Hack Proofing Your Wireless Network

by Syngress

• ISBN13: 9781928994596
• ISBN10: 1928994598
• Format: Paperback
• Copyright: 2002-04-21
• Publisher: Syngress Media Inc

Summary

The only way to stop a hacker is to think like one! Wireless technology is a new and rapidly growing field of concentration for network engineers and administrators. Innovative technology is now making the communication between computers a cordless affair. Wireless devices and networks are vulnerable to additional security risks because of their presence in the mobile environment. Hack Proofing Your Wireless Network is the only book written specifically for architects, engineers, and administrators responsible for securing their wireless networks. From making sense of the various acronyms (WAP, WEP, SSL, PKE, PKI, SSL, SSH, IPSEC) to the implementation of security policies, plans, and recovery protocols, this book will help users secure their wireless network before its security is compromised. The only way to stop a hacker is to think like one...this book details the multiple ways a hacker can attack a wireless network - and then provides users with the knowledge they need to prevent said attacks. Uses forensic-based analysis to give the reader an insight into the mind of a hacker With the growth of wireless networks architects, engineers and administrators will need this book Up to the minute Web based support at [e-mail]

Table of Contents

Foreword	xvii
The Wireless Challenge	1	(74)
Introduction	2	(1)
Wireless Technology Overview	2	(5)
Defining Cellular-based Wireless	3	(1)
Defining the Wireless LAN	3	(1)
The Convergence of Wireless Technologies	3	(1)
Trends and Statistics	4	(1)
Increasing Use of Information Appliances	5	(1)
The Future of Wireless, circa 2005	6	(1)
Understanding the Promise of Wireless	7	(9)
Wireless Networking	9	(1)
Wireless Networking Applications for Business	9	(5)
Wireless Networking Applications for Consumers	14	(2)
Understanding the Benefits of Wireless	16	(8)
Convenience	16	(1)
Flexibility	16	(2)
Roaming	18	(3)
Mobility	21	(1)
Affordability	22	(1)
Speed	22	(2)
Aesthetics	24	(1)
Productivity	24	(1)
Facing the Reality of Wireless Today	24	(14)
Standard Conflicts	25	(2)
Commercial Conflicts	27	(1)
Market Adoption Challenges	27	(1)
The Limitations of ``Radio''	27	(3)
Radio Range and Coverage	30	(1)
Use of Antennas	30	(1)
Interference and Coexistence	31	(1)
The Limitations of Wireless Security	32	(2)
Cellular-based Wireless Networks and WAP	34	(1)
Wireless LAN Networks and WEP	35	(3)
Examining the Wireless Standards	38	(30)
Cellular-based Wireless Networks	38	(1)
Communications Technologies	39	(7)
Wireless LAN Networks	46	(1)
802.11 WLAN	47	(7)
HomeRF	54	(3)
802.15 WPAN	57	(3)
802.16 WMAN	60	(2)
Understanding Public Key Infrastructures and Wireless Networking	62	(1)
Overview of Cryptography	63	(5)
Summary	68	(1)
Solutions Fast Track	69	(4)
Frequently Asked Questions	73	(2)
A Security Primer	75	(50)
Introduction	76	(1)
Understanding Security Fundamentals and Principles of Protection	76	(17)
Ensuring Confidentiality	77	(1)
Ensuring Integrity	78	(2)
Ensuring Availability	80	(1)
Ensuring Privacy	81	(1)
Ensuring Authentication	81	(4)
Ensuring Authorization	85	(2)
Ensuring Non-repudiation	87	(3)
Accounting and Audit Trails	90	(2)
Using Encryption	92	(1)
Encrypting Voice Data	92	(1)
Encrypting Data Systems	93	(1)
