An Analysis of Wireless Security at U of M Dearborn: Found Problems - - PowerPoint PPT Presentation

An Analysis of Wireless Security at U of M Dearborn:

Found Problems and Proposed Solutions

(CASL Only)

Summary

• Basic Networking Concepts
• Description of vulnerabilities
• Demonstration
• Possible solutions

Networking Addresses

3 types of addresses

• DNS address, ex. www.aol.com
• IP address, ex 64.12.89.242
• MAC address, ex. 00:05:2E:8D:C7:B2

Translating Network Addresses

• DNS  IP  MAC
• www.aol.com  64.12.89.242 00:05:2E:8D:C7:B2

Port Explanation

All incoming and

• utgoing data is

filtered through ports in the router Imagine toll booth lanes on a highway

Port 1 2 3 4 … …

Vulnerability #1 : Non-filtered

• utgoing traffic on port 53
• Should allow outgoing DNS information
• Should not allow all outgoing information
• Allows complete bypass of firewall by

anyone

Unfiltered Port

Port 51 52 54 55 56

53

HTTP SSH FTP Telnet etc…

Attacker

Solution

• Reconfigure firewall
• Only allow outgoing DNS on port 53

Vulnerability #2: Firewall only uses MAC address to determine identity

• MAC addresses are publicly broadcasted
• MAC addresses are easily changed, or

spoofed

• Spoofing = impersonating, forging, etc…

Solutions

• Many appoaches
• Need earlier authentication
• Wireless encryption

Vulnerability #3: Client and server MAC tables changable

• Reroutes traffic
• Allows for more advanced attacks like

recording sessions encrypted by SSH or HTTPS

ARP Poisoning

Client

141.215.4.97

MAC IP

00:2F:CD:8E:9A 141.215.4.1 ….. ….. ….. …..

Firewall

141.215.4.1

MAC IP 00:2F:CD:8E:9A 141.215.4.97

….. ….. ….. …..

Attacker

Solution

• Many approaches
• Need earlier authentication
• Wireless encryption

Vulnerability # 4: Rogue Access Points

• BYO-AP!
• Tricks people into connecting to your AP
• Get to client before the firewall does

Rogue Access Point

Client School Router Rogue Access Point

Sure, why not? “I’m the school router. Connect to my stronger signal.”

Solution

• Wireless Encryption
• Wireless Intrusion Detection System or

WIDS

Wireless Networks

• No physical security like wired networks
• Accessible from far away
• Multiplies dangers of vulnerabilities

High Power Antenna

Scope of Project

• Only a month long
• Wireless network not completely evaluated
• More problems then we can present

Conclusion

• A lot of changes needed
• Little work to make changes
• Until then, assume all traffic is being

watched

Q and A