Skip to Content.
Sympa Menu

baslinux - [BL] wireless security

baslinux AT lists.ibiblio.org

Subject: Baslinux mailing list

List archive

Chronological Thread  
  • From: baslinux AT lists.ibiblio.org
  • To: baslinux AT lists.ibiblio.org
  • Subject: [BL] wireless security
  • Date: Wed, 27 Jun 2007 12:32:36 -0400

On Wed, Jun 27, 2007 at 04:49:23PM +1200, Steven wrote:
>
> Do you consider the Aironet 350 an older card?

I meant non-cardbus cards in general, which means 802.11b by definition (I
believe).

> The Aironet 350 has the following security:
> --------------------------------------------------
> 802.1X support including LEAP, EAP-FAST, PEAP-GTC,
> PEAP-MSCHAP V2, EAP-TLS, EAP-TTLS and EAP-SIM to
> yield mutual authentication and dynamic, per-user,
> per-session encryption keys
>
> Authenication by MAC address and by standard 802.11
> authentication mechanisms
>
> Support for static and dynamic IEEE 802.11 WEP keys
> of 40 bits and 128 bits
>
> TKIP enhancements: key hashing (per-packet keying),
> message integrity check (MIC) and broadcast key
> rotation via WPA TKIP and Cisco TKIP
> ---------------------------------------------------
>
> Is that secure enough for you?

It sounds like this card, despite being non-cardbus and 802.11b, is capable
of sufficiently high encryption (it lists
WPA). One crucial question is whether this card is unique among non-cardbus
cards, or whether it's typical. Another
important question is whether there is a Linux program that will allow the
user to deploy WPA encryption (or key
hashing, or MIC) for this card. Have you tried that? If there isn't one, then
discussing the heightened encryption
features of this non-cardbus card seems a bit of a moot point.

WEP is not at all secure and there are programs out there that can crack the
WEP key in just a few minutes or as long
as it takes to sniff a sufficient number of packets. MAC address filtering is
pretty much useless since it's so easy to
discover, then spoof, the MAC address.

> Do you trust your wired connection for this? Your wired
> connection passes through numerous routers where your
> packets could be intercepted by an unscrupulous hacker.
> How is that safer?

I trust https/ssl wired connections. I'm not trying to set myself up as some
kind of wireless security guru or
something. As I said, I've been reading some more about it and coming to a
realization of the security risks. I think
mainly about risks between the wifi card and its base station or router--for
example in the home wireless network,
rather than about the larger internet, when speaking about the added security
risks. The very nature of wireless adds
another vulerability point in computer inter-communications: you broadcast
signals to/from your base station that
anyone within range can intercept. So my thinking is how to secure better
that added point of vulnerability (by using
better forms of packet encryption between wifi card and base station/router).

What would be your solution? Should we just admit that, since our traffic
could be sniffed anywhere along the way to
its destination or back, regardless of whether it's a wired or wireless
connection, making the radio transmission part
of the equation more secure is unimportant?

James




Archive powered by MHonArc 2.6.24.

Top of Page