Reviewing the Role of Policy	93	(8)
Identifying Resources	96	(1)
Understanding Classification Criteria	97	(1)
Implementing Policy	98	(3)
Recognizing Accepted Security and Privacy Standards	101	(12)
Reviewing Security Standards	101	(1)
Early Security Standards	102	(2)
Understanding the Common Criteria Model	104	(1)
ISO 17799/BS 7799	104	(1)
ISO 7498-2	104	(1)
ISO 10164-8	104	(1)
ISO 13888	105	(1)
Reviewing Privacy Standards and Regulations	106	(1)
NAIC Model Act	106	(1)
Gramm-Leach-Bliley Act	106	(2)
HIPAA	108	(3)
Electronic Signatures in the Global and National Commerce Act	111	(1)
COPPA	112	(1)
Civil Liability Law	112	(1)
Addressing Common Risks and Threats	113	(6)
Experiencing Loss of Data	113	(1)
Loss of Data Scenario	113	(1)
Experiencing Denial and Disruption of Service	114	(1)
Disruption of Service Scenario	114	(1)
Eavesdropping	115	(2)
Eavesdropping Scenario	117	(1)
Preempting the Consequences of an Organization's Loss	117	(1)
Security Breach Scenario	118	(1)
Summary	119	(1)
Solutions Fast Track	120	(3)
Frequently Asked Questions	123	(2)
Wireless Network Architecture and Design	125	(76)
Introduction	126	(1)
Fixed Wireless Technologies	127	(14)
Multichannel Multipoint Distribution Service	127	(2)
Local Multipoint Distribution Services	129	(1)
Wireless Local Loop	129	(1)
Point-to-Point Microwave	130	(2)
Wireless Local Area Networks	132	(1)
Why the Need for a Wireless LAN Standard?	132	(2)
What Exactly Does the 802.11 Standard Define?	134	(3)
Does the 802.11 Standard Guarantee Compatibility across Different Vendors?	137	(1)
802.11b	138	(1)
802.11a	139	(1)
802.11e	140	(1)
Developing WLANs through the 802.11 Architecture	141	(9)
The Basic Service Set	141	(2)
The Extended Service Set	143	(1)
Services to the 802.11 Architecture	143	(2)
The CSMA-CA Mechanism	145	(1)
The RTS/CTS Mechanism	146	(1)
Acknowledging the Data	146	(1)
Configuring Fragmentation	147	(1)
Using Power Management Options	147	(1)
Multicell Roaming	147	(1)
Security in the WLAN	148	(2)
Developing WPANs through the 802.15 Architecture	150	(4)
Bluetooth	150	(3)
HomeRF	153	(1)
High Performance Radio LAN	153	(1)
Mobile Wireless Technologies	154	(6)
First Generation Technologies	155	(1)
Second Generation Technologies	156	(1)
2.5G Technology	156	(1)
Third Generation Technologies	156	(1)
Wireless Application Protocol	157	(1)
Global System for Mobile Communications	158	(2)
General Packet Radio Service	160	(1)
Short Message Service	160	(1)
Optical Wireless Technologies	160	(1)
Exploring the Design Process	161	(5)
Conducting the Preliminary Investigation	162	(1)
Performing Analysis of the Existing Environment	162	(1)
Creating a Preliminary Design	163	(1)
Finalizing the Detailed Design	164	(1)
Executing the Implementation	164	(1)
Capturing the Documentation	165	(1)
Creating the Design Methodology	166	(17)
Creating the Network Plan	166	(1)
Gathering the Requirements	167	(1)
Baselining the Existing Network	168	(1)
Analyzing the Competitive Practices	169	(1)
Beginning the Operations Planning	169	(1)
Performing a Gap Analysis	169	(1)
Creating a Technology Plan	170	(1)
Creating an Integration Plan	171	(1)
Beginning the Collocation Planning	171	(1)
Performing a Risk Analysis	171	(1)
Creating an Action Plan	172	(1)
Preparing the Planning Deliverables	172	(1)
Developing the Network Architecture	173	(1)
Reviewing and Validating the Planning Phase	173	(1)
Creating a High-Level Topology	173	(1)
