full-disclosure - Wireless Security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200311302321.hAUNLN722135@netsys.com>
From: MChenetz at comcast.net (Michael Chenetz)
Subject: Wireless Security

Patrick,
	I am currently working on a wireless solution for some big
enterprises. The solution we chose was to implement WPA2 which includes AES
encryption. We wanted something cheap for businesses to deploy while
maintaining a high level of security. WPA2 is part of the forthcoming
802.11i security standard. Although it is not ratified, many devices have it
implemented already. Anything with the broadcom 802.11g chipset has AES with
WPA2. 

	If you are worried about central management and authentication level
encryption, you should go with a radius server and client. We chose funks
solutions which uses TTLS to authenticate the client and encrypt the data.
After the user info is verified it sends the encryption to the AP to use AES
between the client and itself. If you need more info, feel free to respond
back.

Michael Chenetz
Network Security Analyst
Dynamic Strategies
Mike.Chenetz@...inc.com
609-655-1041

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Patrick Doyle
Sent: Friday, November 28, 2003 9:41 AM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] Wireless Security

Hope this question isn't off topic, 

I am currently looking at securing wireless networks using Cisco hardware
and wanted to check what peoples thoughts are on security.

I have read about using LEAP and also IPSEC, my concerns about using LEAP
would be that although the client and access point send hashes of the
username and password, and also dynamically create WEP keys, the process is
still vulnerable to brute force attacks.  Now i know you can lock down the
Access Point (AP) to specific MAC addresses, however, in our environment i
can see wireless being used for meeting rooms etc, so the users would be
random which would mean the constant addition / removal of MACs to the AP
which would probably not be possible or practical all of the time.
Although policy could dictate that when a wireless card is given out, the
MAC address in added to the AP, however if you have multiple APs in
different areas of building, being administered by different IT depts then
this could soon become be a problem.

To me IPSEC looks like be the better solution using SecurID tokens (one time
passwords) to authenticate users, any thoughts would be appreciated.

BBCi at http://www.bbc.co.uk/

This e-mail (and any attachments) is confidential and may contain personal
views which are not the views of the BBC unless specifically
stated.
If you have received it in error, please delete it from your system. Do not
use, copy or disclose the information in any way nor act in
reliance on it and notify the sender immediately. Please note that the BBC
monitors e-mails sent or received.
Further communication will signify your consent to this.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html