Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security

Fixing Wireless Security By Pulling The Plug 133

Posted by timothy from the security-through-snippers dept.
An anonymous reader writes "It seems as though the Japanese government is paying attention to some security concerns of wireless networks, and rather than addressing the problem, taking a more aggressive but perhaps not as thorough approach to the issue at hand. Not very technical, but at least its good to see governments actually doing something about it."
This discussion has been archived. No new comments can be posted.

Fixing Wireless Security By Pulling The Plug More

Fixing Wireless Security By Pulling The Plug

Comments Filter:
  • But it is one the most secure ones. Any network can be hacked, and all it takes is time, as long as you have access to the network. Now that there is no access to a wireless LAN, they have solved their problem, unless they are worried about people who already have access to computers on the network.
    • I agree, although if they're paranoid enough to kill the WAP (I certainly would), maybe they should be reissuing passwords, in case anyone happened to grab them during their time of vulnerability.

      I scares me shitless to think that there have been successful wardriving sessions in the Washington, D.C. area.

    • The article makes it sound as if the agencies involved weren't using WEP (Wired "Equivalent" Privacy). The problem with WEP is that it isn't. Until we get the vendors to agree on something tough (512 bit AES??) we're going to keep having this problem.

      The weird thing about wireless is that someone can archive all your traffic and chew on it for years. So, the concept of "wired equivalent privacy" would really require an encryption scheme which was invulnerable for an infinite amount of time into the future to be as good as wired security... which to me sounds doubtful.

      WEP should be renamed.
    • Being the person who submitted this story, what i meant by "maybe not the most thorough" is that, if that information was so "easily" obtained wirelessly, then its probably not extremely secure on wire either, and they need to have better policies in place, but at least this is an intelligent start.

  • But... (Score:4, Funny)

    by Johnso ( 520335 ) on Thursday December 26, 2002 @05:01PM (#4962212)
    But if it's wireless, how can there be any plug to pull?
    • Just eat the pringles in their pringles can and the network will drop like a rock! You know, once you pop you can't stop...

  • O'Reilly book? (Score:3, Insightful)

    by masonbrown ( 208074 ) on Thursday December 26, 2002 @05:03PM (#4962227) Homepage
    Has anyone read the new O'Reilly book [oreilly.com] on securing 802.11b networks? Does it offer any cross-platform, cross-vendor solutions to general 802.11b insecurity?
    • Uh, why don't you read the full description [oreilly.com]?

      Since you don't seem inclined to investigate these matters yourself, the answer is "yes".
    • I'm asking since I haven't read it, and my local resellers don't have it in stock yet. Again, I ask if anyone has READ the book, not read the description of the book.....

    • IPSEC (Score:3, Insightful)

      by mfarver ( 43681 )
      The real problem is organizations grip tightly to the idea that physical security exists.

      The truth is that its only slighty harder for a attacker to get a physical connection to your network than for that same hacker to sit in your parking lot and wirelessly surf.

      But, wait, we have id badges, and a security gurd at the door, no one can get to our cables: I once worked with a guy who was paid to do penetration testing, he spent a week wandering around inside the corporate headquarters, until the company IT director declared his attacks unsuccessful (they had no firewall logs of his intrusions, so he must have not got in.) The IT director was displeased with the final report, showing all the data he had accessed (some from the consoles of the "secure" machines) and with the CEO who had agreed that the testing included physical site security.

      It becomes even easier when you accept that the vast majority of intrusions come from inside the company, from people who already likely have access to the network.

      Sending confidential data in the clear on a wired or wireless network is not a good idea, period.

  • Government agencies plug leaks in wireless networks
    The Asahi Shimbun

    Since anyone with the software could pry, cable is back in style.

    The Meteorological Agency and the Tokyo metropolitan government stopped using wireless local area networks (LAN) last week after learning data was wide open to anyone with the will and the right software.

    Wireless LANs are increasingly popular because they can be introduced or expanded quite simply without cumbersome cables.

    But when Kazuo Tanabe, a computer consultant in Sabae, Fukui Prefecture, studied LAN emission risks around government office LANs in his own prefecture, then in Tokyo, he found that data transferred on wireless LANs could be intercepted and read by anyone using software freely available on the Web.

    Tanabe said he first assessed the risk of LAN signals radiating from the municipal buildings of Sabae and Fukui, then came to Tokyo last week to measure the risk around some central government office buildings, especially in the Kasumigaseki district.

    There he found that data stored in the Meteorological Agency's personal computers-even personnel records and minutes of meetings-was especially vulnerable.

    The risk was highest at the agency's department dealing with volcanic activity, which lacked proper firewalls such as data encryption and password-protected access.

    When The Asahi Shimbun inquired about data vulnerability, the agency found two of seven wireless LANs could be monitored from outside. A LAN management official there said the network was shut down immediately, departments were informed and all computers on wireless LANs were switched to cable.