Creating a Collocation Architecture	174	(1)
Defining the High-Level Services	174	(1)
Creating a High-Level Physical Design	175	(1)
Defining the Operations Services	175	(1)
Creating a High-Level Operating Model	175	(1)
Evaluating the Products	176	(1)
Creating an Action Plan	177	(1)
Creating the Network Architecture Deliverable	177	(1)
Formalizing the Detailed Design Phase	177	(1)
Reviewing and Validating the Network Architecture	178	(1)
Creating the Detailed Topology	178	(1)
Creating a Detailed Service Collocation Design	179	(1)
Creating the Detailed Services	179	(1)
Creating a Detailed Physical Design	180	(1)
Creating a Detailed Operations Design	181	(1)
Creating a Detailed Operating Model Design	181	(1)
Creating a Training Plan	182	(1)
Developing a Maintenance Plan	182	(1)
Developing an Implementation Plan	182	(1)
Creating the Detailed Design Documents	183	(1)
Understanding Wireless Network Attributes from a Design Perspective	183	(8)
Application Support	184	(2)
Subscriber Relationships	186	(1)
Physical Landscape	187	(2)
Network Topology	189	(2)
Summary	191	(2)
Solutions Fast Track	193	(5)
Frequently Asked Questions	198	(3)
Common Attacks and Vulnerabilities	201	(38)
Introduction	202	(1)
The Weaknesses in WEP	202	(11)
Criticisms of the Overall Design	203	(2)
Weaknesses in the Encryption Algorithm	205	(3)
Weaknesses in Key Management	208	(3)
Weaknesses in User Behavior	211	(2)
Conducting Reconnaissance	213	(3)
Finding a Target	213	(1)
Finding Weaknesses in a Target	214	(1)
Exploiting Those Weaknesses	215	(1)
Sniffing, Interception, and Eavesdropping	216	(4)
Defining Sniffing	216	(1)
Sample Sniffing Tools	217	(1)
Sniffing Case Scenario	217	(2)
Protecting Against Sniffing and Eavesdropping	219	(1)
Spoofing and Unauthorized Access	220	(3)
Defining Spoofing	220	(1)
Sample Spoofing Tools	221	(1)
Spoofing Case Scenario	221	(2)
Protecting Against Spoofing and Unauthorized Attacks	223	(1)
Network Hijacking and Modification	223	(3)
Defining Hijacking	223	(1)
Sample Hijacking Tools	224	(1)
Hijacking Case Scenario	225	(1)
Protection against Network Hijacking and Modification	225	(1)
Denial of Service and Flooding Attacks	226	(2)
Defining DoS and Flooding	226	(1)
Sample DoS Tools	227	(1)
DoS and Flooding Case Scenario	227	(1)
Protecting Against DoS and Flooding Attacks	228	(1)
The Introduction of Malware	228	(2)
Stealing User Devices	230	(2)
Summary	232	(1)
Solutions Fast Track	232	(5)
Frequently Asked Questions	237	(2)
Wireless Security Countermeasures	239	(60)
Introduction	240	(1)
Revisiting Policy	241	(4)
Addressing the Issues with Policy	243	(2)
Analyzing the Threat	245	(8)
Threat Equals Risk Plus Vulnerability	246	(7)
Designing and Deploying a Secure Network	253	(4)
Implementing WEP	257	(7)
Defining WEP	257	(1)
Creating Privacy with WEP	258	(1)
The WEP Authentication Process	259	(1)
WEP Benefits and Advantages	259	(1)
WEP Disadvantages	260	(1)
The Security Implications of Using WEP	260	(1)
Implementing WEP on the Aironet	261	(1)
Implementing WEP on the ORiNOCO AP-1000	262	(1)
Securing a WLAN with WEP: A Case Scenario	262	(2)
Filtering MACs	264	(7)
Defining MAC Filtering	265	(1)
MAC Benefits and Advantages	266	(1)
MAC Disadvantages	266	(1)
Security Implications of MAC Filtering	267	(1)
Implementing MAC Filters on the AP-1000	267	(2)
Implementing MAC Filters on the Aironet 340	269	(1)
Filtering MAC Addresses: A Case Scenario	270	(1)
