Myth #2: Even with 802.11i, you still need a VPN to

Once a network security professional learns that the physical layer of the network can be extended outside a room, building, or even across town, by an intruder with a high-gain antenna, it’s only natural to get skittish about allowing access points on the LAN. When you consider security options for this type of network that has an openly accessible physical layer, comparisons to the Internet are inevitably made.

IPSec and SSL VPNs have long been a logical way to secure users accessing the network via WAN connections, so it makes sense that people would choose those same options to secure a wireless LAN. To make matters worse, many network security veterans have been bombarded with news items telling them how vulnerable Wi-Fi networks are to intrusion—WEP or no WEP.

When WEP was fixed with the introduction of WPA in 2003, many people noticed. When 802.11i and WPA2 were introduced in 2004, even more people noticed. But few people who knew about WPA and WPA2 really knew the ins and outs of how they make wireless networks secure.

WPA fixed WEP by introducing TKIP (Temporal Key Integrity Protocol) encryption and using 802.1X/EAP or WPA-PSK as secure authentication methods. TKIP is an encryption type based on the same ciph er as WEP. While TKIP fixes the flaws in WEP, perhaps even more important is the fact that it kept the same cipher as WEP so that legacy equipment could be upgraded with improved software, not hardware.

Even when WPA became widely available, security professionals still had good reason to recommend VPNs for some secure Wi-Fi environments. TKIP’s use of the RC4 encryption cipher meant that certain organizations (Department of Defense, financial services, etc.) would be unable to comply with tough regulatory standards for IT security unless IPSec or SSL were employed.

When WPA2 was released, all of that changed. WPA2 uses CCMP (Counter Mode CBC-MAC Protocol) encryption. This is significant because the cipher used in CCMP is AES. The AES cipher is the strongest cipher used with IPSec VPNs, and it has no known flaws. The end result is that using CCMP on an 802.11i network provides encryption that is as strong as the strongest IPSec VPN.


Some network security professionals who acknowledge the encryption strength of 802.11i still prefer VPNs because authentication on IPSec and SSL connections is known to be secure. In fact, there are very real concerns when certain types of authentication are used in concert with CCMP encryption. WPA-PSK and 802.1X/EAP-LEAP authentication are both vulnerable to dictionary attacks.

Even though vulnerable WPA2 authentication methods do exist, several secure authentication methods are available as well. When a Wi-Fi network is designed using the 802.1X framework with EAP-TLS, EAP-TTLS, or PEAP authentication, wireless credentials are kept private using tunneling technology similar to SSL. Devices that use CCMP encryption with any of the aforementioned types of authentication are easily identified with the WPA2 Enterprise certification.

The development of WPA2 Enterprise has been an important step in the security evolution of Wi-Fi networks. For some IT security folks, however, being just as secure as an IPSec or SSL VPN isn’t quite enough. Seasoned security people know VPNs. They may not really know WPA2 Enterprise and, therefore, may be unwilling to adopt it when VPNs are readily available. For that reason, it’s important to understand that WPA2 Enterprise is not just as good as an IPSec VPN –it’s better.

WPA2 Enterprise offers benefits over wireless VPN connections in terms of cost, performance, availability, and support. There are numerous ways to express the advantages of WPA2 Enterprise, but a look at the intrinsic nature of each technology is the most revealing way to understand it. Wi-Fi is a layer 2 technology and WPA2 Enterprise secures the network at layer 2. IPSec is a layer 3 technology, which makes it fundamentally less scalable, secure, and manageable for securing a layer 2 link.

ELEVEN Myths about 802.11 Wi-Fi Networks series 1

It seems that Wi-Fi networks have been misunderstood by much of the IT community since their inception.
Even the reasons for this misunderstanding are kind of hard to understand. It could be that the rising popularity of Wi-Fi caused demand to surge ahead of the supply of professionals ready to manage networks. Maybe it’s that networking folks and radio frequency folks both had to learn the other side’s technology on a fairly intimate level. Maybe it’s just that engineers cooped up in an RF chamber all day have a hard time explaining themselves. Whatever the reason, the result has been that myths about 802.11 (better known as Wi-Fi) networks have grown almost as fast as the technology itself.

Being wireless networking instructors allows us a unique perspective in sampling the Wi-Fi myths that are believed by a wide variety of IT professionals. In this series we examine 11 such myths and explore ways to use correct information about wireless LANs to make your networks scalable, secure and satisfying to your users.


Myth #1: If you leave your Wi-Fi adapter turned on, someone could easily hijack your notebook and take control of your computer.

The most widely publicized presentation at the 2006 Black Hat hackers convention revolved around a vulnerability in certain wireless device drivers1. Though the chipsets that use these drivers were left unnamed, the end result was that intruders associated to the same Wi-Fi network as your notebook computer could potentially gain access to your machine through a command line interface.

