IBM Wireless Security Auditor

WSA is an IBM research prototype of an 802.11 wireless LAN security auditor, running under Linux on an iPAQ PDA. WSA automatically audits a wireless network for the proper security configuration to help network administrators close any vulnerabilities before hackers try to break in. Although there are other 802.11 network analyzers out there (wlandump, ethereal, Sniffer), these tools are aimed at protocol experts who want to capture wireless packets for detailed analysis. WSA is intended for the more general audience of network installers and administrators— those who want to easily and quickly verify the security configuration of their networks, without having to understand any of the details of the 802.11 protocols.

802.11 Security Issues

The current 802.11 standard defines two security protocols: shared key authentication was designed to provide secure access control, and WEP encryption was designed to provide confidentiality. (Some vendors also try to claim that the SSID and station MAC addresses provide secure access control. As the SSID and MAC addresses are transmitted in the clear, they really don't provide any meaningful security, and are easily bypassed.)

There are several security issues with these protocols. Most importantly, WEP and shared key are optional, and turned off by default in access points. If these protocols are not turned on in even one access point, it is trivial for hackers to connect to the network, using standard wireless cards and drivers. The 802.11 signal can travel surprisingly large distances from the access point, often a thousand feet or more, allowing hackers to connect from outside the building, such as from a parking lot, or from the street. If, as is often the case, the wireless network is connected directly to a corporate intranet, this gives hackers direct access to the intranet, bypassing any Internet boundary firewalls.

The problem of "open" access points is made more difficult because of the low cost and easy availability of access points, and the difficulty of detecting them. It is not uncommon to find individuals or groups within a company who have installed rogue access points without the knowledge of the normal networking group, and without properly configuring the access point(s). These rogue access points are often difficult to detect with normal network monitoring tools, as access points are normally configured as Layer 2 bridges.

In addition, the WEP and shared key protocols have been shown to have significant cryptographic errors that permit cryptographic attacks on both the confidentiality and access control functions. (For details, see the Wagner/Goldberg paper at http://www.isaac.cs.berkeley.edu/isaac/wep-faq.html, and the Arbaugh paper at http://www.cs.umd.edu/~waa/attack/v3dcmnt.htm). Note that while WEP and shared key are flawed, they should still be turned on, as attacks are much easier with them off.

Vendors and the IEEE are responding to the flawed protocols with fixes in several stages. In the short term, vendors are adding new authentication/key management protocols that provide secure authentication, and new WEP keys for each card, per session. In addition, in the near term, vendors are working on a tweak to WEP to make attacks more difficult, as well as a long-term complete fix.

From a management perspective, network administrators need a tool to verify that all access points are at the desired firmware revision so that they have the most current version of these 802.11 fixes.

802.11 Management Issues

A network administrator needs a convenient way to answer these questions:

• What access points are actually installed?

• Where are they?

• Are they properly configured?

• Do they have the latest firmware?

The wireless network needs to be checked periodically, as access points are easily added and modified, and as updates will be rolled out frequently. The wireless auditing tool needs to look at the actual wireless signals, as the needed information might not be available from the wired side. To monitor the wireless data, the auditor needs to be small and lightweight so it can be easily carried around a site to ensure complete analysis and review.

What Does WSA Do?

Most importantly, we wanted WSA to be easy to use, and to require absolutely no knowledge of the 802.11 protocols. WSA is not a packet dump/analyzer. Rather it does all the necessary packet monitoring and analysis, and provides the user with just the answers to the important management questions. The results are color-coded (green is good, red is bad) for rapid and easy understanding.

WSA features the following functionalities and features:

• Tracks beacon packets to find all access points

• Determines SSID and AP names

• Tracks probe packets and the probe responses

• Tracks data packets

• Determines link encryption method

• Tracks authentication packets

• Determines authentication method

• Tracks clients

• Determines firmware versions by fingerprinting the access point's detailed behavior

Components

WSA currently runs under Linux, on either a notebook or an iPAQ PDA. We currently support the Cisco/Aironet PCMCIA 802.11 cards, either the old Prism I-based cards or the current Prism II-based cards. On the iPAQ, we are using the Familiar Linux distribution with the fltk library, and on thinkpads, we are using RedHat 7.1.

Status

WSA is a research prototype, and no definite decision has been made whether to make it a full product or to release it as open source. (The necessary "airo" driver module modifications have already been open-sourced.)