Author Archive

« Older Entries

WLAN Strategy – Segmented and Guest Networks

Thursday, August 26th, 2010

Continuing my small series on WLAN deployment strategy, now I’ll cover the two more uses for wireless networks in a business.

Segmented Mobile Data

Segmented Mobile Data networks can be found in retail environments for mobile point of sale, hospitals for critical bedside services, warehouses for inventory and logistics, or many other types of environments.  The main idea behind the use of a segmented mobile data network remains to isolate critical data; or to isolate weaker security technologies from the rest of the wireless network.  Regardless of the reasoning, the goal is the same: keep these networks separated from everyone else.  The most critical design decision, therefore, needs to be on the backend – deciding how exactly to segment these networks off.

Professional grade wireless infrastructure like the Cisco 5500 or Motorola RFS7000 is capable of two completely separated WLANs using the same equipment, which is a commonly used technique in such a design.  The infrastructure has an internal firewall that is used to prevent traffic from crossing between the two networks, and can use VLAN tagging to carry back to the main network using a shared WAN connection, or can use two entirely separate WAN connections.  Either way, the infrastructure is functioning as the separation device.  This also generally needs to be backed up with a firewall on the wired infrastructure side, restricting the data flows from the segmented WLAN into the enterprise.

Another alternative is to use two entirely separate pieces of hardware, with two separate physical connections back to the enterprise.  Depending on the needs of your organization, this may be required; if two physically separated wired LANs are deployed, bridging them with a WLAN device may not align with the networking vision.

The type of protection necessary for the the segmented data network again comes down to the technology available.  For data subject to technical compliance concerns, such as PCI-DSS or HIPAA, the stronger the better.  At minimum, WPA2-AES with pre-shared keys can suffice, although a certificate-based authentication solution is always preferable from a strict data security perspective.

If the network is being segmented due to equipment that cannot support strong encryption and authentication technologies, use the strongest available.  Unfortunately, many types of legacy equipment used in warehouses today cannot support WPA2-AES, or even WPA-TKIP – some may be stuck using WEP!  The weaker the level of protection, the more careful your segmentation on backend should be.

Guest Internet Access

Guest internet access generally is provided by a “hotspot”.  Users connect to an unencrypted network, and are sent to a captive portal page, where they can either login with pre-assigned credentials, or accept a terms of service and proceed without any credentials necessary.  Either way, authentication on such a network is accomplished only at the application-level, and there is no data protection provided by the WLAN itself.  As such, these networks should be treated as untrusted and kept firmly segmented from the enterprise, using the techniques described above.

A popular alternative deployment method for hotspot guest wireless networks is to use an entirely separate physical network for guests.  This can dramatically increase the infrastructure costs, but it accomplishes pure segmentation.  A typical use case for this type of physical segmentation would be a cafe or retail environment that wants to provide guests internet access, but doesn’t want to expose any of their business network.  Purchase a separate internet backhaul and configure a Wireless LAN dedicated to this network only.

If your business is subject to compliance regulations, such as PCI, I would strongly recommend using a physically segmented network for guest access.  While this increases capital expenses, it makes scoping activities related to compliance dramatically simpler.  When dealing with auditors, it is always advisable to have clear-cut boundaries around your critical data, and physically isolating any guest network is an easy way to do so.

Summary

Both of these network types rely on the network administrator segmenting the WLAN from the rest of the network.  It’s temping to plug an access point into an unmanaged switch and have the wireless “just work”, but this can open the network to many avenues of attack.  Assume the worse case at the beginning – that your WLAN is compromised – and design its place in the overall enterprise network to minimize the damage that an attacker could do from there.

Tags: , ,
Posted in How-to, Network Design | No Comments »

WLAN Enterprise Mobility Strategy

Friday, July 23rd, 2010

Continuing my series on deployment strategies for enterprise WLAN, today I’m covering the most common type of WLAN deployment – extending the enterprise to mobile users.

Basic Enterprise Mobility – Strategy

Extending the enterprise’s wired LAN to wireless is one of the more straightforward tasks from a network design perspective, but the authentication piece for the Wireless LAN needs to be strictly controlled.  Fortunately, wireless can benefit from the widespread deployment of another technology in the enterprise world – centralized authentication servers.