This is a severe vulnerability, and it strongly emphasizes the point that Wi-Fi stations should be kept from associating to unknown networks. Unfortunately, the people responsible for creating the application that performs this intrusion also ended up perpetrating one of the most widely spread myths concerning Wi-Fi security.
As part of the promotion of their presentation, the authors of this attack tool claimed that Wi-Fi stations were vulnerable to attack just by leaving their Wi-Fi adapters enabled. They could be correct to an extent, as there may be heretofore unknown flaws in Wi-Fi device drivers that could allow an attacker to disengage normal login protections that are in place for today’s operating systems.

Where the presenters of this attack went wrong is in suggesting that a full active attack—one where a victim’s entire machine is overrun—is possible against any poor sap that has a Wi-Fi adapter turned on. In certain situations, this line of thinking ends up being accurate but, like many network intrusions, it would take an extremely negligent end user for such a diabolical attack to be successful.

Let’s put one semi-myth to bed right away: Attackers cannot access your computer without first establishing a connection to the same network you are associated to. This is a fundamental truth of networking. Any peer-topeer attack—such as the CLI attack touted at Black Hat 2006—requires that data be transferred from station to station. Since a Wi-Fi association is necessary for a notebook computer to have a data link layer (layer 2) connection, perpetrating this attack on an unassociated machine is simply impossible.

Now let’s look at the more widely propagated myths. Many people believe that unassociated stations are vulnerable because your notebook computer can be easily hijacked on to a nearby network by an attacker. It is also widely held that associated stations could surreptitiously roam to nearby APs set up by attackers (we’ll call these “hijacker APs”). These myths are tricky because there is some truth to both of them. Let’s differentiate, shall we?

Concerning unassociated stations, many of them are indeed vulnerable to hijacking. Specifically, stations that are controlled by Wi-Fi client utilities that use a Preferred Networks list are vulnerable to hijacking. If the attacker creates an AP with a non-encrypted SSID that is in the station’s Preferred Networks list, the station will connect to the hijacker AP.
There are a couple of solutions to the problem of hijacker APs. Users could eliminate this threat by removing all non-encrypted SSIDs from their list of Preferred Networks. This becomes difficult because every time a user connects to a Wi-Fi network, the SSID and encryption settings (or lack of encryption settings) are automatically added to their Preferred Networks list. A more comprehensive solution is to disable the Wi-Fi adapter when it
is not in use. Sure, this is a great solution in theory but, in practice, often times users are forgetful or negligent when it comes to network security.

Solving the hijacker AP problem may be getting easier. Applications like NetOaats can be configured to disable a user’s wireless network adapter upon the connection to a wired network. It can even be configured to work the same way if a notebook establishes a connection to a Broadband wireless network (like the EvDO networks from Sprint and Verizon). By having users simply run the NetOaats application, they become much less susceptible to peer-to-peer attacks.

Another item that could counteract the attack from Black Hat 2006 is the preponderance of security protocols that prevent Wi-Fi stations from accessing each other. Protocols such as Cisco’s Public Secure Packet Forwarding (PSPF) prevent a wireless user from accessing another wireless user’s station when they are connected to the same AP. This is known as wireless client isolation. Virtually every commercial public Wi-Fi Internet service uses some kind of wireless client isolation protocol. The end result is that users remain safe as long as they stay connected to the network of the Wi-Fi Internet access provider.

There are several other mini-myths that are related to this fundamental myth about the ease of hijacking users. One is that users will connect to an ad-hoc (peer-to-peer) Wi-Fi network that is configured with the same SSID as an AP. This is false because Beacon frames from APs always indicate whether the network is a BSS (network with an AP) or an IBSS (ad-hoc network).

Another myth is that users will automatically connect to any access point in the area if their Wi-Fi adapter is left enabled. While some very old client utilities did have this flaw, today’s client utilities usually only allow a Wi-Fi station to associate to SSIDs that are configured with proper security settings in the list of Preferred Networks.

The truth about the flaw that was presented at the Black Hat 2006 conference is that it appears to be a very real device driver flaw dressed up in a Wi-Fi vulnerability to peer-to-peer attacks that has been known and understood for years by well-versed network security professionals. It is true that if the following conditions are met, users are vulnerable to the full attack:

1. The user has an enabled Wi-Fi adapter.
2. The user’s Wi-Fi adapter is not associated to a network that uses encryption.
3. The user has a non-secure SSID configured in their list of Preferred Networks.

If any of these three conditions are not met, the Black Hat 2006 wireless attack becomes just another vulnerability on the periphery of Wi-Fi that perpetrates one of the most common myths about Wi-Fi security.

Help users create complex passwords that are easy to remember

So how can you make sure users' passwords are complicated enough to deter hackers and easier enough to remember? One of my colleagues offers the following trick for creating complex passwords that meet complexity requirements while still being possible to remember.

Step 1: Come up with a base wordPick the name of a pet or any common thing that's easy to remember. For example, say you once lived in Louisville. You can use that to establish the base of your password and satisfy the required criteria for a strong password.
Remember: You need at least one capital letter and either a number or special character. So, using Louisville as your base word, you can substitute an ! or 1 for i and replace the s with $—e.g., Lou1$ville or L0u!$ville.

