Wireless Vulnerabilities in the Wild: View From the Trenches Deepak Gupta AirTight Networks Acknowledgement: Based on work presented by K N Gopinath at RSA 2011 Insert presenter logo here on slide master. See hidden slide 2 for directions Agenda Why care about Wireless Vulnerabilities? (Motivation) Whats new in this talk and what are its implications? Wireless Vulnerability Analysis (Measurements)
Threat/Vulnerability Mitigation 2 Era of Wireless Consumerization Real Life Breaches due to Insecure Use of Wi-Fi Marshalls store hacked via wireless Hackers accessed TJX network & multiple servers for 18+ months 45.7 million payment credit accounts compromised Estimated liabilities >
4.5B USD Are todays enterprises secure enough to prevent the recurrence of such attacks? 5 Enter War Driving How many of these are actually connected to my network? Not all APs are WPA/WPA2. WPA/WPA2 AP (%)
80 70 60 50 40 30 20 10 0 NY NY London London 6 Paris Paris
RSA '07 RSA '08 War Driving Insufficient for Enterprise Threat Classification Authorized Our Study External Rogue Sensor Based Statistical Sampling Data collected over last two years Total Number of
Enterprise Clients 427,308 Threat Instances Analyzed 82,681 8 Enterprises Deal With Lot of Non-Enterprise Devices 268,383 APs External/
70% APs do NOT belong to the studied Organizations! Authorized Unmanaged 80,515 187,868 Similarly, About 87% Clients are Unmanaged/External! Wireless Threat Space AP Based Threats Rogue APs AP
AP misconfigurations Soft/Client Based APs Wireless Threat Space Client based threats Adhoc Network Client extrusions Connections to neighbors, evil twins Adhoc networks Client bridging Banned devices Window of opportunity for an attacker
t a re h T Threat Duration T3 (T-Cube) Parameters en u eq r F Presence of an instance of a threat (%)
Threat Presence cy Likelihood of presence of a threat instance Real-life data & Accurate picture of Threats How does this information help you? Get an idea of Wi-Fi threat scenario in enterprises that may be like yours Which wireless threats you should worry about first? Plan your enterprise mitigation strategy Simple (Yes/No) metric based on the presence of an instance of a threat (%)
Threat Presence Threat Duration Threat Frequency 14 Results From Our Survey % Response Randomly Chosen set of IT Security Professionals Rogue AP Misconf. AP Adhoc
Client Extrusion Other Results Based on Our Data Key Observations 100% Occurrence (% Organizations) 90% 80% 70% 60% 50% 40%
Adhoc Soft Banned APs Devices DoS Client Bridging Key Implications 0% Threats -Organization data is potentially at risk via Wi-Fi Lets Dive Deeper into Nature of Threats Rogue APs
Client Extrusions Adhoc Clients Enterprise Wireless Consumerization: Rogue APs 1521 Rogue APs seen in our study 163 Different type of Consumer Grade OUIs seen Rogue AP Details About 1 in 10 Rogue APs have Default SSIDs Unknown/ Blank, 2% About Half of Rogue APs Wide Open Open, 49% Default SSIDs, 9%
WPA(2)/PSK, 29% Unknown, 1% Non-Default, 89% WEP, 21% Rogue AP Details An open Rogue AP is Virtually THIS! Client Consumerization: Client Extrusion
Client (Smartphones & laptops both) probes for these SSIDs. Topic of Hot Discussion Today! 23 Client Probing For Vulnerable SSIDs Retail/SMB Organizations 118,981 Clients Authorized Unmanaged 12,002
636 (5.3%) 106,979 21,777 (20.4%) Power of Accurate threat classification. 5.3% Vs 20.4% Known Vulnerable SSIDs Probed For 103 distinct SSIDs recorded Certain (8%) Authorized Clients Probing for 5 or more SSIDs Adhoc Authorized Clients!
565 distinct Adhoc SSIDs found, About half of them Vulnerable 15% of these are default SSIDs. 26,443 (7%) clients in adhoc mode. So What? Illustrative Exploit via Client Extrusion Smartphone as an Attacker App1: Mobile Hotspot App2: SSLStrip Attack Tool VIDEO DEMO: Smartpot MITM Attack VIDEO DEMO: Smartpot MITM Attack 28 How long (time interval)
a threat is active before removal? Threat Presence Threat Duration Threat Frequency 29 AP Threats live longer than Client Threats 15% client threats & 30 % AP threats live for > hr Histogram indicating that AP threats live longer Some AP based threats are active for a day or more!