Many enterprise environments utilize a centralized authentication system to manage their user accounts, with Microsoft Active Directory being one of the most common.  This system can also be leveraged to provide authentication to the Wireless LAN.  Active Directory can serve as an 802.1X authenticator, allowing the wireless network to use EAP technology to authenticate users.  The two EAP methods most worthy of consideration in a WLAN environment are EAP-TLS, and PEAP.

EAP-TLS provides full mutual authentication, using a public key infrastructure to create and manage certificates for both client devices and the authenticating server.  In practice, it will allow users to seamlessly authenticate to the wireless network, because the certificate exchange occurs behind the scenes.  In an Active Directory environment, the certificates used in authentication can be deployed remotely by the Domain Controllers.  This works especially well with laptop users, but can be a challenge with mobile devices that do not have a wired connection to the network.  Certificates can be pushed to mobile devices in several ways, such as by use of a dedicated management WLAN or physical installation via memory cards or barcode scanning, but in a large environment with many mobile devices, it may be wise to look into alternatives.

Fortunately, a worthy alternative to EAP-TLS exists with PEAP authentication.  PEAP provides for similar levels of security to EAP-TLS, but does not rely on client certificates to authenticate devices to the network.  Instead, PEAP uses a more traditional username & password combination.  These credentials can be integrated with an Active Directory environment, allowing administrators granular control over what users get access to the WLAN.  PEAP also mitigates the potentially expensive maintenance cost of managing certificates on mobile devices.

EAP-TLS and PEAP, combined with WPA2-AES, provide the strongest authentication and encryption solutions available in WLAN, and as such should be used to protect any critical data traveling over the network.  While integration with Active Directory is not mandatory, because many organizations have such an environment already deployed, extending its use to cover WLAN authentication is an attractive option.  If your organization does not have a centralized authentication system in place already, the deployment of a WLAN can be a strong motivation to do so.  Several free alternatives to Active Directory also exist, such as FreeRADIUS.  Some enterprise-grade WLAN infrastructure also provides the ability to generate and manage certificates using an internal server hosted on the access point.  Given the easy integration with common authentication systems, and the availability of free alternatives, there really is no reason not to deploy a centralized authentication solution to secure your enterprise WLAN.

Pre-Shared Keys – also known as “Personal” authentication – are generally not appropriate for enterprise environments.  WPA2-AES using pre-shared keys does not have any documented vulnerabilities, but any PSK solution relies on sharing authentication credentials between multiple users and devices.  This can affect the integrity of the network, and doesn’t provide any traceability to activities of users on the network.  It should be avoided in a mission-critical environment.

Tags: , ,
Posted in Network Design | No Comments »

WLAN In the Enterprise – Use Cases and Strategies

Wednesday, July 21st, 2010

Continuing from my first post in the series, today I hope to cover the common use cases and general strategies for securing an enterprise WLAN.

Depending on the size and business needs of the enterprise, a WLAN can be used in a few different ways:

Basic Mobility – the most common use of WLAN is simply to extend the existing wired LAN to wireless users.  This can have a very positive impact on productivity, allowing users more flexibility throughout the workspace.

Segmented Mobile Data - this type of WLAN is one where the network is dedicated to use of a specific type of data that is segmented from the main enterprise network.  Typical use cases here are in hospitals or retail stores, where compliance regulations provide strict guidance on data protection and segmentation.

Guest Internet Access – common in cafes and large businesses, this type of WLAN typically provides only internet access and is entirely segmented from the enterprise wired LAN.

Wired LAN Replacement - this type of network is becoming a feasible alternative to the hassle of running cable, and will likely continue to grow in popularity as time goes by

These use cases can blend together in any number of ways.  A well thought-out design at the beginning, along with the right hardware planning, can accomidate these uses and even more.

General Strategy

Like other networking strategies, the use of proper segmentation at the Layer 2 level is critical when designing a WLAN.  Your most critical data flows should have their own segment, protected by methods like VLAN segmentation, firewalling, private IP spaces, and routing tables.  Regardless of the authentication and encryption method used for the WLAN itself, properly designing its location within the enterprise wired LAN is critical.