Step 2: Add more characters to the base wordPick any four characters to add to the base word.

Step 3: Store your password without worryNow, write down the added four characters, along with a clue for the base word. Using our previous example, you would write down city1xyza, where city1 signifies Louisville with a 1 and $ and xyza represents the four additional characters.

So, even written down, this password reference would serve as a reminder of your complete password while revealing nothing to any roaming eyes. (Keep in mind that this example is a 14-character password. While that may be longer than the actual requirement, it may be easier to remember.)

Take advantage of the Windows XP Start menu's pinned items list

You're probably familiar with Start's left side menu—but do you know why the program list is divided in two? Here's what you need to know about the pinned items list found in Windows XP, and how you can customize it to easily access your favorite programs.

The left panel of the Start menu consists entirely of a divided list of programs that Windows XP thinks will come in handy for you: the pinned items list above the separator line, and the most frequently used programs list, displayed below the line.

By default, Windows XP places links to your Internet browser and your e-mail application in the pinned items list and will place as many as 30 shortcuts to the programs that you've recently used in the most frequently used programs list. (The most frequently used programs list is, by default, six shortcuts long.)

In order to really take advantage of the Start menu as a launching area for all the programs you use most often, you can configure the entire left panel as a pinned items list. Here's how:


1. Right-click the Start button and select the Properties command to display the Taskbar and Start Menu Properties dialog box.

2. Click the Customize button adjacent to the Start Menu radio button to display the Customize Start Menu dialog box.

3. In the Programs panel, use the Spin button to set the Number Of Programs On The Start Menu setting to 0. Click the Clear List button.

4. In the Show On Start Menu panel, you can clear the Internet check box because the Internet Explorer icon already appears in the Quick Launch menu by default, and maybe even the e-mail check box, depending on how you launch your e-mail application.

5. Click OK twice—once to close the Customize Start Menu dialog box and once to close the Taskbar and Start Menu Properties dialog boxes.

6. Click the Start button and access the All Programs submenu.

7. Locate and right-click on a shortcut to a program you use most often and select the Pin To Start Menu command.

You can pin as many as 30 of your most often used programs to the Start menu, depending on your screen resolution setting. With your actual favorite programs on the pinned items list, you can now really take advantage of the Start menu.

Speed up Windows XP's defrag operations

Note: This tip applies to both Windows XP Home and Professional editions.
A simple way to speed up a defrag operation in Windows XP is to restart the system before you launch Defrag. This allows the operating system to clear out the swap/paging file and reset it to the default size. This lets Defrag focus strictly on the necessary data on the hard disk without having to stop and manage a huge swap file loaded with unneeded data.
Another approach to speeding up a defrag operation in Windows XP is to configure it to occur immediately upon startup. Fortunately, you can do so easily with this simple registry edit:

1. Launch the Registry Editor (Regedit.exe).
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce.
3. Right-click on the RunOnce subkey and select New String Value.
4. Name the value Defrag and press [Enter] twice.
5. Type Defrag.exe c: /f in the Value Data text box and click OK.
6. Close the Registry Editor and restart Windows.
The defrag operation will begin when you type in your password and press [Enter]. (Keep in mind that values added to the RunOnce key are removed immediately after the command has been run.)

How to Back up Mozilla Firefox and Thunderbird

Backing up Firefox and Thunderbird is easier than you think....

Firefox and Thunderbird Firefox users need to regularly back up to guard against the possibility that their profile gets corrupted or wiped after installing a new extension or a new version of Firefox. If you use Thunderbird then it's even more important that you backup to ensure you don't accidentally lose your email correspondence and account settings.

There are two ways to backup: use a backup utility or do it yourself manually.

Backup Utilities
MozBackup is a free utility written by Pavel Cvrcek that will automatically backup Firefox and Thunderbird as well as Netscape and the full Mozilla suite. It works like a charm - the whole process is driven by a Wizard so easy to use that even raw beginners will be able to set up automatic backups. It also offers encryption of the backup files and a complete push-button restore option.

MozBackup only backs up the essential information rather than all the information in your Mozilla profile but that's fine for most users. You can get MozBackup here: http://mozbackup.jasnapaka.com/index-old.html

Manual Backup
Backing up Firefox and Thunderbird manually is as simple as copying their respective profile folders to another location. If you do that, you’ll have a full backup with all your setting and personal data saved.

The hard part is finding the profile folders. First up, they are not located where you would expect to find them. Secondly, they are located in different places for different versions of Windows. Thirdly, they may be assigned random file names that make them difficult to recognize.
On Windows 2000/XP machines the locations for your Firefox and Thunderbird profiles are respectively:

• C:\Documents and Settings\\Application Data\Mozilla\Firefox\Profiles\\
• C:\Documents and Settings\\Application Data\Thunderbird\Profiles\\

To back these up I copy the profiles to an external USB drive. It's as simple as that. I do it manually but you could also use Windows Scheduler or a backup manager to do the job automatically. Make sure, though, that Firefox and Thunderbird are not running before you backup.