Filtering Protocols	271	(2)
Defining Protocol Filters	271	(1)
Protocol Filter Benefits and Advantages	272	(1)
Protocol Filter Disadvantages	272	(1)
Security Implications of Using Protocol Filters	272	(1)
Using Closed Systems and Networks	273	(5)
Defining a Closed System	273	(1)
Closed System Benefits and Advantages	274	(1)
Closed System Disadvantages	275	(1)
Security Implications of Using a Closed System	275	(1)
A Closed Environment on a Cisco Aironet Series AP	275	(1)
A Closed Environment on an ORiNOCO AP-1000	275	(2)
Implementing a Closed System: A Case Scenario	277	(1)
Enabling WEP on the ORiNOCO Client	277	(1)
Allotting IPs	278	(3)
Defining IP Allocation on the WLAN	278	(1)
Deploying IP over the WLAN: Benefits and Advantages	279	(1)
Deploying IP over the WLAN: Disadvantages	279	(1)
Security Implications of Deploying IP over the WLAN	280	(1)
Deploying IP over the WLAN: A Case Scenario	280	(1)
Using VPNs	281	(6)
VPN Benefits and Advantages	283	(1)
VPN Disadvantages	284	(1)
Security Implications of Using a VPN	284	(1)
Layering Your Protection Using a VPN	285	(1)
Utilizing a VPN: A Case Scenario	286	(1)
Securing Users	287	(5)
End User Security Benefits and Advantages	290	(1)
End User Security Disadvantages	290	(1)
User Security: A Case Scenario	291	(1)
Summary	292	(1)
Solutions Fast Track	293	(3)
Frequently Asked Questions	296	(3)
Circumventing Security Measures	299	(28)
Introduction	300	(1)
Planning and Preparations	300	(3)
Finding a Target	301	(1)
Choosing the Tools and Equipment Required for Attack	301	(1)
Detecting an Open System	302	(1)
Detecting a Closed System	303	(1)
Exploiting WEP	303	(3)
Security of 64-bit versus 128-bit Keys	304	(1)
Acquiring a WEP Key	305	(1)
War Driving	306	(4)
What Threat Do These ``Open Networks'' Pose to Network Security?	307	(1)
What Tools Are Necessary to Perform a War Drive?	307	(1)
What Network Information Can I Discover from a War Drive?	308	(2)
Can War Driving Be Detected?	310	(1)
Stealing User Devices	310	(2)
What Are the Benefits of Device Theft?	311	(1)
MAC Filtering	312	(3)
What Is a MAC Address?	312	(1)
Where in the Authentication/Association Process Does MAC Filtering Occur?	313	(1)
Determining MAC Filtering Is Enabled	314	(1)
MAC Spoofing	314	(1)
Bypassing Advanced Security Mechanisms	315	(3)
Firewalls	316	(1)
Filtering by IP Address	316	(1)
Filtering by Port	317	(1)
What Happens Now?	317	(1)
Exploiting Insiders	318	(2)
What Is at Stake?	318	(1)
Social Engineering Targets	319	(1)
Installing Rogue Access Points	320	(2)
Where Is the Best Location for a Rogue AP?	320	(1)
Configuring the Rogue AP	321	(1)
Risks Created by a Rogue AP	321	(1)
Are Rogue APs Detectable?	321	(1)
Exploiting VPNs	322	(1)
Summary	323	(1)
Solutions Fast Track	323	(3)
Frequently Asked Questions	326	(1)
Monitoring and Intrusion Detection	327	(36)
Introduction	328	(1)
Designing for Detection	328	(3)
Starting with a Closed Network	329	(1)
Ruling Out Environmental Obstacles	330	(1)
Ruling Out Interference	331	(1)
Defensive Monitoring Considerations	331	(6)
Availability and Connectivity	332	(1)
Interference and Noise	332	(1)
Signal Strength	333	(1)
Detecting a Denial of Service	334	(1)
Monitoring for Performance	335	(1)
Knowing the Baseline	335	(1)
Monitoring Tools of the Trade	336	(1)
Intrusion Detection Strategies	337	(9)
Integrated Security Monitoring	338	(1)
