WISDOM Advanced Security Measures

Client's WLAN without IPSec protection. IPSec renders most of the commonly used attack methods completely ineffective. It does this by providing confidentiality, integrity, and authentication of traffic.

A client's system can be vulnerable to attack when it is connected to the untrusted WLAN network without the protection of IPSec.

Include personal firewall software on the wireless client to protect the client while it is connected to the untrusted WLAN network without the protection of IPSec.

DNS and DHCP server application protocols. These protocols are not protected by the VPN IPSec solution and will require supplementary host security best-practice implementation and third-party software to mitigate the risk of attack against the server(s).

In general terms, the VPN gateway delineates between the trusted wired network and the untrusted WLAN. The wireless client establishes a VPN connection to the VPN gateway to start secure communication to the corporate network. In the process of doing so, the VPN gateway provides device and user authentication via the IPSec VPN. This filtering does not protect the application protocols on the DNS and DHCP servers and therefore leaves them open to direct attack. Extra care must be taken to ensure that these systems are as secure as possible at the host level.

Implement host-level security to include updating and maintenance of the latest OS and application patches and the use of a host-based intrusion detection system (HIDS).

Wireless packet sniffers against WLAN clients. The effort needed for intruders to penetrate a wireless network is now being lessened with the release of several wireless sniffer software applications that allow intruders to passively collect data for real-time or later analysis. Such analysis can lead to the compromise of the network. AirSNORT is an application that utilizes known WEP flaws to extract the WEP key and allow unauthorized network access. NetStumbler is a full-featured wireless sniffer that logs an extensive array of information about any wireless network it happens to encounter: the MAC address of the access point, the network name, SSID, manufacturer, channel in use, signal strength, and whether WEP is enabled, to name a few. An intruder looking to attack a target wireless network can use all of this information.

Wireless packet sniffers can take advantage of any of the known WEP attacks to derive the encryption key and other information valuable for preattack reconnaissance.

Use IPSec encryption of wireless client traffic.

Man-in-the-middle attacks. A man-in-the-middle attack security breach is when a malicious user intercepts, and possibly alters, data traveling along a network. Security auditing tools such as dsniff, sshmitm, and webmitm are capable of performing active man-in-the-middle attacks against encrypted SSH and HTTPS traffic. A rogue access point can utilize this default behavior to compel clients to connect to a node performing active man-in-the-middle attacks against sensitive traffic.

WLANs are susceptible to man-in-the-middle attacks. The man-in-the-middle or TCP hijacking attack is a well-known attack where an attacker sniffs packets from a network, modifies them, and inserts them back into the network. There are a few programs/ source codes available for doing a TCP hijack. TCP hijacking is an exploit that targets the victim's TCP-based applications such as Telnet, rlogin, ftp, mail application, Web browser, etc. An attacker can grab unencrypted confidential information from a victim's network-based TCP application and can further degrade the authenticity and integrity of the data.

Use IPSec encryption of wireless client traffic.

DHCP IP configuration protocol spoofing.

By spoofing the client's packet exchange, a DHCP server will give all of the available leases to a spoofed MAC address, thus causing a denial of service. Any machine wishing to join the network after the attack would not be allocated an IP address because the whole of the DHCP range will have been either allocated to valid interfaces (i.e., interfaces already joined to the network before the attack took place) or spoofed MAC addresses. Any interface already joined to the network would not notice the effect of the attack because it has already been assigned an IP address, but interfaces without an IP address would not be able to join the network because the DHCP server will have no available IP addresses. A rogue DHCP server could also be set up by a hacker. The DHCP protocol can aid a hacker to redirect traffic through his or her machine (man-in-the-middle attack) or to send users to false Web pages (via a rogue DNS server). This could occur because a DHCP server can set various options, such as what IP address to use for the default gateway and what DNS servers to use.

