Lux in tenebris
Auto-translated
Protecting Wi-Fi Networks
Fixing WEP
There are several procedures you can use to improve the security of your network. In fact, all of the items listed below are necessary during the initial setup of the network, but if they haven't been implemented, it's best to do them as soon as possible.
Use long WEP keys; this will make it more difficult for a hacker. If your equipment supports 128-bit encryption, then definitely use it.
Change keys periodically.
Place access points behind a firewall, outside the local network.
Use a VPN for all protocols that may transmit important information.
Use multiple techniques to encrypt traffic, such as IPSec. You will probably need to install software on clients, install an IPSec server on the local network, and use a VLAN between the access point and the server. In this scenario, network users will establish an IPSec tunnel to the server and transmit all data through it.
If possible, you should update the firmware on all network devices. For example, the developers of AirSnort (see the previous article) note that not all access points are vulnerable to hacking, and it is no longer possible to crack the WEP key on them. This is the job of manufacturers – updates constantly improve their devices, and the sooner you implement these improvements in your network, the better.
But this is, of course, not a panacea. WEP uses the RC-4 algorithm, which is inherently vulnerable due to the constant key. The only thing in the protocol that helps to combat this and change the key value is the 16-bit IV value. It changes its value every 65,536 packets, and from a hacker's point of view, it no longer matters what firmware is used in the network equipment – if the value repeats, then it can be found and used to gain access. Upgrading equipment should not be ignored, but it is better to pay attention to the network protection algorithms themselves.
WPA-PSK and WPA-Enterprise
Therefore, something needs to be done about the concept itself. Solutions have already been developed, in particular, WPA, or Wi-Fi Protected Access. The basis of WPA is the Temporal Key Integrity Protocol (TKIP). In short, TKIP is much better than WEP: its encryption mechanism is more robust, and it can be implemented on existing equipment. TKIP changes the key for each transmitted packet, thereby eliminating any possibility of guessing. (There is also a simplified version of WPA – WPA Pre-Shared Key (WPA-PSK). It is more suitable for small networks. As in WEP, it has a static key, but TKIP is also used, which automatically changes the key at certain time intervals.) Another variation of WPA is WPA-Enterprise, which uses TKIP, and in addition, an authentication server or device that operates using the Extensible Authentication Protocol (note that an additional server is required here, which will distribute privileges, for example, RADIUS; this situation is called EAP-over-RADIUS; there is also another, cheaper solution – the so-called Wireless Guard, which authorizes the user with a username and password).
Of course, WPA technology also has its problems. Robert Moskowitz of ICSA Labs discovered that the WPA key phrase can be cracked. This happens because a hacker can force the access point to regenerate the key exchange in less than 60 seconds. And even if the key exchange is secure enough for immediate cracking, it can be saved and used for offline brute-forcing. Another issue is that EAP transmits data in plain text. Initially, Transport Layer Security (TLS) was used to encrypt EAP sessions, but it requires a certificate on each client to work. TTLS partially fixed this problem, but Microsoft (Windows XP SP1\2\3 supports WPA) and Cisco decided to solve the problem in their own way and created Protected EAP, which is different from TTLS. Now, the two technologies are competing, and the support of such major players will likely lead to PEAP's victory.
*******
The Internet.
******************************************************************
And a little humor!
Methods for catching a lion in the desert
At one time, physicists proposed their own set of methods for solving the problem of catching a lion in the desert and placing it in a cage. But how do various figures from the era of information technology solve the same problem?
A Pascal programmer searches the desert with a full iteration. Upon finding the lion, he builds a cage around it.
An advanced Pascal programmer sorts the desert in ascending order, then searches for the lion using a binary search and builds a cage around it. If the lion leaves during the construction process, he throws down his work with a cry: "Range Check Error".
A C programmer searches for a stone in the desert and places it in a cage. He assigns the value "lion" to the stone.
An advanced C programmer assigns the value "cage" to the desert.
A C++ programmer designs a cage in such a way that the lion is part of it. When the cage is initialized, the lion is automatically generated inside.
An Ada programmer says that the lion and the cage are objects of different types, and there is no need to bother him with incorrect tasks.