    At the Tokyo metropolitan government offices, several bureaus, including construction and environmental protection, did not encrypt the data moving over their LANs.

    At the office that administers public hospitals, most of the 80 PCs used by supervisors could be read from outside. Data exposed to prying eyes included payment to doctors and patient records.

    An official said network personnel were not well informed about security, but said all the wireless LANs were swapped for cable over the weekend.

    During his experimental foray at the Ministry of Economy, Trade and Industry, Tanabe said he found pirate versions of movies, including ``Harry Potter,'' TV dramas and video clips of entertainment personalities, which an official later said were for personal use.

    Encryption had not been used in some LANs at the Foreign Ministry or the Ministry of Agriculture, Forestry and Fisheries until September, when data vulnerability was pointed out.

    ``Use of wireless LANs is inappropriate for government agencies that handle personal information,'' Tanabe said. ``One hole in the network lets hackers in. Data can easily be stolen or altered. Or the opening can be used to spread viruses or other misdeeds.''

    (12/26)

  • Wow (Score:3, Funny)

    by Aggrazel ( 13616 ) <aggrazel@gmail.com> on Thursday December 26, 2002 @05:03PM (#4962230) Journal
    And if you really want to be secure, unplug your computer from the network completely! No one will be able to hack you then!

    BUT WAIT! If they get access to the computer they might, so lets unplug it from electricity, then the data will be REALLY secure.

    NO WAIT! What happens if they pull the hard drive out and connect it to another computer? I know, lets chop up the hard drive into little pieces to make sure that doesn't happen, then we'll be REALLY SECURE!

    Just don't write any thing down on a piece of paper, you never know into whose hands it might end up.
    • They always say they'll replace it with one of the same quality, but they never do...

      Damn those mice, and their crazy ideas of planet-sized supercomputers.

    • Re:Wow (Score:2, Informative)

      by shepd ( 155729 )
      >NO WAIT! What happens if they pull the hard drive out and connect it to another computer? I know, lets chop up the hard drive into little pieces to make sure that doesn't happen, then we'll be REALLY SECURE!

      I remember talking to someone at IBM about this. They told me that at the end of every shift, they were to remove the HDD from their computer (I assume it was on some sort of tray) and place it in a locked storage cabinet.

      I'm very sure if IBM did this, then the government would be more than willing to do it...

      • This is exactly how things are done in many US government agencies. Remember when that hard drive was lost at Los Alamos National Labs a couple of years ago (well I think that was a laptop drive)? Every computer has removable hard drive trays which you lock up every night before going home.

      • Re:Wow (Score:3, Informative)

        by FuzzyDaddy ( 584528 )
        I remember talking to someone at IBM about this. They told me that at the end of every shift, they were to remove the HDD from their computer (I assume it was on some sort of tray) and place it in a locked storage cabinet.

        I worked for a company that sold systems for use in classified environments. They all wanted removable hard drives for this very reason.

      • I've heard of this too. Sales people who worked primarily off-site had a safe installin their homes where both their laptop HDD and their IBM credentials/passcards/keys were to be stored when not in the physical posession of the droid.....errrr...employee.
  • ...giving WiFi the big "Fukui"?
  • Wireless networks are easily hackable, and even if you cant right away, you can just decrypt the packets later and see what juicy contents are inside. I think a sort of dual network thing probably would have been the best solution. Wireless for regular stuff, and physical cable for the other stuff maybe? Is that what would have been considered more thorough?
    • Wireless networking is evolving. Although any encryption can be cracked if you have enough encrypted data to analyze the idea is to change the keys often enough that it won't happen. For example, say that it would take about 500MB of encrypted data in order for the key to be discovered. So after sending 300MB of data the key is automatically changed. That way there is never enough data that was encrypted under the same key to allow the key to be cracked.

      Wireless will get there.

  • They did the right thing (Score:3, Insightful)

    by humina ( 603463 ) on Thursday December 26, 2002 @05:07PM (#4962273)
    You can get into a wireless network from VERY far away with the right antennas and equipment. Sensitive data should stay as far away from wireless as possible. The Japanese government did the right thing in pulling the plug. Most companies would just try to use the wireless network anyhow cause they already spent the money on the equipment. Wireless has it's uses. They just do not include sensitive networks.

  • I'm pretty sure (Score:3, Interesting)

    by TerryAtWork ( 598364 ) <research@aceretail.com> on Thursday December 26, 2002 @05:09PM (#4962280)
    That there's a project on Sourceforge to implement strong encryption on WANs to overcome the WAP problem.

    Can anyone elaborate on this, please?