Watching for Unauthorized Traffic and Protocols	339	(2)
Unauthorized MAC Addresses	341	(1)
Popular Monitoring Products	342	(1)
Signatures	343	(3)
Conducting Vulnerability Assessments	346	(2)
Incident Response and Handling	348	(5)
Policies and Procedures	350	(1)
Reactive Measures	350	(1)
Reporting	351	(1)
Cleanup	352	(1)
Prevention	352	(1)
Conducting Site Surveys for Rogue Access Points	353	(5)
The Rogue Placement	353	(1)
The Well-intentioned Employee	353	(1)
The Social Engineer	354	(1)
Tracking Rogue Access Points	355	(3)
Summary	358	(1)
Solutions Fast Track	359	(2)
Frequently Asked Questions	361	(2)
Auditing	363	(44)
Introduction	364	(1)
Designing and Planning a Successful Audit	364	(13)
Types of Audits	365	(1)
Assessing Risk	365	(2)
Measuring System Operation	367	(1)
Measuring System Compliance	368	(1)
Verify Change Management	368	(1)
Assessing Damage	368	(1)
When to Perform an Audit	369	(1)
At System Launch	370	(1)
Information On Schedule	370	(1)
Maintenance Window	370	(1)
Unplanned Emergency Audits	371	(1)
Auditing Activities	371	(1)
Audit Planning	372	(1)
Audit Information Gathering	372	(1)
Audit Information Analysis and Report Generation	372	(1)
Audit Report Presentation	373	(1)
Post-audit Review	373	(1)
Next Steps	373	(1)
Auditing Tools	374	(1)
Auditing Interview Tools	374	(1)
Technical Auditing Tools	375	(1)
Critical Auditing Success Factors	376	(1)
Defining Standards	377	(9)
Standards	378	(1)
Guidelines	378	(1)
Best Practices	378	(1)
Policies	378	(1)
Procedures	379	(1)
Auditing, Security Standards, and Best Practices	379	(3)
Corporate Security Policies	382	(2)
Auditing Charters and Irregularities	384	(1)
Sampling Irregularities	384	(1)
Biased Opinions	384	(1)
Fraud	385	(1)
Establishing the Audit Scope	385	(1)
Establishing the Documentation Process	386	(1)
Performing the Audit	386	(4)
Auditors and Technologists	386	(1)
Obtaining Support from IS/IT Departments	387	(1)
Senior Management Support	387	(1)
IS/IT Department Support	388	(1)
Gathering Data	388	(1)
Interviews	389	(1)
Document Review	389	(1)
Technical Review	390	(1)
Analyzing Audit Data	390	(2)
Matrix Analysis	391	(1)
Recommendations Reports	392	(1)
Generating Audit Reports	392	(10)
The Importance of Audit Report Quality	393	(1)
Writing the Audit Report	393	(1)
Executive Summary	394	(1)
Prioritized Recommendations	394	(1)
Main Body	394	(1)
Detailed Recommendations	395	(1)
Final Conclusions	396	(1)
Appendices	396	(1)
Glossary	396	(1)
Final Thoughts on Auditing	396	(1)
Sample Audit Reports	397	(1)
Sample Management Report: Wireless Network Security Audit Report XYZ Corporation	397	(1)
Sample Technical Report Wireless Network Security Audit Report: XYZ Corporation	398	(4)
Summary	402	(1)
Solutions Fast Track	403	(3)
Frequently Asked Questions	406	(1)
Case Scenarios	407	(32)
Introduction	408	(1)
Implementing a Non-secure Wireless Network	409	(1)
Implementing an Ultra-secure Wireless LAN	410	(8)
Physical Location and Access	411	(1)
Configuring the AP	412	(1)
Designing Securely	413	(4)
Securing by Policy	417	(1)
Taking a War Drive	418	(8)
Scouting Your Location	426	(3)
Installing in Difficult Situations	427	(2)
Developing a Wireless Security Checklist	429	(4)
Minimum Security	429	(1)
Moderate Security	430	(1)
Optimal Security	431	(2)
Summary	433	(1)
Solutions Fast Track	434	(2)
Frequently Asked Questions	436	(3)
Appendix: Hack Proofing Your Wireless Network Fast Track	439	(28)
Index	467