We took a little drive around Columbus, Ohio in December to see if wireless network security had improved since our last outing. In the past, our samples showed large numbers of unprotected wireless networks, but things appear to be changing.

During our random 30-minute wardrive sample, we discovered 36 wireless network access points were visible from our local freeways. Of the 36, 17 (or just shy of half) were unencrypted. This is a nearly 25% improvement from samples taken eighteen months ago, while the number of access points has remained roughly the same.

Nearly all of the access points were broadcasting their SSID, which remains very common, and some say best practice. It seems few companies have embraced the security through obscurity of attempting to hide their SSID from war drivers. This may largely be due to the issue where disabling the SSID broadcast setting actually results in many access points sending the data more often as association and other protocol transactions occur.

Of the 19 encrypted access points, all but one was using WEP as the encryption system, while the other one had been deployed using WPA. While WEP is a proven weak encryption system, it seems to remain the default mechanism for encrypting most small to midsize wireless deployments. Certainly, even with its issues, it's better than nothing at all.

Ten of the 36 access points were configured using the default SSID, which attackers usually use as an indicator of an out-of-the-box configuration. Of those ten default SSID systems, only one had been changed to use WEP -- meaning that likely, attackers are right to assume that the defaults are being used.

Based on the BSSID addresses of the access points and other means, our toolkit was able to fingerprint the manufacturer of ten of the access points. Of those, Linksys was the leader (six), followed by Belkin (two), and Proxim (one), Netgear (one). 26 of the access points were unfingerprinted by our quick drivebys.

Overall, there is improvement. More encryption (even if it is WEP), and less default configurations are being used than what we found 18 months ago. Likely, the newest default configurations that include better protection mechanisms are beginning to show impact. As older devices get replaced with newer ones already configured to be more secure out-of-the-box, it is likely even more improvements will be reached. This winter, you might find a day or so for your security team to recheck your wireless networks. With all of the new security options available for wifi, it is pretty likely some improvements could be made.

ITworld.com

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine