Transcript Wireless Security - Lingnan University

Wireless Security
Traditional method
A computer with network card
 a cable connecting network card and
the network

User’s computer
ISP’s computer
Remote web server
1) Login to ISP
2) Assign a unique IP address
3) Send an URL
4) Convey the URL
5) Get the web page and send
it to ISP
6) Convey the Web page to user
URL
URL
ISP’s computer
URL
User’s computer
Web page
Web page
Web page
Internet
Remote web server
URL
Web
page
Web pages
User’s computer 1
URL
URL
URL
URL
Internet
Wireless router
Web page
IPS’s
computer 1
User’s computer 2
Web page
Web
pages
Web page
Web page
Remote
web server
User’s computer
Wireless router
ISP’s computer
Remote web server
1) Login to ISP
2) Assign a unique IP address
3) Assign a dummy IP address
4) Send an URL
5) Convey the URL
6) Convey the URL
7) Get the web page and send
it to ISP
8) Convey the web page
9) Distribute the web page to user
Wireless technology at
home
Infrared (IR) or Radio transmission
 e.g. remote control, cordless
computer keyboards and mouse,
stereo headsets
 Short distance, simple signals

Wireless connection
Access point with cable connection to
the network
 IEEE802.11 wireless LAN card

User’s
notebook computer
Other user’s
notebook computer
Internet
Other user’s PDA
User’s PDA
Access Point
User’s
Smart Phone
Access Point
Other users
with
wired Environment
Figure 1: Mobile Devices
other user’s
Smart Phone
IEEE802.11x standards
Developed by IEEE (Institute of
Electronic and Electrical Engineers)
 Have many standards (e.g.
IEEE802.11a,
IEEE802.11b,IEEE802.11g, etc)
 Began in 1990
 Took 7 years to complete the first
standard

Products available in the
Market
Only products of three standards
 IEEE802.11b


First product in the market
IEEE802.11a and IEEE802.11g arrive
almost simultaneously
 IEEE802.11n


finalized in 2010
comparison
IEEE802.
11b
IEEE802.
11g
IEEE802.
11a
IEEE802.
11n (Draft)
speed
11 Mbps
54 Mbps
54 Mbps
300Mbps
Frequency
2.4 GHz
2.4 GHz
5 GHz
2.4 GHz
Advantages
•
Popular
• inexpensive
Compatible
with
IEEE802.11b
Avoid
interference
with other
devices (such
as cordless
phones,
microwave
oven)
•
Faster than
version b and g
• Compatible
with b and g
Bluetooth
Low-cost, low-power
 Cover 10 meters
 Max speed: 700 Kbps.
 Use 2.4 GHz radio frequency
 Not a competitor of IEEE 802.11
 Replace cables in short distance

User Knowledge
Lack of security features in mobile
devices
 Immature wireless technology
 Security features not turned on
 Users unaware of security problems

Eavesdropping
Access Point
Attacker
User
Internet
Figure 2 Eavesdropping by attacker
Program downloading
Small memory
 More often to download program

Attacker’s computer
Performing illegal activities
URL
URL
Internet
Legitimate user’s
computer
Wireless
router
Web page
Web page
ISP’s computer
Performing illegal activities
Attacker’s mobile phone
Eavesdropping
Difficult to discover
 Can use ordinary mobile device to
attack
(e.g. notebook computer)
 Software available in public domain
 Can attack from 20 miles away

router
Attacker's
computer
Attacker’s
mobile phone
Internet
User
Remote servers
Potential thread of download
programs
Reading or writing files (such as
passwords) on the devices
 Delete files
 Connecting to other computers or
devices
 perform illegal operations (such as
hacking)

Jamming
User
Attacker
Jamming Device
Internet
Access Point
Steps in jamming
Listen to communication first
 Collect information
 Break the communication
 Impersonate the jammed user to
continue communication
Or
impersonate the server

Jamming
User
Jamming Device
User’s Access Point
Attacker’s Access Point
Attacker
Man-in-the-middle
Listen to communication
 Intercepts the message
 Modify or add data in the message
 Confidential and integrity problem

Attacker’s Notebook
User
Send a Message
Original Message
Remote servers
Intercept the message
e.g. transform one million to
David’s account
Modify the message
Send the modified
message
Modified message
e.g. transfer two million
to John’s account
Process the message
Identity of attacker
Mobile device is small (e.g. PDA)
 Difficult to detect
 Difficult to locate the attacker
