IBM Wireless Security Auditor

IBM Wireless Security Auditor

The following overview was provided with permission from Dave Safford of IBM.

WSA (Figure 10.16) is an IBM research prototype of an 802.11 wireless LAN security auditor, running under Linux on an iPAQ PDA. WSA automatically audits a wireless network for the proper security configuration to help network administrators close any vulnerabilities before hackers try to break in. Although there are other 802.11 network analyzers out there (wlandump, ethereal, Sniffer), these tools are aimed at protocol experts who want to capture wireless packets for detailed analysis. WSA is intended for the more general audience of network installers and administrators ” those who want to easily and quickly verify the security configuration of their networks, without having to understand any of the details of the 802.11 protocols.

Figure 10.16. WSA operating on an iPAQ.

802.11 Security Issues

The current 802.11 standard defines two security protocols: shared key authentication was designed to provide secure access control, and WEP encryption was designed to provide confidentiality. (Some vendors also try to claim that the SSID and station MAC addresses provide secure access control. As the SSID and MAC addresses are transmitted in the clear, they really don't provide any meaningful security, and are easily bypassed.)

There are several security issues with these protocols. Most importantly, WEP and shared key are optional, and turned off by default in access points. If these protocols are not turned on in even one access point, it is trivial for hackers to connect to the network, using standard wireless cards and drivers. The 802.11 signal can travel surprisingly large distances from the access point, often a thousand feet or more, allowing hackers to connect from outside the building, such as from a parking lot, or from the street. If, as is often the case, the wireless network is connected directly to a corporate intranet, this gives hackers direct access to the intranet, bypassing any Internet boundary firewalls.

The problem of " open " access points is made more difficult because of the low cost and easy availability of access points, and the difficulty of detecting them. It is not uncommon to find individuals or groups within a company who have installed rogue access points without the knowledge of the normal networking group , and without properly configuring the access point(s). These rogue access points are often difficult to detect with normal network monitoring tools, as access points are normally configured as Layer 2 bridges.

In addition, the WEP and shared key protocols have been shown to have significant cryptographic errors that permit cryptographic attacks on both the confidentiality and access control functions. (For details, see the Wagner/Goldberg paper at http://www.isaac.cs.berkeley.edu/isaac/wep-faq.html, and the Arbaugh paper at http://www.cs.umd.edu/~waa/attack/v3dcmnt.htm). Note that while WEP and shared key are flawed, they should still be turned on, as attacks are much easier with them off.

Vendors and the IEEE are responding to the flawed protocols with fixes in several stages. In the short term, vendors are adding new authentication/key management protocols that provide secure authentication, and new WEP keys for each card, per session. In addition, in the near term, vendors are working on a tweak to WEP to make attacks more difficult, as well as a long- term complete fix.

From a management perspective, network administrators need a tool to verify that all access points are at the desired firmware revision so that they have the most current version of these 802.11 fixes.

802.11 Management Issues

A network administrator needs a convenient way to answer these questions:

• What access points are actually installed?

• Where are they?

• Are they properly configured?

• Do they have the latest firmware?

The wireless network needs to be checked periodically, as access points are easily added and modified, and as updates will be rolled out frequently. The wireless auditing tool needs to look at the actual wireless signals, as the needed information might not be available from the wired side. To monitor the wireless data, the auditor needs to be small and lightweight so it can be easily carried around a site to ensure complete analysis and review.

What Does WSA Do?

Most importantly, we wanted WSA to be easy to use, and to require absolutely no knowledge of the 802.11 protocols. WSA is not a packet dump/analyzer. Rather it does all the necessary packet monitoring and analysis, and provides the user with just the answers to the important management questions. The results are color -coded (green is good, red is bad) for rapid and easy understanding.

WSA features the following functionalities and features:

• Tracks beacon packets to find all access points

• Determines SSID and AP names

• Tracks probe packets and the probe responses

• Tracks data packets

• Determines link encryption method

• Tracks authentication packets

• Determines authentication method

• Tracks clients

• Determines firmware versions by fingerprinting the access point's detailed behavior

Components

WSA currently runs under Linux, on either a notebook or an iPAQ PDA. We currently support the Cisco/Aironet PCMCIA 802.11 cards, either the old Prism I-based cards or the current Prism II-based cards. On the iPAQ, we are using the Familiar Linux distribution with the fltk library, and on thinkpads, we are using RedHat 7.1.

Status

WSA is a research prototype, and no definite decision has been made whether to make it a full product or to release it as open source. (The necessary "airo" driver module modifications have already been open-sourced.)

WSA Visual Tour

Here's the root window background (Figure 10.17):

Figure 10.17. IBM's root window background.

Figure 10.18 shows the main application window, with basic information on two visible access points. The green color indicates that the first access point is configured to use WEP. The yellow color indicates that the second access point has been seen, but that we have not yet seen data to tell whether or not the access point is correctly configured.

Figure 10.18. Main application window.

In this screenshot, another access point has been seen, and the "tsunami" access point has been determined to be misconfigured (allowing unauthenticated, unencrypted) connections (see Figure 10.19).

Figure 10.19. Testing for weak WLANs.

Clicking on any access point line gives a more detailed screen. This access point has been correctly configured for WEP data (see Figure 10.20).

Figure 10.20. Detailed access point information.

WSA has seen this access point accept unencrypted data (see Figure 10.21).

Figure 10.21. WSA detects no encryption on this network.

Options include attempting an active association to a given access point, and the recording of GPS location information, which is useful in tracking signal propagation and locating access points (see Figure 10.22).

Figure 10.22. WSA supports GPS hardware.

This screen shows some configuration items, including packet source (specified file, or specified interface), and an optional GPS device specification (see Figure 10.23).

Figure 10.23. WSA configuration options.

This screen shows options for saving the current data to a file, setting an audit policy, resetting the current data, or quitting (see Figure 10.24).

Figure 10.24. File options in WSA.

The Help menu can call up a statistics screen for the current run, along with a program information screen (see Figure 10.25).

Figure 10.25. The WSA Help menu.