Identifying the Security Risks of Mobility

Without proper configuration, data on wireless networks and devices can be intercepted, analyzed, changed, or deleted, resulting in compromised data confidentiality and integrity.

Network services can also be compromised. Bad routing or naming information can be injected into a network. User passwords can be compromised and used for further intrusions. The configuration of devices can be changed to allow unauthorized connections or to disallow connections that should be allowed.

Mobile computers are vulnerable to worms, Trojan horses, and viruses. A compromised computer can be used to launch a Denial of Service (DoS) attack on a user's home or business network, when the user returns from roaming. Security measures are necessary to avoid these problems.

Basic networking classes teach that networks are structured in bus, ring, or star topologies. Although this may be true for very simple wired networks, it's not true for wireless networks. Even the simplest wireless network is amorphous, with radio waves emanating in many directions. Wireless users and wireless network signals can wander to unexpected places, where ordinary security protections may not be in place. That can compound this risk when mobile computers are taken off the main network and placed on a wireless network, where they are exposed to attacks, viruses, and Trojan horses. There's also the danger that they'll bring those risks back to the wired network. This means that users, and the IT representatives who support those users, must be even more vigilant about mobile security than they are with wired connectivity.

The previous section mentioned that 802.11 networks can span about 50 meters. With good antennas and favorable physical conditions that limit signal degradation, 802.11 networks can actually extend to much wider areas. A problem for network administrators is that networks can sometimes spread into parking lots or areas outside a building. Network attackers have been known to sit in the parking lots of companies and break into the wireless network and from there into the wired network. In August 2004, three Michigan men reached separate plea bargain agreements with the U.S. federal government in connection with a case in which they hacked into the national network of a retail store chain from one store's parking lot.

Other unscrupulous individuals have used wireless bandwidth without authorization to send huge amounts of spam or other objectionable material. In September 2004, a Southern California man pled guilty under the federal CAN Spam Act to driving around Venice, California, searching for unprotected wireless hot spots and exploiting them to distribute unsolicited e-mail that advertised adult websites.

In addition to the possibility that unauthorized users might exploit unsecured wireless bandwidth to launch attacks or send spam, there's also an increased risk to individual wireless devices, including notebook computers, on wireless networks. One reason for this is that wireless users can roam to unprotected networks, such as Internet cafés, hotels, and airports. Without proper protection, these users are vulnerable to DoS attacks and virus infections.

Wireless networks use shared bandwidth and therefore are more vulnerable to spying than wired networks. Wireless networks are analogous to legacy wired Ethernet networks that were designed using hubs or shared coaxial cable. In these older, nonswitched networks, every user on the network saw every other user's network traffic. Wireless networks still work that way today. Without added security features, both Bluetooth and 802.11 networks are vulnerable to sniffing, whereby an attacker monitors data being transmitted over a network. The confidentiality of data is at risk, as is the integrity of data if the attacker has the ability to change or remove data.

Tools are readily available for sniffing an unencrypted or weakly encrypted WLAN. They include Kismet, AirSnort, Ethereal, and WildPackets' AiroPeek. Network managers have legitimate uses for these tools, but attackers also can use them to peek at confidential data transmitted wirelessly.

Bluetooth networks that don't use encryption are also vulnerable to sniffing, although the tools are not as readily available as they are with WLANs. Without proper configuration, Bluetooth devices are also vulnerable to Bluesnarfing, where attackers gain unauthorized access to data stored on Bluetooth devices, and Bluejacking, where tricksters send bogus (often silly or flirtatious) business cards to Bluetooth devices. In early versions of Mac OS X, Bluetooth support allowed files to be shared without properly notifying the user. This has been addressed in Mac OS X 10.4.

Note

Never underestimate the potential for attackers to send malicious applications that the user may execute.

Despite these security risks, and others that are beyond the scope of this lesson, users demand mobility. They won't go back to being tethered to their desks. To meet the need for secure mobility, Apple Computer supports numerous industry standards for protecting Bluetooth and 802.11 networks.

Using the security features discussed in this lesson, you can control which users have access to mobile devices and networks, and what those users can do while they have access. You can also enable strong encryption that will make it virtually impossible for attackers to understand confidential data transmitted over wireless networks. The wireless genie is out of the bottle and surfing a radio wave near you, but that doesn't mean your security has to go up in smoke.