Data encryption in 802.11 is accomplished by a combination of the authentication type with an underlying encryption method.  Use of WPA2-AES encryption should be considered mandatory in any new WLAN deployment.  This encryption technology has no documented vulnerabilities and widespread hardware and software support.  If your enterprise has devices that do not support WPA2-AES, strongly consider replacing them.  When designing a network, its security should not be determined by the weakest link.  Unless there is a business case for doing something otherwise, use the strongest encryption and authentication methods available.

My next post will get into some specifics about these different use cases!

Tags: , ,
Posted in Network Design, Securism | No Comments »

Deploying A World-Class WLAN in Your Enterprise

Friday, July 16th, 2010

In the last decade, 802.11 Wireless LAN technology has had a dramatic impact on the technology world.  Reliable, high-bandwidth networking is now easily available to anybody who wants it, and the number of WiFi enabled devices continues to grow at a dramatic rate.  So naturally, businesses ranging from basic office environments, to complicated co-located warehousing/retail/office operations have begun leveraging the technology as well.  Unfortunately, the ease of setup that WLAN offers has led to some confusion among even seasoned IT practitioners.  In this series of  posts, I hope to provide some simple guidance to help clarify how to securely and efficiently manage an enterprise Wireless LAN.

Some History

I will not go into the history of the 802.11 standard in too much detail here, although there are a couple of important points to recognize when thinking about how to deploy a WLAN in your business.  The most important thing to know is this – many of the WLAN security technologies that were being used in deployment until three or four years ago are vulnerable to several well-known attacks.  If your business has a WLAN that has “just been working” for a while – it should probably get some attention.

To elaborate on this a bit further, the most common Wireless LAN encryption method used until late 2003, WEP, has been subject to some very public weaknesses, almost since its inception.  Its temporary replacement, WPA-TKIP, has similar (although not as dramatic) weaknesses, that have been public since at least 2008.

Adding insult to these platform-common weaknesses, some of the alternate, “more secure” based authentication methods advised by vendors have also been picked apart and had their vulnerabilities shown to the world.  I’m looking at you, LEAP.

To sum it up briefly – many networks that people thought were secure in 2003 or 2004 are definitely not secure today.  And unfortunately, WLAN sometimes is treated like a part of the physical infrastructure – if it ain’t broke, don’t fix it!

Current Tech

Fortunately, 802.11 is really starting to come into its own lately, and can be an extremely secure – in some ways more secure – piece of critical infrastructure.  The extremely solid (and so far unbroken) WPA2-AES encryption standard defined by 802.11i has had widespread vendor support since 2007.  And certificate-based authentication methods such as EAP-TLS, PEAP, and EAP-TTLS have similarly experienced a growth in support, among not just desktop OS platforms, but mobile operating systems as well.  And Wireless Intrusion Detection Systems are hitting their stride, ranging from several robust and effective professional solutions from vendors like AirTight, Cisco, and Motorola, to fantastic open-source applications like Kismet.  And robust infrastructure management software is now making the administration of Wireless LANs more simple and effective.

In short, today it is possible to deploy a WLAN that will meet all the use cases an enterprise can throw at it, and that is as secure as a typical wired LAN infrastructure.

In the next post, I’ll cover typical enterprise WLAN use cases, and the strategies for designing and securing them.

Tags: , ,
Posted in Network Design, Securism | 1 Comment »

Pivot Mercilessly!

Wednesday, March 17th, 2010

I just returned from a great trip to SANS 2010, in Orlando, where I was taking SEC 560 – Penetration Testing.  Our instructor, Ed Skoudis (an amazing guy, by the way), repeatedly hammered into our brains the mantra “Pivot Mercilessly!”

This concept is something that a penetration tester or vulnerability assessor needs to always keep in mind – look for the easy toehold into a system, and then see where you can go from there.  “Pivot” throughout the environment using the weak link as a starting point.

I was performing an assessment recently on a Solaris system that demonstrated this concept very effectively.  One of the boxes was vulnerable to a relatively old telnet vulnerability , which we exploited with pleasure – granting us root access to the machine.  From there, we examined the trust relationships inside the network and noticed that this box had “r service” trust relationships set up with many other machines in the network.  So, we used rsh to connect to numerous other boxes, all with root level access, and from those boxes to others… quickly we had the entire system PWNED.

