The myth of wireless insecurity

By | December 7, 2005

Everyday, millions of people make secure transactions using Web browsers and Secure Sockets Layer, or SSL. In fact, e-commerce is entirely dependent on SSL technology. Even if their knowledge of the technology itself is sketchy or non-existent, the actions of the everyday consumer demonstrate widespread trust in SSL.

On the other hand, very few trust IEEE 802.11 wireless technology to guard their secrets, despite the fact that significant advancements have been made. Wireless Protected Access, or WPA, when properly implemented, ensures that 802.11 wireless networks are at least as secure as SSL, and certainly more secure than unprotected wired infrastructures. This is something that communications professionals need to be aware of if they are to prepare their customers effectively for future networking demands, in addition to easing their own concerns over security.

Wireless networks were rendered insecure in early 2001 when the University of California, Berkeley published a paper describing significant vulnerabilities in Wired Equivalent Protocol, or WEP. Indeed, these weaknesses were real, as the IEEE committee that developed the security portion of 802.11 failed to employ a cryptographer as part of the team.

Cryptography requires a strong mathematical background, and remains a highly specialised science. A rare few are qualified to develop and analyse implementations of cryptographic algorithms. As a result, even though the RC4 algorithm used by WEP is secure, the implementation specified by the committee was not. It betrayed many holes, including a lack of specification for how the Initialisation Vector required by the algorithm should be computed. The problem was exacerbated further by the absence of a static, shared key that could be used by every machine in a network and used directly for encryption. There was also no simple method available for distributing keying material.

Using readily available tools such as Airsnort, it is simple to recover the WEP key and then monitor a network. Due to the lack of a scalable key distribution scheme, key changes were difficult and thus extremely rare. Consequently, WEP was branded as insecure, and the perception of wireless LANs was tainted accordingly.

New reality

That was three years ago and technology has moved forward since then. Unfortunately, the perception is still that wireless is insecure. As a result, many organisations are either not implementing wireless at all, or are making progress needlessly complex by implementing VPNs to securely tunnel traffic through the wireless cloud. At worst they are treating the wireless infrastructure as totally un-trusted and protecting their LAN infrastructures with firewalls.

Leave a Reply