Wireless vulnerabilities

Submitted by acohill on Mon, 02/18/2008 - 08:50

This moderately technical article (PDF file) has an extensive discussion of the vulnerabilities of wireless systems, including WiFi, Bluetooth, and WiMax. Communities interested in investing primarily in wireless broadband should read this article first, as the data presented illustrates why most businesses do not regard wireless as a business class service.

Here is a short summary of the issues from the article:

Wireless networks have three additional aspects that make the security of wireless
networks even more challenging than the security of fixed networks:

• Wireless networks are always open
• Attackers can connect into the network from anywhere and from any distance
• Attackers are always anonymous

Wireless networks are always open – Physical media does not protect them. Any device
that implements the same radio interface can access a wireless network. One common
assumption is that wireless technologies are secure when authentication and encryption
are properly deployed. Looking closely at the operation of related protocols, there are
many message sequences that take place before the authentication. These message
sequences can always be attacked regardless of the deployed security measures.
Attacks are not limited by location or distance.

Attacks are not limited by location or distance. The distance from where the attacker can
reach the wireless network is only limited by the power of the transmitter. For example,
Bluetooth attack tools are known to have several-mile radiuses, although valid usage
scenarios would never attempt such range of coverage for Bluetooth.

Attackers are always anonymous. Although a valid user can be pinpointed with good
accuracy, an attacker can use directed antennas that will only target a selected victim. It is impossible to guarantee detection of malicious users in wireless networks. As stated
above, an attacker can also always attack the message sequences that happen before the
authentication of the device and thus avoid identification.