corporate LAN in a most favorable time.
But there are some caveats for those who use this technology and those who don’t. WiFi medium can be a weakest security link for your enterprise and may remain invisible to you forever if you have not implemented right controls to manage WiFi enabled devices. Having the strongest authentication or encryption configuration possible in place for the corporate WiFi network is not enough to guarantee security of the network or the data that resides on the network.
The WiFi threats
Here are the top three WiFi threats we must know:
1. Presence of rogue, mis-configured or unmanaged WiFi gears
Presence of any rogue, mis-configured or unmanaged access points on corporate network may open a backdoor entry for an unauthorized or a malicious user and leave the network vulnerable. Such devices come into existence onto corporate network mostly by a trusted employee who sets up his own private WLAN.
2. Backdoor entry through WiFi enabled client machines
WiFi enabled clients can also serve as a point to access corporate network. Such backdoor can easily be created by a trusted insider on any WiFi enabled machine by simply creating a bridge interface on top of wired and wireless interface. An unauthorized user can establish peer to peer or adhoc mode connection with a trusted client machine from outside the building and have all data transferred on his machine.
3. RF spillage from neighbor’s networks
RF spillage from neighboring open WiFi networks e.g. a cyber caffe or WiFi Internet service provider can defeat the purpose of a corporate firewall or built-in access controls which are implemented to protect leakage of corporate data or sensitive information through Internet.
The solution
Presence of above mentioned threats can only be discovered if we monitor the airspace. Hence, there is a need to continuously monitor the airspace in and out of a corporate building, 24/7 and 365 days. Believing that legacy wired network monitoring systems or tools can also monitor wireless devices is a big misapprehension. In a wired network, all devices are physically connected to the network with the help of a copper cable. While in a wireless network, devices connect and communicate in the air with the help of radio frequency (RF) and hence monitoring such devices requires a system which can understand RF communication.
In a technical terminology such systems are known as Wireless Intrusion Detection and Prevention Systems (WIPS). In the absence of such systems, it is impossible to visualize the presence of WiFi enabled devices especially clients or data exchange done by these clients. Hence, threats arising from WiFi may remain invisible forever.
The conclusion
So the conclusion is that in a looming economic condition, corporate data and sensitive information residing on the network demands for more tightened security, which means, ensuring that corporate policies are effectively enforced and corporate networks, authorized client devices, and wireless medium are properly monitored round the clock. This is only possible if enterprises have successfully implemented right controls to manage the risk that is inherent with their employee’s use of wireless technology.
Subscribe to:
Posts (Atom)