    • Perhaps this will do the trick http://www.winton.org.uk/zebedee/
    • It's called IPSec. Dammit, just because it is used almost exclusively as a VPN solution, no one considers it as a solution for wireless security, and it indeed is a kick ass solution. I allow on my personal network access to FORWARD only if they are able to establish an IPSec connection. INPUT only on ESP and UDP port 500 (and DNS, ssh, for other reasons). I feel a lot more confident in this setup. The only problem I still foresee is that of systems on the same network being able to talk to each other unencrypted. The setup of mine (as well as most), however, is that servers are wired and wireless entities exchange no significant traffic between themselves...

  • Meanwhile in related news... (Score:4, Funny)

    by T-Kir ( 597145 ) on Thursday December 26, 2002 @05:09PM (#4962283) Homepage

    ...Pringles have announced record sales, especially among the computing demographic. This announcement also ties in with their plans to introduce MEGA-size Pringles... just for those who can't stop when they pop (or they need extra signal catchment from the bigger tube).

    [End Joke]

  • I do contract work with casinos (Score:4, Insightful)

    by JeanBaptiste ( 537955 ) on Thursday December 26, 2002 @05:10PM (#4962288)
    Casinos and nuclear power plants. Anything that is remotely sensitive is kept off of any network that eventually attaches to the internet. Firewalls, DMZs, encryption, all this stuff is great, but if its really important, no outside connections are the only way to go.

    so, I agree with Japan on that. and on the ps2.
    • Yeh right. And how many unlisted dialups do they use? Or for that matter, private leased lines that are remotely accessible through the providers private network?

      Not that such is trivial to crack, but it's all connected. Some stuff is just easier to reach.
      • I can't speak for the poster, but I can belive him because I have worked for companies that have networks completely inaccessible from the outside.
      • One nuclear power plant I work for has 2 networks. Internal and External. The 'External' network is accessable to the internet.
        The 'Internal' network:
        Unlisted dialups: 0.
        'Private leased lines': 0.

        Why? Because it is a matter of national security. Not good enough? Because if someone authorized such a decision they would go to jail, possibly for treason.

        Heck, just what I have already said probably violates my NDA in some way...
      • I followed the link in your sig and skimmed the text.
        It seems like what you want is basically this [freenetproject.org] right?
        • No, not at all. I want a complete network with IP connectivity and all the services that are possible with that. Freenet is the wrong approach, imo. It's neat if you want to move files around, but what if you want to chat real time? Or send email? Or any number of other things. Security/anonymity or not, it seems like a step backward. Seems more akin to pre-internet usenet, than it is to anything truly modern. I've heard people suggest that maybe they should build a network layer on top of it, but why do that when we can build such a network correctly, from the ground up?

          On Meta, you'll be able to register domain names for free. Or experiment/be involved with the grimy details of managing a big network(or not, if that's not your thing). You'll be able to be anonymous, and yet prove that you are indeed the same anonymous person that someone talked to last week. Run webservers, email, and everything else that your ISP bans. The list goes on...

          I hope Freenet is modestly successful though, it will take the limelight then, and act as a distraction for Meta.
    • I don't blame them. I have so far resisted the siren call of 802.11x because of all the security problems. WEP is pretty damn lame, VPNs are a pain and usually are also proprietary solutions, and even with wired Internet there are some people out there who view your network as a challenge to surmount. This is why I intend to take all the machines on my network that run Windows OFF the network. The Macs and the Linux and FreeBSD boxen can stay on, but the Spawn Of Bill get no gateway address or DNS information. Their IP addresses and hardware NIC IDs also will get filtered. I suspect this will solve a multitude of problems.
      • MY file server / interal web developement server has no ability to talk to the Internet. It has a hard-coded HOSTS file listing the machines on the LAN, it has no DNS server entry, no default route entry, and the server's IP addresses are blocked at the firewall. There iis no valid reason anyone outside my LAN would ever need to contact that machine and it has not valid reason to talk to the Internet. If I need patches or updates I downloadthem on a workstation, inspect them and then pipe them over to the server.
  • I thought everyone knew how wireless gave easier access to networks. Is there a way to simply put hardware encryption on every card, hub, router, etc.? I don't know anythinhg about encryption (or anything else, really =P) But would it be too hard to have hardware encryption that could be programed when the card is installed in the workstation.

    I'll go back to my busywork and try not to think about things I know nothing about.
    • Sadly, the problem is not that there is no encryption in the hardware, but that the encryption built-in to 802.11 hardware (WEP) was not implemented properly. Here [berkeley.edu] is a nice summary of the problems. Essentially, WEP can be cracked in a very short time with minimal effort. Using something like IPSec or SSH to encrypt the data in software before it is transmitted can help secure the data, but does not prevent someone from using the network for other purposes. In the case of businesses or government offices, if the data needs to be kept safe, it should remain on a wired network, with no connection to the outside world.
  • I'm rather ignorant about security on these wireless networks (802.11, Wi-Fi, etc). All my wireless experience is GSM based. I'm also not a user of wireless networks of any kind, for anything other than voice.

