|
|
 |
|||||||||||||||
|
|
|||||||||||||||
|
|||||||||||||||
|
 
|
 Getting Phished: Why SSID Spoofing (Still) Matters By Lisa Phifer
January 29, 2007
Phony access points (APs) that use spoofed service set identifiers (SSIDs) to lure wireless users are nothing new. Also called evil twin or honeypot rogue APs, these look-alikes have grown common in venues frequented by business executives, including airports and hotels. The next time you connect to any WLAN, ask yourself: are you really certain the AP is legitimate? If not, you could be setting yourself up for a variety of nasty phishing attacks, with personal, professional and financial consequences. Spoofing Has Never Been EasierIt's always been simple to configure an AP with someone else's hotspot, corporate or residential SSID. SSIDs are trivial to sniff from an active WLAN and cannot be completely hidden, even if omitted from beacons. Because most wireless clients connect to SSIDs, not APs, nearby users are just as likely to choose a phony or illegitimate AP as they are a legitimate one. Jacking up transmit power and sending deauthenticates can improve the odds of successful misdirection. Once connected, a phony AP can use its man-in-the-middle vantage point to launch a plethora of attacks. For example, the AP can intercept Web requests and supply bogus responses carrying corrupted images or malware (define). Those seeking financial gain are more likely to phish (define)for values like credit card numbers, e-commerce credentials and corporate logins. Identity theft has become big business, and phony APs are a relatively easy way to phish high-value users without raising suspicion or leaving tracks. Unfortunately, easy-to-use platforms are readily available to create a phony AP that phishes for identities and snarfs returned values:
False SecurityThere's a big difference between knowing that phony APs exist and actually protecting yourself from them. First, let's dispel some popular myths:
Steps That Can HelpIt is hard for an end user to visually differentiate between a legitimate AP and one using a spoofed SSID (and perhaps MAC address). But a wireless intrusion prevention system (WIPS) has a broader, full-time view of activity throughout your office. It can spot an AP that wasn't there an hour ago, APs operating with spoofed SSIDs, unusual deauthenticate messages, excessive client roaming between APs, and other signs of possible attack. Companies can deploy WIPS to spot all kinds of rogue APs (including those with spoofed SSIDs), automatically deauthenticating connections made to them by employees. Outside of the office, SSID spoofing detection is harder. Users are surrounded by an ever-changing world of unknown APs. But depending upon the operating system, you can run a WIPS program on your laptop itself. These host-resident programs watch for forbidden or hotspot SSIDs, APs or client behaviors. Some generate alerts to warn users; others can stop connections that violate configured rules. Examples include the Shmoo Group Hot Spot Defense Kit (HSDK), AirTight Network's SpectraGuard SAFE, AirMagnet StreetWISE, Network Chemistry's RFprotect Endpoint, and AirDefense Personal. Proactive steps can also be used to avoid connecting to phony APs in the first place. First, wireless client policies should be configured to connect only to known SSIDs in Infrastructure Mode. This cannot evade phony APs, but it makes a huge dent in accidental or risky connections to unknown SSIDs. For Windows XP clients, client probing can be reduced using the nonbroadcast network option (see Microsoft Knowledge Base article KB917021). To avoid errors when users configure their own security parameters, and to prevent users from even seeing forbidden SSIDs, configure IT-managed wireless policies.
Next, connect only to WLANs that employ 802.1X authentication with an EAP-type that lets the client verify the authentication server's identity (e.g., EAP-TLS, EAP-TTLS, PEAP). When configuring 802.1X connections, it is critical to have the client automatically check both server and issuer certificates before sending username and password (or any other type of client credential). When implemented correctly, this makes it difficult for a phony AP to pose as a legitimate AP, because phony APs do not match the legitimate server's digital certificate, and cannot issue their own valid certificate from your certificate authority.
802.1X is most often employed by corporate WLANs, but can also be used at some hotspots (e.g., iBAHN, T-Mobile.) It can be helpful to use hotspot connection manager programs that automatically check the server's identity during login. But be careful not to accidentally fall back to the hotspot's open, unauthenticated WLAN. To use 802.1X with a home WLAN, you'll need an AP that supports WPA-Enterprise or WPA2-Enterprise (most new APs do) and a simple RADIUS authentication server like WinRadius, FreeRadius or SecureMyWiFi. Some home routers even have a RADIUS server built in. Finally, it is still an excellent idea to utilize higher-layer security measures like SSL, SSH or VPN to protect traffic sent across the Internet or any other public network. Just don't rely on them as a substitute for preventing connections to phony APs. No matter what type of network you use, strong server authentication should be enforced before the client supplies the user's identity. This concept is the key to avoid being phished.
|
||||||||||||||||||||||||
| Solutions | ||||||
|
||||||
|
||||||
|
||||||
|
||||||
IE 7
Firefox 2.0
