explain how the flaw worked. Just said that the Uni in question had been in discussions with WiFi mfgs who had as much as admitted nothing could be done to prevent the flaw.

Doug M

#2
Go this more detailed write up just now as a news mag item
[link|http://www.mcpressonline.com/mc/.6aeaa825!more=1#more|http://www.mcpresson...aa825!more=1#more]

FULL EXTRACT >>>>
Wi-Fi Security Flaw Found
by Thomas M. Stockwell

A new warning cautions against using IEEE 802.11.

Published May 2004

On May 13, 2004, the Australian Computer Emergency Response Team (AusCERT) issued a severe warning about the security of the wireless local area networks (
WLANs), the very devices that are rapidly growing in public and private popularity. The warning is specifically aimed at devices that use IEEE standard 802.11 wireless protocol extensions, and AusCERT says that the flaw is "fundamental" to elements within the communications protocol itself.

IEEE 802.11--also known as Wi-Fi--is the communications protocol that is driving the sudden popularity of wireless routers, wireless network interface cards, and a slew of consumer communication devices. The 802.11 protocol is used pervasively in both industry and home devices to connect devices like laptops, desktops, and PDAs, enabling them to network "untethered" to the Internet.

DoS Vulnerability
AusCERT discovered that Wi-Fi is a natural target for a Denial of Service (DoS) attack. According to the report, IEEE 802.11 can be easily disrupted using an inexpensive PDA with a WLAN card. Furthermore, detecting the location of the attacker can be difficult. This vulnerability makes a WLAN composed of 802.11 devices inappropriate for many public infrastructures and extremely unsuitable where high availability of the network is a requirement.

Basic Wi-Fi Protocol Flaw
Wi-Fi's vulnerability is related to the medium access control (MAC) function of the IEEE 802.11 protocol itself.

802.11 networking devices perform a protocol routine called Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) to access a communications channel. CSMA/CA is a technique designed to minimize the likelihood of two devices transmitting simultaneously. CSMA/CA itself uses a routine called Clear Channel Assessment (CCA) to determine if traffic is currently running on the specified communication channel. When the channel is occupied by traffic, CCA senses the traffic, and the WLAN devices wait for a break before transmitting packets of information. CCA is used in all standards-compliant hardware and is performed by the Direct Sequence Spread Spectrum (DSSS) physical (PHY) layer within the protocol.

In short, CCA within DSSS acts as a traffic cop within the protocol, controlling when a device has access to the channel and how long it is allowed to communicate before letting another device use the channel.

But, according to AusCERT, the CCA traffic cop can easily be overwhelmed by an unscrupulous hacker, and once the hacker begins transmitting, there is no adequate mechanism to shut him off.

Low Cost to Hack
Moreover, according to AusCERT, the mechanism needed to overwhelm CCA is incredibly easy to construct. An attacker can use a simple PDA equipped with a Wi-Fi card to broadcast a spectrum of signals to preoccupy the communications channel, preventing any other device from communicating. In addition, since the disrupting device can be small and difficult to locate with the physical range of the WLAN, the vulnerability of 802.11 WLANs make them delicate.

It was previously believed that any DoS attack against IEEE 802.11 networks would require specialized hardware that would saturate the wireless frequency with high-power radiation. Unfortunately, AusCERT's discovery of this vulnerability has proven just the opposite: A semi-skilled attacker with limited resources could quickly disrupt the viability of an 802.11 network, while escaping detection.

No Cheap Fix Available
The discovery of this particular technical vulnerability in the IEEE 802.11 protocol is a difficult problem for the rapidly expanding Wi-Fi industry.

IEEE 802.11 is not a single protocol, but a set of engineering standards and extensions that manufacturers of devices use when constructing the firmware for microchips. The fact that the vulnerability is so deeply embedded in the PHY layer of the DSSS technology means that there is no simple software "fix" to remedy the flaw. Engineers will literally have to "return to the drawing board" to redesign the entire protocol, the firmware, and the chips themselves.

Some Versions of Wi-Fi Not Affected
By the same token, the flaw is only a problem for certain versions of IEEE 802.11-compliant networks. In particular, this vulnerability is present in devices that follow the original IEEE 802.11 and protocol extensions 802.11b and low-speed (below 20 Mbps) 802.11g. Devices using the 802.11a protocol extension and the 802.11g high-speed (above 20 Mbps) extension do not use the DSSS technology and are not impacted.

Unfortunately, it's the vulnerable 802.11b protocol standard that is currently being used extensively in public and private WLANs--primarily because devices are inexpensive and readily available.

Don't Use Wi-Fi in Critical Infrastructure
For this reason, AusCERT is warning that in areas where a high availability WLAN is required--such as in public safety and security settings--802.11b should be avoided. This might include police, fire, safety, emergency, or municipal settings. It would also include situations in which critical infrastructure like WLANs are being implemented to support power or water systems.

IEEE 802.11 devices were already suspect because of poor security implementation, but these concerns haven't staunched the rapid deployment of Wi-Fi in public places and private networks. However, in this era when concerns about security and terrorism continue to hold sway, this new vulnerability should cause network implementers to think twice before installing Wi-Fi in their critical infrastructures.

Thomas M. Stockwell is Editor in Chief of MC Press Online, LP.
<<<<