Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 05/07/07 issue

Cracks in the air

Justice security expert shows how easy it can be to defeat wireless security

By William Jackson, GCN Staff

Justice Department information technology security specialist Mischel Kwon gave a sobering assessment last week of some of the security risks in today’s environment of ubiquitous, promiscuous unwired communications.

“The days of no-wireless policies are gone,” Kwon said at the CIO Council’s quarterly IT forum in Washington. Wireless local-area networks are a fact, she said. Workers create ad hoc personal networks with Bluetooth devices, and radio frequency identification is mandated for passports and government IDs. And “with more use comes more hacking.”

Vulnerabilities in the 802.11 family of Wi-Fi standards are well-known: Rogue access points can make control difficult, signals are easy to detect, the Wired Equivalent Privacy standard is easy to crack and Wi-Fi Protected Access is vulnerable, if not equally easy to crack. But many users are less aware of the security holes that can be opened by Bluetooth-enabled devices ranging in size from handheld BlackBerrys to wireless-equipped cars.

“Why would you connect to a Bluetooth headset?” Kwon asked. “There’s no reason for it.”

And assurances from the State Department aside, she is no fan of the RFID chips in new passports. Physical and software protections incorporated into the documents are not adequate, she said. “If you have an e-passport, protect it” with additional shielding, she said. “If that is stolen, you are stolen.”

Kwon’s lectures, complete with hands-on demonstrations, have become popular with government audiences. She is enthusiastic about the give-and-take battle of wireless attack and defense, and she has something of an antenna fetish — although bigger is not always better in antennas, she said. Rob Del Gaizo, a computer science student at George Washington University, assisted with demonstrations of hacking techniques.

Cracking the WEP encryption scheme took only a few minutes after capturing relatively few packets. Breaking the Advanced Encryption Standard encryption used in WPA/2 is much more difficult, so Del Gaizo attacked the passphrase exchange during the connection process instead.

“All I need is a four-way handshake, and then I can walk away” to run a dictionary attack against it, he said.

“All of these can be subverted in some way,” Kwon said. But even with weaknesses, some security is better than none because it can discourage the casual hacker.

More news on related topics: Communications / Networks, IT Security, Mobile & Wireless



GCN Popup