Comments on: Current Event – A Broader Look on Wireless Access Point Vulnerabilities http://cubist.cs.washington.edu/Security/2009/03/16/current-event-a-broader-look-on-wireless-access-point-vulnerabilities/ Mon, 25 May 2009 11:35:08 -0700 http://wordpress.org/?v=2.8.6 hourly 1 By: Mike http://cubist.cs.washington.edu/Security/2009/03/16/current-event-a-broader-look-on-wireless-access-point-vulnerabilities/comment-page-1/#comment-8409 Mike Wed, 18 Mar 2009 14:46:43 +0000 http://cubist.cs.washington.edu/Security/?p=1126#comment-8409 As you correctly point out, it's becoming more and more naive to assume that a wired network is intrinsically secure due to the possibility of rogue access points, or of access jacks or cables being accessible in semi-public areas. Rather than implement a clever knocking sequence to activate an access point, a simpler / cheaper method would be to plug the access point into a timeswitch. Unless the security audits are carried out (say) between 4pm on a Friday and 9am on a Monday, there's no access point to detect. (The timeswitch is more noticeable on a physical inspection, however). As well as Bluetooth, consider also the possibilities for networking opened up by mobile phones / GM GSM devices: worldwide accessibility, difficulty distinguishing between legitimate and illegitimate radio traffic, and network access only on demand. As you correctly point out, it’s becoming more and more naive to assume that a wired network is intrinsically secure due to the possibility of rogue access points, or of access jacks or cables being accessible in semi-public areas.

Rather than implement a clever knocking sequence to activate an access point, a simpler / cheaper method would be to plug the access point into a timeswitch. Unless the security audits are carried out (say) between 4pm on a Friday and 9am on a Monday, there’s no access point to detect. (The timeswitch is more noticeable on a physical inspection, however).

As well as Bluetooth, consider also the possibilities for networking opened up by mobile phones / GM GSM devices: worldwide accessibility, difficulty distinguishing between legitimate and illegitimate radio traffic, and network access only on demand.

]]>