    My big question is, how much security is needed anyway? What are people using these networks for? If you're just doing simple web browsing at the airport (or even checking email that you don't care about) it shouldn't be much of an issue.

    Are many people using this stuff for financial transactions (including HTTPS over the web)? Do people use this to check secure email? Do many people (/. is a biased crowd) use wireless hubs in their homes?

    Where do the current security standards fall short? Afterall, you can listen in on any Internet traffic (in theory).

    Of course, in time, we'll need good security on wireless links. I just don't think it's reached a point where wireless gets enough use to need much security (yet).
    • You are quite right that security concerns with WiFi should be based on what kind of traffic is being spewed out into the atmosphere.

      If it's HTTPS you don't have to worry about it because the HTTPS protocol already encrypts your data very well. Similarly, if it's data you really don't care about (like web browsing) then you don't really need to worry.

      The point is many businesses use wireless like it's a PRIVATE network. Wirless should be viewed as a PUBLIC network, even when you have WEP enabled and MAC filtering turned on. Best practice IMO is to use IPSec encryption (it's not flawed like WEP). Basically set up VPN endpoints on each side of the WiFi link.
    • Where do the current security standards fall short? Afterall, you can listen in on any Internet traffic (in theory).

      One problem with wireless is that people tend to look at security from only one perspective -- "are my secrets safe?" -- and conclude that people without secrets don't need any security.

      The reason I use IPSec is not to keep the black hats from reading my credit card data (https keeps that safe enough), but to keep them from using my connection to send packets elsewhere. I just don't want my ISP or the police to break down the doors because some drive-by sent a million spam messages (or worse) with my return address!

  • The simple security solution for wireless networks is VPN. This could be a bit of a pain in the ass to set up and maintain in an environment where you've got 80 pc's on at any given time. Which is why you run wired (use gigabit ethernet if you got it-spanks wireless any day) in any significant cluster of pc's and only use secured wireless links between clusters where running cable is impractical. Example would be in and industrial/commercial park where you've got several offices that need to be networked together. Providing general wireless access (rather than Point-to-Point bridging) has to be done in an environment that is understood to be insecure, ie. you have to log into a secured environment in order to handle any sensitive information. The bottom line is that you can't trust a wireless connection to your own network anymore than you can trust any connection to the internet.

    The reason most wireless LANs go unsecured is that the equipment is defaulted with minimum security setings to make it easy to install and set up. Typically, once the AP is placed and running, people are just happy that it works, and neglect to apply the necessary security devices within the equipment. Additionally, research into appropriate security practice for wireless is rarely done. I've got the appropriate settings and protections on my home WLAN, and even so, if I'm not using the network, I turn it OFF - no need for unnecessary risk. A little paranoia won't hurt you, besides, they really are out to get you.
    • Things that happen to foil network security
      or
      Your PHB is the Enemy

      As an informed network guru, you already know that wireless networking is inherently insecure, but you are ordered to implement it anyway. Your proposal includes keeping all wired computers wired, running cable to all new pc's that need the network connection. You've got to have a separate server for the AP so you can segregate the wireless and wired networks. You'll have to load firewall, VPN, and intrusion detection software on the new server as well as EVERY client pc, and set things such that the clients will ONLY connect to the server AP and the AP will ONLY accept authorized client connections without broadcasting info to anonymous clients (knowing full well that snort will pick up the signal anyway). The AP(s) will be placed in such a way that signal leaking out of the target area is minimal or as close to unusable as possible (You know you won't be able to use the Langley method of wire mesh in all exterior walls and windows to contain the signal will NEVER be approved). You also request a pay increase because of the additional workload of managing this second network. Here's what happens:

      1) The PHB says "sure" and appropriates the equipment for you to deploy, but assigns you a new task as soon as you have it working but before you get all the security implemented. Result: insecure wireless network.
      2) A contractor is hired to install the wireless network, but the security implementation they proposed is declined because the PHB says "Our network guy will set that up" and then neglects to assign you the task. Result: insecure wireless network.
      3) Miraculously, you get your way and have the wireless network and security installed exactly the way you wanted. Result: your PHB bitches that the security measures are "inconvenient and slow down the network" and you are told to fix it, leaving you with an insecure wireless network.
      4) Your massive proposal is rejected, no wireless network is installed, and you still have time to post semi-intelligent crap on slashdot.
    • ...
      > Which is why you run wired (use gigabit ethernet if you got it-spanks wireless any day)

      Does gigabit ethernet use unshielded twisted pair?

      Any wire that transmits a signal, transmits some of it into the air. It might take some seriously sensitive equipment to pick up (think of the van from the movie `Sneakers'), but I'm willing to bet the expense of such equipment is trivial for a medium-sized governemt or international corporation (or `terrorist' group, or the Freemasons, or whoever it is that makes you want to wear a tinfoil hat).

