Designing a sophisticated wireless application with perl.

DigitalKitty has asked for the wisdom of the Perl Monks concerning the following question:

Replies are listed 'Best First'.
Re: Designing a sophisticated wireless application with perl. by waswas-fng (Curate) on Dec 04, 2002 at 05:17 UTC
Just a few ideas to to ccnfigure the wireless network to be secure, you can do this pretty easy: 1. Like you said use WEP. 2. Lock down the AP to MAC addresses that should be allowed on the network. 3. Put a firewall between the AP and the internal network. 4. In addition to WEP (which is breakable) use a VPN solution from client to the Firewall. PTPP or IPSEC clients and servers are fairly available for most platforms. 5. Consider using SSL on the web server. 6. Set up snort or some other IDS on the inside of the firewall -- and _look_ at the reports. The multiple levels of encryption add overhead but make it much more secure -- WEP is very breakable without vpn encapsulation and or SSL once an intruder breaks WEP they can get valuble information to gain access to your network. -Waswas	[reply]
Re: Re: Designing a sophisticated wireless application with perl. by UnderMine (Friar) on Dec 04, 2002 at 09:39 UTC
To extend this further I have even seen suggestions of using SSH Tunneling as yet another layer but this can be counter productive as with a VPN and a good firewall you can lock down the ports that are open within the VPN tunnel (ie only SSL) but if you allow ssh port forwarding you have less control (counter anguments welcome as I would love to be able to lock down port forwarding under SSH). A good VPN tunnel should thave 3DES encription or stronger with Dynamic keys. These rules and tunnels are a pain to set up but worth it in the long term. Another thing you can do while locking down MAC address at the AP is allocate each a fixed IP which sometimes helps if you want to setup Bidirectional VPNs. This is nice if your software needs to be able to push from the server rather requiring the data to be pulled from the client or even if you want to SSH onto the client machine to upgrade the software. Don't just look at the server side of security locking down the client is as important as locking down the server. If I hack the client and get it to spool data to a file and then email me that file.... And for the ultra paranoid that can afford it a nice firewall between your web server and database server can help a lot. Making Wireless LAN Security Air Tight is an interesting read. location-based services has some interesting points in relation to this also Homeland security waiting for Wi-Fi might be of interest. also Wi-Fi gets a security boost contains more info on WFA a more secure version of WEP Hope that ramble helped UnderMine Update: Added client side issues Update: Added report link Update: Added new security realted report link Update: Added WFA report link	[reply]
Re: Re: Designing a sophisticated wireless application with perl. by hardburn (Abbot) on Dec 04, 2002 at 16:25 UTC
Like you said use WEP. I wouldn't bother with WEP at all. Like you said, it's broken, and can only serve to give the illusion of security. Lock down the AP to MAC addresses that should be allowed on the network. I'm not a big fan of restricting by MAC addresses. An attacker can just sniff your network for a while to figure out what MAC addresses are being allowed and then change the MAC address on their own card. In addition to WEP (which is breakable) use a VPN solution from client to the Firewall. PTPP or IPSEC clients and servers are fairly available for most platforms. Now we're getting somewhere. VPN, IPSec, and SSH tunnelling are probably the only good ways to secure a wireless network. I've also heard of a project that, using two or more anttenas, it triangulates the position of a client on the wireless network. This allows you to restrict people on your network by their physical location. (Sorry, I heard about this from a LUG meeting, so I don't have a link. The theory is sound, though.)	[reply]
Re: Re: Re: Designing a sophisticated wireless application with perl. by waswas-fng (Curate) on Dec 04, 2002 at 19:31 UTC
I suggest using WEP because it will add a hurdle to a possible attack, even with 40bit WEP it can take quite a while to gather enough weak packets to break the key. Most APs have updates that lower the amount of weak packets that are generated. MAC address filtering on the AP only makes the solution more secure by requiring the attacker (after breaking WEP) to _see_ an active client bound to the AP to know its MAC, It adds a small step but for little amount of work it takes to set up it is worth it IMHO. As far as triangulation of the client I have seen some demos and logic behind it but I am not sure that that would fit in with the original poster's concept of "outside the building" =) I guess my bottom line is: Make as many hurdles for an attacker to jump over as possible -- With the items I suggested all in place the three "weakest links" in the whole picture are the laptop being used as the client, the person with the password using the laptop, and the physical server. -Waswas	[reply]
Re: Designing a sophisticated wireless application with perl. by pg (Canon) on Dec 04, 2002 at 04:43 UTC
Although encryption is one the weakest part of the wireless environment, it is not worse than fixed land network. There is another weak point, which is much worse in wireless network than fixed network, that's the authentication part. In a wireless network, it is much easier for a third party to break into an ongoing session or authentication process, and steal data, or even initiate the authentication process by pretending to be an authorized user. One of the problem is that, normally the first part of the authentication process is not encrypted until later, and in a wireless environment, it is easier for intruders to quickly intercept data.	[reply]
Re: Designing a sophisticated wireless application with perl. by paulbort (Hermit) on Dec 04, 2002 at 19:51 UTC
This is really more of a network engineering issue, I don't really see how Perl enters into the security much at all. Lots of good suggestions in previous posts, here's my distillation of the ones I like and my own spin: 1. SSL encryption (or better) is absolutely required. Whether you do WEP on top of that or not is up to you. 2. Since the wireless protocols are sniffable, you should assume that your wireless network is 'outside' just like the internet is 'outside'. A firewall is a good start, a firewall with a DMZ for the web/db servers is even better. If you tell the firewall to simply drop and ignore any traffic that isn't a VPN, most attacks will be ignored. 3. I really like using keypairs instead of passwords for something like this. For the truly paranoid, insist on montly maintenance on every laptop, where you watch it do a full disk scan for viruses, malware, unauthorized software, etc., and also REPLACE the private key. For maximum paranoia, restore a disk image each month and then replace the key. (Probably takes about as long as the virus scan.) 4. Don't forget to put at least a software firewall on the laptops, again configured to ignore anything incoming that isn't part of expected VPN traffic. 5. If do the firewall and secure VPN things on both ends of the connection, the client and server neither know nor care that they happen to be sending bits over the air instead of copper. Keeping the OSI layers separate helps keep down suprises. Good Luck! -- Spring: Forces, Coiled Again!	[reply]
Re: Designing a sophisticated wireless application with perl. by foxops (Monk) on Dec 04, 2002 at 19:41 UTC
If you want to restrict access by location, you could also get a few directional antennae and setup an omni directional fake AP generator {http://www.blackalchemy.to/project/fakeap/]. But I suppose a Net-BSD sniffer in the right place could eventually figure out who is talking to who (whom?).	[reply]