A Delphi programmer writes to all the conferences: "Guys, where can I get a component that searches for a lion in the desert and puts it in a cage?".
A hardware engineer buys a lioness at the zoo, performs an operation to change its gender, and tries for a long time to stuff it into a canary cage.
An action gamer arms himself with a super shotgun, a plasma gun, a railgun, a nailgun, a six-barreled machine gun, and a chainsaw. He combs the desert, destroying everything in his path. He searches for the lion among the dead and tries to find a gold key in its stomach. If he finds it, he unlocks the cage with it and waits for a reward.
A quest gamer searches the entire desert for a lion, finds it, and puts it in his pocket. Then he searches the entire desert for a cage, while trying to stuff the lion into a teapot, a shoe, a TV, a bucket of paint, and other containers he comes across.
A strategy gamer raises taxes throughout the desert to get money to build a cage and hunting units. By the time the construction is completed, all the lions die of hunger.
An Internet user goes to his favorite search engine, types "desert" in the search bar, and searches for "lion in a cage". If he doesn't find it, he says that the task is unsolvable.
A webmaster goes to his favorite search engine and types "desert + lion" in the search bar. He creates a document "cage.html" and adds a link to the found result in it.
A spammer sends many cages to the entire desert, each of which has a note attached: "If you are a lion, please go inside and close the door behind you".
A Trojan horse maker does the same as the spammer, but instead of a note, he puts a picture of a naked lioness inside the cage.
An administrator digs a moat around the cage, fills it with concentrated acid, installs anti-tank hedgehogs and anti-personnel mines along the bank, and wraps all this with barbed wire. He connects wires from a high-voltage generator to the wire and the bars of the cage. He hangs 10 combination locks and 12 padlock locks on the cage. He goes inside, locks all the locks, turns on the current, swallows the keys, forgets the codes, and says that now no lion can scare him.
A hacker neutralizes the acid with alkali, cuts the wire, crawls under the hedgehogs, jumps over the mines with a pole, turns off the current, picks the locks, and enters the cage. Not finding a lion inside, he curses in annoyance, kicks the administrator, and goes back to the desert.
Fixing WEP
There are several procedures you can use to improve the security of your network. In fact, all of the items listed below are necessary during the initial setup of the network, but if they haven't been implemented, it's best to do them as soon as possible.
Use long WEP keys; this will make it more difficult for a hacker. If your equipment supports 128-bit encryption, then definitely use it.
Change keys periodically.
Place access points behind a firewall, outside the local network.
Use a VPN for all protocols that may transmit important information.
Use multiple techniques to encrypt traffic, such as IPSec. You will probably need to install software on clients, install an IPSec server on the local network, and use a VLAN between the access point and the server. In this scenario, network users will establish an IPSec tunnel to the server and transmit all data through it.
If possible, you should update the firmware on all network devices. For example, the developers of AirSnort (see the previous article) note that not all access points are vulnerable to hacking, and it is no longer possible to crack the WEP key on them. This is the job of manufacturers – updates constantly improve their devices, and the sooner you implement these improvements in your network, the better.
But this is, of course, not a panacea. WEP uses the RC-4 algorithm, which is inherently vulnerable due to the constant key. The only thing in the protocol that helps to combat this and change the key value is the 16-bit IV value. It changes its value every 65,536 packets, and from a hacker's point of view, it no longer matters what firmware is used in the network equipment – if the value repeats, then it can be found and used to gain access. Upgrading equipment should not be ignored, but it is better to pay attention to the network protection algorithms themselves.
WPA-PSK and WPA-Enterprise
Therefore, something needs to be done about the concept itself. Solutions have already been developed, in particular, WPA, or Wi-Fi Protected Access. The basis of WPA is the Temporal Key Integrity Protocol (TKIP). In short, TKIP is much better than WEP: its encryption mechanism is more robust, and it can be implemented on existing equipment. TKIP changes the key for each transmitted packet, thereby eliminating any possibility of guessing. (There is also a simplified version of WPA – WPA Pre-Shared Key (WPA-PSK). It is more suitable for small networks. As in WEP, it has a static key, but TKIP is also used, which automatically changes the key at certain time intervals.) Another variation of WPA is WPA-Enterprise, which uses TKIP, and in addition, an authentication server or device that operates using the Extensible Authentication Protocol (note that an additional server is required here, which will distribute privileges, for example, RADIUS; this situation is called EAP-over-RADIUS; there is also another, cheaper solution – the so-called Wireless Guard, which authorizes the user with a username and password).