      I'm no expert on radio, but wouldn't higher speed data (like gig ethernet) use higher frequencies, and would that make it easier or harder to pick up in the hypothetical signals intelligence van? (Or would it not affect it either way? I really don't know analog too well)

      Would using shielded cabling keep some of the `leakage' from happening? Of course, fiber would be the way to go, for the truly paranoid. No EMF radiation, and takes some pretty specialized (fairly expensive?) equipment to `tap' even if you're crawling around in somebody's ceiling/basement.

      Sorry, that asked too many questions, I'm in ramble mode..
      • Does gigabit ethernet use unshielded twisted pair?

        No, but I run double-shielded UV-resistant weatherproof cat-5, even for my patch cables. Anyone can do this, it's just a lot more expensive than the plain stuff (and a little harder to work with).

        I'm no expert on radio, but wouldn't higher speed data (like gig ethernet) use higher frequencies, and would that make it easier or harder to pick up in the hypothetical signals intelligence van?

        Higher frequencies generally get less penetration than lower frequencies which is why 802.11b (2.4 Ghz) has such a short range and 801.11a (5 Ghz) is worse. Double-shielded cat-5 (or fiber) + wire mesh in exterior walls & windows + massive shrubbery & trees on the grounds does a damn good job at preventing any (usable) signal from leaking out to that signals van parked on the street outside my house. Though I can't do much about the outside line they tapped, except for best available encryption. With all possible security measures in place, the weakest point is always the outside connection, which is why the most sensitive stuff MUST remain disconnected from any network that has an external connection. Wireless is by definition an external connection, and must be treated as such.
  • If they've shut down the wireless networks because they can't be adequately secured, how long before they get rid of the Microsoft networks? After all, computer consultant Tanabe was already complaining that "Data can easily be stolen or altered. Or the opening can be used to spread viruses or other misdeeds." Now if that doesn't describe Microsoft, I don't know what does.
    • Anyone who is truly concerned about computer security has to consider switching away from Microsoft. "Data can easily be stolen or altered. Or the opening can be used to spread viruses or other misdeeds." is an accurate description of Microsoft. Anyone concerned because personal information is flowing unguarded on a wireless lan should be concerned that it's being stored and protected with no particular security at all. That the underlying OS has proven itself time and again to be vulnerable to the cracks/hacks/tricks too numerous to mention.

      OpenBSD, OS X, pen and paper. Most alternatives are more trustworthy.

  • Security is in the eyes of the beholder.(or admin) (Score:3, Interesting)

    by t0qer ( 230538 ) on Thursday December 26, 2002 @05:26PM (#4962410) Homepage Journal
    Unless you are doing a weekly sweep of your network, and documenting the changes, any network, wired or wireless is suspectable to comprimise.

    Using any cheap hub, a few gel cell batteries, and some cat5 wiring knowledge, a person with physical access to the building could hide a 802.11 unit in the ceiling tile, crawlspace, outdoors in the bushes, and for the duration of the charge create a gateway into said network. Add a device (such as the dreamcast) or comprimise a computer internally to broadcast and it becomes darn near untracable.

    The major problem with most 802.11 installs is the admin simple does not do enough accounting and locking down on their network. If they would just reject all unknown mac addresses and accept from a known list WITH the added benifit of encypting all the traffic there would be NOTHING to worry about.

    Why doesn't someone just point that out to them? Hey Japan out of work IT dude right here in USA--I stay up all night PST playin EQ so we're on the same time zone pretty much (ba-bump)
    I can SSH remotely I'll work cheaper than any indian too (baBumpTa!)
    • If they would just reject all unknown mac addresses and accept from a known list WITH the added benifit of encypting all the traffic there would be NOTHING to worry about.

      A little too confident here? WEP encryption is flawed and hackable without too much effort. MAC addresses can be spoofed pretty easily.

      Wireless is very tempting, but it should be considered a "public" network. Run all of your traffic through encrypted IPSec tunnels.
    • Not all WAP's are created equal. For example, my home unit (D-LINK) won't allow me to implement wireless best practices, such as:

      * Allowing me to specify MAC addresses. This would be ideal, since I only use two wireless clients on my network and it never changes. No clients with non-specific MAC addresses would gain access.

      * Allowing me to successfully turn off "beaconing." Beaconing broadcasts the network info, which isn't necessary if the clients already know what it is. However, turning it off means I regularly lose connection, even when the PC is 30 feet away.

      * Strong WEP encryption. Encryption is difficult to implement. For example, if I want a 128-bit ASCII or HEX key, I need to MANUALLY type this key into each workstation. It makes tweaking the units difficult. The "passphrase" option exists on the client software but not the WAP software. High levels of encryption are slow and result in connection loss. 64 bit works very well, 128 bit so-so.

      *Allow me to run Linux. The Linux driver for the wireless card won't be available until next year.

      The cheezy implementation of the standard and the highly variable implementation of various options makes these things unsecure.