Threat Duration 12 Hr+ 12 Hr 6 Hr 1 Hr Rogue AP 30 Min AP Misconf. 10 Min Client Extrusion 0%
10% 20% 30% 40% 50% 60% 70% Adhoc networks % Threat Instances with Given Threat Duration
Data from SMB/Retail (PCI) Segment Threat instances per Sensor per month Threat Presence Threat Duration Threat Frequency 31 Threat Frequency Threat Frequency Large Enterprise Segment: Threats Per Month Per Sensor (Approx. 10,000 sq feet area) 13
14 12 8 10 8 6 4 1 2 0 Rogue AP Misconfigured AP Client Extrusion
Threat Category Bigger your organization, higher the likelihood of finding the threats Key Takeaways Summarized Wireless threats due to unmanaged devices are present Enterprise wireless environment influenced by consumerization Certain threats more common than others
Client extrusions Rogue AP AP Mis-configurations Adhoc clients Common threats affect large enterprise and SMB organizations Wireless threats persist regardless of sophistication of wired network security Threat Mitigation 34 Lets Ban Wi-Fi! Use WPA2 For Your Authorized WLAN!
But, WPA2 does not protect against threats due to unmanaged devices Threat Mitigation Regular wireless scans to understand your security posture - Cloud based solutions are available to automate wireless scans Defense-In-Depth Mitigation Intrusions (AP Based Threats) Extrusions (Client Based Threats) Wire side controls as a first line of defense (e.g., 802.1X port control)
Educate users: clean up profiles, Use VPNs & connect to secure Wi-Fi Wireless IPS to automatically detect & block intrusions Deploy end point agents to automatically block connections to insecure Wi-Fi Wireless IPS to automatically detect & block extrusions in enterprise perimeter
Apply Slide: Recommended Best Practices Self Assessment Test Scan your network to find out how vulnerable you are Good chance that you will find a Rogue AP, higher chance that you will find client extrusion Follow best practices Educate your users to connect to secure Wi-Fi Use VPN for remote connections Clean up the Connection profiles of Wi-Fi clients periodically Deploy end point agents to automate some of the above
Adopt a defense in depth security approach Employ wire side defenses against Rogue APs (first line of defense) Regularly scan your wireless perimeter If risk assessment is high and/or you store super sensitive data Threat containment via wireless IPS should be considered Apply Slide: Recommended Best Practices Go Wi-Fi, But, The Safe Way! Questions? Thank You [email protected] 40
A1: Location/Site Wise Distribution Location Wise Distribution Key Observations Occurrence (% Locations) 50% 45% 40% Client Extrusions Prominent threats are distributed across
Applied retroactively through restatement of financial statements. GASB 84, Fiduciary Activities (2020) Outlines specific criteria for definition of a fiduciary activity. Fiduciary Fund vs. Special Revenue Fund
Engineering Economics in Canada ... To implement the CCA system, assets are grouped into CCA asset classes Each CCA asset class has a designated CCA Rate assigned Sample CCA Classes and Rates CCA CCA Class Rate Description 1,3,6 4 -...
University of Cambridge and Founder of XenSource Inc. Computer Laboratory Outline Virtualization overview Xen Today : 2.0 Overview Architecture Performance Live VM Relocation Xen 3.0 Roadmap (Q2 2005) Virtualization Overview Single OS image: Ensim, Vservers, CKRM Group user processes into...
Canine Nutrition: A Practical Approach Relatively speaking, most dogs today eat a more nutritional diet than their owners do Nutritional Requirements of the Dog Though a carnivore, the dog utilizes a wide variety of foodstuffs efficiently and can meet nutritional...
How to represent a distributed algorithm? The notions of . atomicity, non-determinism, and fairness. are important issues in distributed algorithms, so we will need some notations and examples to clarify them.
Firewalls Firewalls Most widely sold solution for Internet security Solution in a box appeal Not a substitute for proper configuration management Firewall needs to be configured properly for intended protection Types of Firewalls IP packet level Packet filtering TCP session...
NaiveBayes JRip J48 SMO Find References by selecting a classifier Use Cross-Validation! Analyzing Results Important tools for Homework 2 Accuracy "Correctly classified instances" F-measure Confusion matrix Save model Visualization Running weka from the Command Line Running an N-fold cross ...
22 million people die during WWI. Civilian deaths . accounted for nearly half of that number. Military deaths are estimated to between nine and eleven million. Twenty million soldiers are wounded . but survive. Ten million refugees are forced to...
Ready to download the document? Go ahead and hit continue!