1. Risks of Wireless Access Points
Brian Moeller, CISSP
11/28/2018
The Ohio State University Network Security Group

2. What is a wireless access point?
A device that uses a radio to allow access to a network
11/28/2018
The Ohio State University Network Security Group

3. The Ohio State University Network Security Group
Apple Airport
11/28/2018
The Ohio State University Network Security Group

4. Apple Airport “in the wild”
11/28/2018
The Ohio State University Network Security Group

5. Cisco Wireless Access Point
11/28/2018
The Ohio State University Network Security Group

6. Cisco Wireless Access Point – Front View
11/28/2018
The Ohio State University Network Security Group

7. The Ohio State University Network Security Group
Linksys
11/28/2018
The Ohio State University Network Security Group

8. The Ohio State University Network Security Group
Netgear
11/28/2018
The Ohio State University Network Security Group

9. Apple Powerbook Laptop
11/28/2018
The Ohio State University Network Security Group

10. The Ohio State University Network Security Group
Why scan for wireless?
Inventory Access Points and get a rough idea of how they’re secured
Plot their locations
Experiment with new wireless “Scanning” software
11/28/2018
The Ohio State University Network Security Group

11. The Ohio State University Network Security Group
Why scan for wireless?
Get an idea of how wireless is being used on Campus
Prove/disprove that wireless implementations are secure or not secure
Demonstrate scanning technology and methods
11/28/2018
The Ohio State University Network Security Group

12. The Ohio State University Network Security Group
The Scanning process
Laptop
Wireless card (Orinoco/Lucent Silver, in this scan)
Small external antenna
Golf Cart
Map of Campus
11/28/2018
The Ohio State University Network Security Group

13. The Ohio State University Network Security Group
The Scanning process
Added GPS
GPS gives location data via satellite triangulation
Accuracy usually around 15ft.
11/28/2018
The Ohio State University Network Security Group

14. The Ohio State University Network Security Group
The Scanning Process
11/28/2018
The Ohio State University Network Security Group

15. The Ohio State University Network Security Group
The Scanning Process
11/28/2018
The Ohio State University Network Security Group

16. The Ohio State University Network Security Group
The Scanning Process
11/28/2018
The Ohio State University Network Security Group

17. The Ohio State University Network Security Group
The Scanning Process
How the scan works
Software looks for SSID (Service Set Identifier) broadcasts
Polls access point for configuration, names, and any other information it’s willing to share
Does *NOT* request IP address
11/28/2018
The Ohio State University Network Security Group

18. The Ohio State University Network Security Group
So, make your point
Wireless common around Campus
Good system administration practice is questionable
Many appear to be merely unpacked, and plugged in
Most not running authentication or encryption
11/28/2018
The Ohio State University Network Security Group

19. Campus Wireless Scan Results
Total of 122 Wireless Access Points found
45 encrypted (WEP)
77 Not Encypted
11/28/2018
The Ohio State University Network Security Group

20. Campus Wireless Scan Results
35 Access Points appear to have factory default settings
11/28/2018
The Ohio State University Network Security Group

21. The Ohio State University Network Security Group
11/28/2018
The Ohio State University Network Security Group

22. The Ohio State University Network Security Group
Conclusion
Many wireless access points on campus
Channel contention may be an issue
No standardized configuration
11/28/2018
The Ohio State University Network Security Group

23. The Ohio State University Network Security Group
Conclusion
Security issues
Authentication
Authorization
Accountability
Integrity
Confidentiality
11/28/2018
The Ohio State University Network Security Group

24. The Ohio State University Network Security Group
Policy Discussion
Ownership of Wireless Frequencies and channels on campus
Centralized Management of Wireless Frequencies and Channels
Authority to assign channels, and approval of frequency/channel usage.
11/28/2018
The Ohio State University Network Security Group

25. The Ohio State University Network Security Group
Policy Discussion
Ownership of Wireless Frequencies and channels on campus
Authority to define which wireless technologies will be authorized for use on campus
11/28/2018
The Ohio State University Network Security Group

26. The Ohio State University Network Security Group
Policy Discussion
Requirement for wireless encryption
Proposed policy outlines requirement for *AT LEAST* WEP, and strongly recommends usage of VPN technology (but does not require VPN)
11/28/2018
The Ohio State University Network Security Group

27. The Ohio State University Network Security Group
Policy Discussion
Requirement for MAC address registration and filtering
11/28/2018
The Ohio State University Network Security Group

28. The Ohio State University Network Security Group
Policy Discussion
Requirement for authentication for all users who use the network (includes wireless)
11/28/2018
The Ohio State University Network Security Group

29. The Ohio State University Network Security Group
Policy Discussion
Network Addressing
Requirement for using campus-assigned network addresses – and specifically disallowing NAT or private addressing.
11/28/2018
The Ohio State University Network Security Group

30. The Ohio State University Network Security Group
Policy Discussion
Wireless Base Station Naming
Campus-wide standardization of access point names, and registration in DNS.
Requirement for contact information for all access points.
11/28/2018
The Ohio State University Network Security Group

31. The Ohio State University Network Security Group
Policy Discussion
Wireless Base Station Naming
Campus-wide standardization of access point names, and registration in DNS.
Requirement for contact information for all access points.
11/28/2018
The Ohio State University Network Security Group

32. The Ohio State University Network Security Group
Policy Discussion
Logging Policy
All wireless access points must employ a logging scheme that logs the IP address and user authentication information (including username, login/logout times and dates) for at least 30 days.
11/28/2018
The Ohio State University Network Security Group

33. The Ohio State University Network Security Group
Policy Discussion
Protection of the wireless and network devices
Configuration must protect wireless access point configuration (i.e. by disabling or changing SNMP settings)
Password protection of all configuration methods
11/28/2018
The Ohio State University Network Security Group