    • I don't think Unless you are doing a weekly sweep of your network, and documenting the changes, any network, wired or wireless is suspectable to comprimise works. If the black hat has physical access to a wire run, they can transparently hide the AP and not have it detectable from the wired side. You have to monitor new devices in real time if you want to detect injected packets -- and even that can be compromised if the bad guy manipulates his MAC to that of a device that is supposed to be there.

      On the other side, the question of safe deployment is non-trivial. While t0qer's suggestion to reject all unknown mac addresses and accept from a known list raises the bar, but doesn't eliminate problems. Again, the bad guy can readily manipulate his mac.

      Best practice seems to be to put APs on a dedicated VLAN, isolated from resources until authentication is provided. [LEAP and such are nice, but subject to MITM, so make sure that mutual auth with a pre-shared secret is part of the solution, if you really want to isolate resources...] and disallow any traffic that isn't part of an encrypted session.

  • "Entertainment Personalities" (Score:2, Funny)

    by Anonymous Coward
    During his experimental foray at the Ministry of Economy, Trade and Industry, Tanabe said he found pirate versions of movies, including ``Harry Potter,'' TV dramas and
    video clips of entertainment personalities, which an official later said were for personal use.

    Looks like someone's porn stash got found.

  • According to the article :

    The risk was highest at the agency's department dealing with volcanic activity, which lacked proper firewalls such as data encryption and password-protected access.

    It's sure that removing wlan APs will encrypt data and put some password mechanisms...

  • My company tried to fix the wireless that way. Unfortunately, our network was still vulnerable after pulling the plug. We ended up shutting off the wireless nodes instead.
  • It is a good thing that Tanabe probed Japanese government networks. If he done this in the US, the government would have thrown him in jail instead of shutting down their wireless networks.
  • "Not very technical, but at least its good to see governments actually doing something about it."

    Define good. I don't think it's good that their way of dealing with it is to avoid it. If it's broken, they should be investing in getting it fixed. Seriously, the Government's adoption of technologies like this really helps drive small businesses to innovate.
  • I have absolutely no problem with individual users or agencies making choices (i.e. wireless vs. wired) like these for themselves...the problem comes when somebody, usually a government type, decides for EVERYONE what's acceptable and not acceptable. As posted here before, our "government types" are starting to get itchy fingers over this wireless thing...."must stop anyone from having open AP"...in the name of National Security.

    If you don't want your data open for everyone to look at, don't use wireless or spend the time to create a really secure VPN/SSH connection that you trust. You shouldn't ever consider wireless any more secure/private than shouting across a couple of rows at the ball game.....that said, there are some situations where you do WANT everyone within a limited range to hear what you are saying, or simply don't care if they evesdrop...wireless is perfect for that....

    We tech types have a responsibility to help educate the folks who are still trying to hook up their X-mas gifts. If people understand what's going on with wireless, they will be less likely to gripe about the problems with it and we all will be less likely to have a government solution imposed upon us...
  • Its common thought in security circles that if you can't afford to do something right, its best not to do it at all. And given Japan's monetary issues right now, its quite possible they can't afford to do it right.

    Shutting it all off till they can afford to place the resources on it that it requires is perfectly reasonable.
  • The risk was highest at the agency's department dealing with volcanic activity, which lacked proper firewalls

    If the fire can't get in, how can the volcanologists study it?
  • Now, could be my ADD in action, but I saw NOWHERE in the article any mention of WAP encryption. I know that 64-bit encryption has proven fairly crackable in the past to anyone who has the real knowhow, but what of 128? Granted, it's been a while since I've really paid attention to the latest and greatest in 802.11 breaking, but is this really a hard topic?

    What do Japanese officials have to say for encrypted wireless networks?
  • "The risk was highest at the agency's department dealing with volcanic activity, which lacked proper firewalls such as data encryption and password-protected access."

    Oh wow...data encryption and password-protected access are proper firewalls...the one I have must not be doing anything then! I can go ahead and shut it off, and just leave my access password to protect my system, and not have to deal with the headaches of hosting games through my current "improper" one.

  • 802.11 is broken (Score:2, Interesting)

    by tstoneman ( 589372 )
    I just got my Linksys wireless bridge and AP over Christmas because I got sick of tripping over all the wires in my apartment.

    After I bought it and plugged it in, and I sat down and read up on security, and I was simply shocked at how the Linksys equipment have completely zero security.

    The most you can do to protect yourself is:

    1) disable SSID broadcasts
    2) filter based on MAC addresses
    3) use 128 bit WEP to obfuscate your data to only the casual

    Of course, WEP can be broken by any hacker worth his-or-her salt, and filtering based on MAC addresses doesn't work because you can spoof MAC addresses. There is zero security from a determined hacker.

    The Linksys APs also have a severe security issue where anyone can get the ssid [securityfocus.com] through a simple udp broadcast, meaning they don't even need a valid IP address. Once they get your SSID, it makes it way easier to connect to the AP.

