Chapter 1 WIRELESS NETWORK SECURITY FUNDAMENTALS
Total Page:16
File Type:pdf, Size:1020Kb
Chapter 1 WIRELESS NETWORK SECURITY FUNDAMENTALS 1. INTRODUCTION It's an epidemic waiting to happen to many security experts. While most IT managers today have their hands full securing wired networks, their companies have been spending billions of dollars on wireless. Businesses will have spent $60 billion on wireless communications services and wireless network security by the end of 2006; and, 80 percent of the U.S. work force will use some sort of wireless device, including cell phones, pagers and mobile computing devices. That's good news for employee productivity, but bad news for companies ill-prepared to head off wireless network security breaches and debilitating viruses [10]. There's been a lack of functionality and a lack of mature infrastructure globally. And, that's the only reason the wireless viruses of today have not been more damaging. But, that's about to change. Industry analysts predict dramatic increases in wireless handheld use and the proliferation of new mobile capabilities. They expect to see 5.9 billion handsets, personal digital assistants (PDAs) and Internet appliances equipped with wireless capabilities by the end of 2008—^with that, you get a fiill scale epidemic in the works. Simply put: It's coming [10]. For many IT managers, the wireless world, with its often-incompatible alphabet soup of standards, may be new territory. Many enterprises have felt that protecting their wireless processes against viruses is one piece of the complicated puzzle they can afford to omit. They'll soon need to face threats that could wreak havoc on a very large scale. 4 Chapter 1 Therefore, in order to fight the viruses and security breaches of the future, wireless network security vendors (even giants Uke IBM) are busy developing products. In addition, within applications and on devices, they are also heading off problems on a wireless network level. 2. OVERVIEW OF WIRELESS NETWORK SECURITY In markets where wireless devices are more widely used, to date, most wireless attacks have happened outside the U.S. Nevertheless, one virus that did hit U.S. handhelds was known as the Liberty virus. For example, some personal digital assistant users received what they thought was a program that would allow them to play a certain game for free. However, it launched a virus that erased all the data on the devices when they double-clicked on the link. Nonetheless, the virus wasn't devastating for people who regularly back up their PDA information on their PCs. Nevertheless, more serious problems have occurred overseas in the form of viruses and/or malicious code that forced phones to dial particular numbers, intercepted transmissions and perpetuated the theft of data. Disguised as a short message, one vims was distributed in Scandinavia. The virus rendered the buttons useless, when a user received the message. In order to get their phones fixed, users had to take them in to their service providers. New types of malicious code have been written that force wireless devices to make phone calls, because many of them also have telephony capabilities. One incident in Japan caught the attention of wireless operators and software companies around the globe. Users of NTT DoCoMo's (http://www.nttdocomo.com/top.html) popular I-mode service [1] received an e-mail with what looked like an embedded Web site link. When customers clicked on the link, their phones automatically dialed Japan's emergency response number. Luckily, they could stop it before it got too bad; but, that could shut down a 911 system that could have life-and-death consequences. For example, similar viruses could be unleashed that might flood a company's call center, or cause phones to dial a 900 number. If a virus that spread to all its mobile workers racked up significant charges, a corporation could be seriously affected. The threat of data theft, perhaps, is more alarming to businesses. In order to prevent the interception of information as it's being transmitted, all wireless transmission standards have security built in, but they're known to 7. 5 be fallible. Encryption technology designed to head off the threat of sniffing, has been included by developers of standards such as Wireless Application Protocol (WAP) and the wireless LAN 802.1 lb standard [10]. Because the wireless network is essentially everywhere, sniffing is an inherent problem in wireless. Sniffers must have access to physical parts of the network in order to break in the wired world. The problem is, with wireless, they don't even have to be in the network. They can be in a van outside with a transmitter. When researchers at the University of California at Berkeley figured out how to crack its built-in encryption, the widely used wireless LAN standard, 802.11, came under fire recently [10]. Because developers addressed wireless network security from the start and are working to beef it up before wireless LANs become more pervasive, there is still some hope. Companies will also have to secure wireless transactions. There will be attacks on the devices themselves, but they quickly will be focused on transactions. As devices develop more capabilities, these threats are expected to grow more serious and frequent. Typically, you should look to the past to predict the future. Also, new possible threats come into play every time there is a technology advancement. Each time software companies release popular technologies in the PC environment, people use them to write malicious code. The same is expected with regard to wireless. For example, a Windows program can currently run on a Windows CE device, but CE doesn't yet support macros. So, the ability for viruses to spread is nil, because the device doesn't support macros. Nevertheless, wireless devices are rapidly developing other capabilities. In the beginning the PDA was just something used to store contacts. But, today they are little computing devices. There's more of a chance of things being used improperly, as you create more functionality. Most viruses have been regional so far. But, the threat of viruses spreading around the globe grows, as regions of the world begin to standardize wireless technologies. NTT DoCoMo, for example, plans to open its wireless network globally by 2006 [10]. This would then allow the worldwide spread of NTT DoCoMo threats. In addition, there is a greater potential for viruses to spread between PCs and mobile devices (which could enable viruses to spread very quickly), because more of the capabilities are supported by devices. So that the same applications can run on PCs and handheld devices, Windows CE will support Java script in the future. Then viruses can spread easily via e-mail or programs that synchronize PCs and handheld devices. A version of Java is already supported by most wireless phones (including versions Nextel Communications sells primarily to businesses). 6 Chapter 1 2.1 Firewall Building What's really becoming readily available, are more wireless network security measures and products. Still, uncertainty about how to address potential threats is preventing some enterprises from deploying wireless. Still though, many companies have to contend with wired security issues. And, it is difficult for IT managers to stay on top of new developments, because both the wired and wireless worlds change quickly. It's a tremendous challenge for IT managers to understand the space and issues, and what the solutions are to address it. Many enterprises aren't yet concerned about protecting against viruses, because wireless viruses haven't been widespread. Also, many enterprises haven't heard very much about wireless viruses, and so, it's not a real issue right now. Although the data from wireless devices passes through the corporate firewall [8], additional wireless network security isn't necessary, because the information wouldn't be valuable to anyone else. For example, at Final Mile Communications (http://www.finalmilecom.com/), a professional services company, field service workers use Nextel phones to receive trouble tickets and report status back to the dispatch center [10]. They haven't seen any viruses yet, but when and if a virus does present itself, it will be a serious issue to be dealt with. Warning: URLs may change without notice! There seems to be more concern about the possibility of data being stolen by other companies. By determining what's acceptable and what isn't, the first decision an enterprise must address when implementing a secure wireless system is to define its security model. It's ponderous; that's part of the problem. For example, in the wired world, encryption based on public key infrastructure [7] hasn't taken off because it is difficult to use. An enterprise that wants to give a field service worker access to important data is aiming to make that worker more efficient. However, you've negated the advantage of going after wireless network security, if it introduces more error and takes longer to use. You have to take a holistic approach. Coming to market, are more products purporting to provide end-to-end wireless network security that starts with the device and includes transmission and the software that runs applications. Thus, giving companies more options that fit their specific needs. One of the simplest problems, though, has not been widely addressed: Should the device be lost or stolen, few mobile devices have mechanisms for protecting information stored on them. So that only the owner can access stored data [6], there are some early products that companies can add to user devices to encrypt data. L 7 For example, F-Secure (http://www.f-secure.se/foretaget/) has encryption and antivirus software for Pocket PCs, and Palm and Symbian devices [10].