All of this was made possible by a single box with one weak spot.  This is likely the case with most systems out there – maybe you’ll have one or two boxes vulnerable to exploits, especially in a well-managed corporate network.  From there, it’s up to you to pivot your way through the rest of the system!

Tags: , ,
Posted in Attacks, methods | No Comments »

SANS 2010

Thursday, February 25th, 2010

If any readers out there are interested in meeting up, all three of us will be attending the SANS 2010 training conference in Orlando, Florida the week of March 7th.

Feel free to drop us a line here and we can have a beer!

Tags: ,
Posted in Securism | No Comments »

Information Leakage via Delicious

Friday, July 10th, 2009

By now, the concept of “google hacking” is pretty commonly understood.  People may not be preventing it very well, but it’s moved beyond a new thing.

For the uninitiated, though, here’s a brief summary: using Google (or any other search engine – but really, is there any other?) to find vulnerable web apps, personal information, mp3s in public directories, etc etc.  It’s great fun, and a pretty fundamental initial step of profiling an attack target.

Johnny Long was one of the main evangelists of this method and has a great database of search terms.  It’s no longer actively maintained, but you can still find plenty of good information with this as a starting point!

So Google hacking is great, but it only gets you to the public internet.  What if I wanted to profile the inside of a company, from the outside?  And passively – without hitting their servers myself?  Wouldn’t it be great if I could look for public information shared by company insiders?

Delicious seems almost perfectly designed to do this kind of activity.  For the unfamiliar, delicious is an online bookmarking site, designed around the idea that sharing bookmarks is a great way to learn about new sites.  Which is an alright idea…  but don’t people also bookmark a lot of private information?  I sure do!

Making matters worse, delicious encourages users to get started by uploading their browser bookmarks.  Essentially uploading gobs of potentially personal data to a public site.  This is a classic case of information leakage.  A dedicated attacker can use this public information to get all sorts of juicy tidbits about a company.

Let’s do some examples.  This all works great in theory, but, like Google, there is a LOT of data to sort through.  Say I’m a bad guy interested in insider information about a company.  I can start looking for the basics – say… “intranet”.  Delicious makes this easier by encouraging users to tag their posts for easy categorization:

http://delicious.com/tag/intranet

So that gives me everything that users have tagged with ‘intranet’.   Lots of sites about intranet design, usability, etc.  But also sites tagged by users to manage their own bookmarks!  So I’ll start digging into an individual company… how about AMD?

http://delicious.com/search?p=amd&u=&chk=&context=recent&tag=intranet

intranet_amd

The first result doesn’t look interesting, but the second and third, well those sound like intranet sites!  This is confirmed by trying to follow them through and the DNS not resolving.  Nice!  Now let’s see what else this presumed AMD employee has bookmarked…

links_1

Wow, lots of development related links!  Interesting.  And what’s that link on page 2 about “AMD Manager Toolkit” ??  This fellow looks like he’s a technical manager at AMD!

Dig a little deeper, and it looks like we have another intranet site – mentioning the (presumably internal) code name of a project.  Interesting!  Go further into the links, and you see even further links to internal project Wiki pages.

links_2

Surfing around to a few of the non-intranet sites gives me an even better profile of this person.  They work with unit testing.  They use UML, C++, and Ruby, and read a lot about circuit design.  They live in India.  They’re learning guitar, and are interested in martial arts.

This may seem like innocent information to an outsider, but if I was doing this for espionage purposes, I just learned a lot about the internal operations of a project – and this is with 10 minutes of work on one webpage.  What else could I find if I dug through the internet further?

Web 2.0 is a lot of fun, and can be really useful.  But what’s often overlooked are the implications of sharing all this information.  Unless you make it a point to protect your privacy, that privacy probably doesn’t exist.  And for businesses, this can be a major potential risk.

Delicious certainly doesn’t help stop this – according to the FAQ, you cannot make your links private by default, but instead must manually edit them to make them private.  And also, the TOS leaves responsibility entirely in the hands of the users.  Very laissez-faire!

Should companies ban employees from using sites like delicious?  Probably not.  But I think that this demonstrates that employees need to be more educated on what they are exposing themselves and their employer to when using social networking sites.