    From what I've heard, Linksys even isn't doing anything about it.

    It really seems as though 802.11X is going to only find a place at home where consumers care more about getting rid of wires than about security. There is no valid reason for a business or governments, where their information is worth much much more, to be using such a security-free mechanism.

    I'm okay because I needed the wireless stuff for my gf's computer, and all she does is surf the web. I put in place a FreeBSD firewall just in case, so I'm not too worried about my neighbors or wardrivers getting connected. But for those people that don't care about security, this is probably the way that untraceable hacking in the 21st is going to go through - via some idiot that left his 802.11b connection open to hackers that live across the street, or just happened to pull by in their car to try and hack into some military site, etc.

    • From what I have heard, most of the cheapass consumer devices aren't all that great. If you want a really secure WiFi implementation, go with Cisco equipment. Of course it's a bit cost prohibitive for home but a no-brainer for businesses.

      At my house I use some of the cheap stuff. But I would still enable WEP and MAC filtering even though they can be broken. You still lock your car door even though someone can slim-jim it or just bash your window.
    • Of course, WEP can be broken by any hacker worth his-or-her salt, and filtering based on MAC addresses doesn't work because you can spoof MAC addresses.

      I belive the term is "cracker", not "hacker".

  • the wireless network pays attention to YOU!!!
  • a) Pulling the plug on a wireless network - inappropriate metaphor, doubt it was a pun, in light of literary skills - see below.

    b) Addressing the problem - means deal with it - I think banning wireless networks because they can be cracked is a way of addressing/dealing with the cracking problem, in the same way that changing your front door to a steel one 'addresses' the burglar-getting-through-glass-door problem.

    c) Aggressive but not thorough - how can you not be more thorough in fixing a problem then by completely removing the source of the problem? Wireless suffers from warwalking / wardriving problems. Remove wireless, remove the warwalking problems.

    Okay, you might not agree with me on the technical issues but I was adressing the problems that the submitter had with expressing himself. If you can't express yourself properly, then people will not listen to, consider or internalise what you're trying to tell them.
  • With Wireless LAN broadcasted by a accesspoint a intruder is by default root on your 802.11b network. Its like he logged on as root on your switch. the switch being the wireless LAN. Actually a wireless LAN is more like a HUB. And then start waiting for one of the trusted party's on it to spill a readable password or so.

    enough said.

  • mmm, entertaining! (Score:3, Funny)

    by trb ( 8509 ) on Thursday December 26, 2002 @07:50PM (#4963288)
    Tanabe said he found ...
    video clips of entertainment personalities, which an official later said were for personal use.
    I hereby submit my nomination for euphemism of the year.
  • This seems like overkill to me. Clearly these folks have been paying too much attention to those banner ads that say "DANGER: Your computer has an IP address - attackers could use this to locate your computer and hack it".

    Some explain to me again how 802.11b is so much more insecure than a wired, hubbed network? *hears silence* It's not. For 5 years I worked in an environment where we have a hubbed network. In case you don't know, that means any computer on the network can see all packets (assuming the viewer is in promiscuous mode). So what do you do? You use ssh to log in to machines. You use HTTPS for secure web data. You use Kerberos for POP3 authentication, or IMAP/SSL for IMAP authentication. You use PGP to encrypt any e-mail you're worried about. Everything else, you suck it up and deal. I don't really care that the guy down the hall knows I'm reading Slashdot.

    It's the same with wireless. You want to send sensitive data? Do it over HTTPS or an IPSec connection, or an SSH tunnel, or copy it using FTP over SSHv2, or Kerberos, or one of the numerous other methods for encrypting data. If you can't use one of these methods, then maybe you want to send your data in some other form (like, dead-tree form, or verbal form, or using semaphore signals, or something). But don't pretend that sending data in clear text over a wired network is somehow better than sending it over a wireless link. (Note: I'm discounting leased pairs/dedicated circuits, since those are prohibitively expensive.) If your data is readable by someone other than you, assume that someone other than you will read it. Assuming anything else is like walking into a bank and yelling "OK, Mr. Bank Teller, I'm going to give you my PIN number - everyone else, just don't listen, ok?"

    • heh your gf with her windows laptop wants to
      access something quickly on the network. there you go.
    • You use Kerberos for POP3 authentication,
      Tell me please how Kerberos, an authentication method, secures a network? If your kerb password is sent in plaintext, it can still be sniffed. Does using buzzwords increase your security too? Maybe we can HTML my WEP NET and FBI my LAX...
      • Tell me please how Kerberos, an authentication method, secures a network?

        Kerberos V5 can be used for both authentication AND encryption.

        If your kerb password is sent in plaintext, it can still be sniffed

        But it's not sent in plaintext. That's the whole point of Kerberos.