Of course, WPA technology also has its problems. Robert Moskowitz of ICSA Labs discovered that the WPA key phrase can be cracked. This happens because a hacker can force the access point to regenerate the key exchange in less than 60 seconds. And even if the key exchange is secure enough for immediate cracking, it can be saved and used for offline brute-forcing. Another issue is that EAP transmits data in plain text. Initially, Transport Layer Security (TLS) was used to encrypt EAP sessions, but it requires a certificate on each client to work. TTLS partially fixed this problem, but Microsoft (Windows XP SP1\2\3 supports WPA) and Cisco decided to solve the problem in their own way and created Protected EAP, which is different from TTLS. Now, the two technologies are competing, and the support of such major players will likely lead to PEAP's victory.
*******
The Internet.
******************************************************************
And a little humor!
Methods for catching a lion in the desert
At one time, physicists proposed their own set of methods for solving the problem of catching a lion in the desert and placing it in a cage. But how do various figures from the era of information technology solve the same problem?
A Pascal programmer searches the desert with a full iteration. Upon finding the lion, he builds a cage around it.
An advanced Pascal programmer sorts the desert in ascending order, then searches for the lion using a binary search and builds a cage around it. If the lion leaves during the construction process, he throws down his work with a cry: "Range Check Error".
A C programmer searches for a stone in the desert and places it in a cage. He assigns the value "lion" to the stone.
An advanced C programmer assigns the value "cage" to the desert.
A C++ programmer designs a cage in such a way that the lion is part of it. When the cage is initialized, the lion is automatically generated inside.
An Ada programmer says that the lion and the cage are objects of different types, and there is no need to bother him with incorrect tasks.
A Delphi programmer writes to all the conferences: "Guys, where can I get a component that searches for a lion in the desert and puts it in a cage?".
A hardware engineer buys a lioness at the zoo, performs an operation to change its gender, and tries for a long time to stuff it into a canary cage.
An action gamer arms himself with a super shotgun, a plasma gun, a railgun, a nailgun, a six-barreled machine gun, and a chainsaw. He combs the desert, destroying everything in his path. He searches for the lion among the dead and tries to find a gold key in its stomach. If he finds it, he unlocks the cage with it and waits for a reward.
A quest gamer searches the entire desert for a lion, finds it, and puts it in his pocket. Then he searches the entire desert for a cage, while trying to stuff the lion into a teapot, a shoe, a TV, a bucket of paint, and other containers he comes across.
A strategy gamer raises taxes throughout the desert to get money to build a cage and hunting units. By the time the construction is completed, all the lions die of hunger.
An Internet user goes to his favorite search engine, types "desert" in the search bar, and searches for "lion in a cage". If he doesn't find it, he says that the task is unsolvable.
A webmaster goes to his favorite search engine and types "desert + lion" in the search bar. He creates a document "cage.html" and adds a link to the found result in it.
A spammer sends many cages to the entire desert, each of which has a note attached: "If you are a lion, please go inside and close the door behind you".
A Trojan horse maker does the same as the spammer, but instead of a note, he puts a picture of a naked lioness inside the cage.
An administrator digs a moat around the cage, fills it with concentrated acid, installs anti-tank hedgehogs and anti-personnel mines along the bank, and wraps all this with barbed wire. He connects wires from a high-voltage generator to the wire and the bars of the cage. He hangs 10 combination locks and 12 padlock locks on the cage. He goes inside, locks all the locks, turns on the current, swallows the keys, forgets the codes, and says that now no lion can scare him.
A hacker neutralizes the acid with alkali, cuts the wire, crawls under the hedgehogs, jumps over the mines with a pole, turns off the current, picks the locks, and enters the cage. Not finding a lion inside, he curses in annoyance, kicks the administrator, and goes back to the desert.
Евангелие от Иоанна, 1.5: Lux in tenebris lucet, et tenebrae eam non comprehenderunt. Свет во тьме светит, и тьма не объяла его.