Allow only the known protocols for initial IP configuration (DHCP) and VPN access (DNS, Internet Key Exchange [IKE], and Encapsulating Security Payload [ESP]) from the WLAN to the wired network through filtering at the AP and Layer 3 switch. Enforce authorization policies on the VPN gateway for individual user groups.

IP spoofing. The attack is based on the fact that Internet communication between distant computers is routinely handled by routers, which find the best route by examining the destination address, but generally ignore the origination address. The origination address is only used by the destination machine when it responds to the source.

In a spoofing attack, the intruder sends messages to a computer indicating that the message has come from a trusted system. To be successful, the intruder must first determine the IP address of a trusted system and then modify the packet headers so that it appears as if the packets are coming from the trusted system. The attacker is fooling (spoofing) the distant computer into believing that he or she is a legitimate member of the network. The goal of the attack is to establish a connection that will allow the attacker to gain root access to the host, allowing the creation of a backdoor entry path into the target system.

WLANs are susceptible to IP spoofing. A hacker can use IP spoofing to gain unauthorized access to the network and computers, whereby the intruder sends messages to a computer with an IP address indicating that the message is coming from a trusted host. To engage in IP spoofing, a hacker must first use a variety of techniques to find an IP address of a trusted host and then modify the packet headers so that it appears as if the packets are coming from that host.

Implement IPSec. Hackers can spoof traffic on an unprotected WLAN, but only valid, authenticated IPSec packets will ever reach the production wired network. An effective measure against IP spoofing is the use of a VPN protocol such as IPSec. This methodology involves encryption of the data in the packet as well as the source address. The VPN software, or firmware, decrypts the packet and the source address and performs a checksum. If either the data or the source address have been tampered with, the packet will be dropped. Without access to the encryption keys, a potential intruder would be unable to penetrate the firewall.

ARP spoofing. ARP spoofing is a method of exploiting the interaction of IP and Ethernet protocols. It is only applicable to Ethernet networks supporting IP. ARP spoofing involves constructing forged ARP replies. By sending forged ARP replies, a target computer could be convinced to send frames destined for computer A to go instead to computer B. When it is done properly, computer A will have no idea that this redirection took place. The process of updating a target computer's ARP cache with a forged entry is referred to as "poisoning."

ARP is a TCP/IP-based protocol used to convert an IP address into a physical address (called a Data Link Control [DLC]) such as an Ethernet address. A host wishing to obtain a physical address broadcasts an ARP request onto the TCP/IP network. A host on the network that has the IP address in the request will reply with its physical hardware address. After authenticating, ARP spoofing attacks can be launched in the same manner as in a wired environment to intercept other users' data.

Implement IPSec. ARP spoofing attacks can be launched; however, data is encrypted to the VPN gateway, so hackers will be unable to read the data.

Password attacks. An attacker who obtains some sensitive password-derived data, such as a hashed password, performs a series of computations using every possible guess for the password. Because passwords are typically small by cryptographic standards, the password can often be determined by brute force. Depending on the system, the password, and the skills of the attacker, such an attack can be completed in days, hours, or perhaps only a few seconds. A password database should always be kept secret to prevent a dictionary attack on the data. Obsolete password methods also permit a dictionary attack by someone who eavesdrops on the network. Strong password policy enforcement methods prevent this occurrence.

As with wired networks, WLANs are vulnerable to exploitation when weak policies and password controls exist.

Implement good password policies, one-time-passwords (OTP), and auditing.

Unauthorized network topology discovery. Network topology discovery is part of the reconnaissance process for an adversary planning for unauthorized access to a network or an attack.

Unauthorized topology discovery can occur in the same way that is possible in the wired network. Network topology can aid an adversary in the attack planning phase when this information is not otherwise available.

Control IP configuration protocols. Only IKE, ESP, DNS, and DHCP will be allowed from the WLAN to the wired network.

MAC/IP spoofing from unauthenticated users. WLANs are susceptible to both MAC and IP spoofing.