        • How do I send my kerb password from my machine to the host? Telnet? Plaintext. Ftp? Plaintext. HTTP? Plaintext...
          • How do I send my kerb password from my machine to the host? Telnet? Plaintext. Ftp? Plaintext. HTTP? Plaintext...

            Not really. Yes, your Kerb password could be compromised if you send it in the clear, but the whole point of Kerberos is that you shouldn't need to. Normally, what you do is get your tickets (using your password) on the local machine, and use those tickets to make secure connections (a trite explanation, but I'm not getting into TGTs here) to hosts using kerberized telnet and kerberized ftp. But no, there's nothing to stop you from typing your password in plaintext except your own brain.
            Yes, you are correct, there is no Kerberized HTTP (anymore), but, well, there's SSL and "it seems to work OK".

  • Securing a wireless network is by no means simple, but it can be done. What we did here is implement 802.1x PEAP(Protected Encrypted Authentication Protocol) and 10 second key rotations PER connection (128-bit of course). All of this security is just to get you into a DMZ network. The DMZ is firewalled off by a Pix. To get into the real network, you have to fire up a VPN connection through the firewall.

    It is up and running right now, using cisco and MS hardware and software. A similar solution could be done using cisco LEAP with slightly less security for the DMZ authentication servers.

    Unfortunately, a cross platform solution does not fully exist at his point. Windows has the best security at this point. Go figure. PEAP so far is only supported on windows. LEAP runs on quite a few platforms including linux and OS X.

    So please... stop posting uninformed slams on 802.11. Its all about knowledge and implimentation. Our wired network here is no where near as secure as out wireless one!
    • Arghh. It makes me want to scream when I see sentences like the last one: "Our wired network here is no where near as secure as out wireless one!".

      Do you have a spanning switch port on the outside of your building/office that anyone can sniff? Regardless of what you're doing now to encrypt the traffic, the fact is that it can all be captured and processed at a later time. This inherently makes it way more insecure, no matter how you've scrambled the data.

      Given enough time, horsepower and/or smart people (the best encryption schemes are destroyed mathematically, not by brute/distributed force) the codes can be broken. Say it takes 3-5 years. Well, where I work, we have information that has a 20 year life span. If some critical pieces are uncovered any time during that, it's game over.

      No matter what security you use, 802.11 will never be truly secure.

      (the really sad thing is that I blew the ability to mod because of this...there were some good posts too...sigh)

      • No, there are no routers other than the firewall. Period. It is called a DMZ. It is completely isolated.

        A ten second window is not sufficient to get even close to grabbing a 128bit key. The only choice is to try and figure out the key rotation. I put my faith in the fact that the key switching is reasonably random. That is my weakness, if you can call it that.

        Besides, Even if they broke the keys for the wireless network, the data is heavily encrypted through a VPN tunnel and IPsec. Access to the wireless network does not grant access to the wired network. Have fun cracking the VPN!

        The easiest way to get into our network over wireless is to steal a company laptop, and then try to hack a user password. We track the laptops religiously, and the users are not allowed to use their own passwords over wireless. If they want wireless, we issue them keys.

        Yes, it is more secure than our wired network.

        Is our network fully encrypted? NO.
        Does our wired network have port atentication? NO.
        Do we have to tunnel to our servers? NO.

        Anyone visiting our office can drop a dreamcast in the corner of the lobby, plug it into a network jack, and POOF! they're in. Easy as that. Even if you disable the network ports in the lobby, a visitor could do the same in any office, cube, of conf room.
    • Windows has the best secuirty my ass, vpn has already been cracked and rather easily. Try ssh tunneling and then you have something to deal with.
  • ...so much for hacking in and downloading archived La Blue Girl episodes.

  • In related news (Score:1, Funny)

    by Anonymous Coward
    Using password as your password not secure.
  • Yes how hard is it to type ssh -l . Wireless is only secure as the OS that you use with it. If you decide that you like to use windows, you and you alone are responsible for the insecurity.
  • No one else seems to have asked, so I'll give it a shot:

    Is anyone else a little slow to associate meteorological information with tough security? I mean, what are they doing over there if they're worried about their department of volcanic activity?

    Ironic that the "sensitive data" would be prove to be personnel records. As for minutes of meetings, again, I would like to know what top secret plans were discussed. Perhaps I'm paranoid, or I've seen too many of the 600 Godzilla movies.
  • This is the first numerical problem I ever did. It demonstrates the
    power of computers:

    Enter lots of data on calorie & nutritive content of foods. Instruct
    the thing to maximize a function describing nutritive content, with a
    minimum level of each component, for fixed caloric content. The
    results are that one should eat each day:

    1/2 chicken
    1 egg
    1 glass of skim milk
    27 heads of lettuce.
    -- Rev. Adrian Melott

    - this post brought to you by the Automated Last Post Generator...

Slashdot Top Deals

Understanding is always the understanding of a smaller problem in relation to a bigger problem. -- P.D. Ouspensky

Close