Tags: , , , ,
Posted in Attacks, How-to | 3 Comments »

No WPA2 With Windows Wireless Zero Config??

Monday, June 8th, 2009

Wow – I would never have thought that in this day and age, a major vendor like Microsoft wouldn’t fully implement a spec.  However, in the case of WPA2 it looks like that they did exactly that – at least until 2005.

BUT making things more interesting- this was an “optional” update with XP SP2, until it was finally rolled into XP SP3.  There is a hotfix for XP SP2 machines in order to support WPA2 – KB 893357.

WPA2/AES didnt’ really become widely implemented until 2006, but it was in the 802.11i spec that introduced WPA in 2004.  For a major vendor like MS to not implement it is pretty crazy.  But then again I, as a wireless security professional, didn’t setup a WPA2/AES network in my home until last month.  So maybe they were onto something.

Anyways, if you’re using XPSP2 and a WPA2 network – you need the hotfix, or XPSP3+.  Good luck out there!  I really recommend moving to WPA2/AES, especially considering the improvements in the Nvidia CUDA drivers that are allowing TKIP to be broken in an increasingly short amount of time.

Tags: , , , , ,
Posted in Fundamentals, How-to | No Comments »

Where Have We Been?

Wednesday, April 15th, 2009

Wow, it’s been over a month without much action here at Securism.  But it’s not for lack of stuff to talk about – precisely the opposite, we’ve all been so incredibly busy that this little blog has fallen by the wayside.  But I promise that we’ll get right back up at it!  In the meantime, here’s what we’ve all been doing.

Ben and I both attended the SANS 2009 conference in early March, in Orlando.  He was in the advanced penetration testing class, and I was taking the wireless security class.  Verdict on both of those: AWESOME.

Walter also went to a SANS conference in Phoenix to attend a class on secure network design.

I also just finished the EC-Council Certified Ethical Hacker program, which is a good overview certification class.  Don’t underestimate that exam – it’s a tricky one!

Beyond the gobs of training, we’ve also been working on some great stuff at work, getting well up to our necks in the world of PCI.

So, dear readers, don’t fret.  We’re still here, and will be back shortly!

Tags:
Posted in Securism | 1 Comment »

Putting Together a Wireless Security Toolkit for the Android OS

Wednesday, February 25th, 2009

I’ve had the first commercially available Android mobile phone, the T-Mobile G1, since the platform launched last fall, and have been really happy with it so far.  As the platform is getting more mature, we are now starting to see a lot of new and useful applications out there – especially some useful for security!  Here’s a quick rundown of some of the tools that I’ve found and am using:

WifiScan – a great wireless discovery application for the platform.  It’s a powerful wireless audit tool that will log all of the discovered networks in range, and plot them to a KML file for visualization in Google Earth.  This application records information such as BSSID, Channel, Security Type, SSID, etc.  Tremendously useful for a discrete wireless network audit!

PortScandroid – a very basic port scanning application for the platform.  It’s not terribly useful for use over the cellular data network due to the filtering applied by T-Mobile, but when using 802.11, it gets the job done.  Doesn’t do any correlation of services to ports, but it performs the basic functions.

ConnectBot – this is a full-functioned SSH client for the platform.  Handy.

androidVNC – a VNC viewer for the Android platform that’s been forked from the tightVNC viewer development project.  Also a handy tool.  This is still in the beta phases and hasn’t been added to the Market yet, but it’s downloadable from the project page.  Easiest way to install it is to navigate to the project page within the phone’s browser and just download the APK package.

I am going to conduct a WarDriving contest between my little Android and a full-fledged laptop running Kismet and an external Wifi antenna to see how the signal discovery compares, but initial tests show the G1 to have a pretty remarkable Wifi range.  I’ll post a followup after I conduct the test.

The Android platform is showing a lot of promise, and for use on a pen-test, these tools could prove to be useful additions to your arsenal – and are certainly more discrete than using a laptop with a big ol’ antenna!

Thanks syn for inspiring me to investigate this – his post about the iPhone wireless toolkit made me wish we had these tools on the Android, and lo-and-behold – we do!

Tags: , , ,
Posted in mobile | No Comments »

« Older Entries