How to Avoid Security Risks for Mobile Computing on Public WLANs

Wireless broadband Internet access via hotspots is convenient for both the casual surfer and the Internet-dependent teleworker. Unfortunately, current security technologies integrated into wireless LAN products offer insufficient protection here, and mobile users must be wary when accessing the central company network via a hotspot.

What is necessary is a security solution that protects the teleworkers' place in all phases of connection construction on hotspots—without risky, foreboding configurations and without the help of users or administrators. This article will illuminate the effectiveness of VPN security mechanisms, data encryption, strong authentication and personal firewalls. Plus, it will show how optimal protection can be achieved by dynamically integrating each of these technologies.

Risks in the WLAN

Each user can access public WLANs with correspondingly equipped terminals. The terminals automatically obtain an IP address, in the sense that they recognize the SSID (service set identifier) of the WLAN. Thus, they put themselves within range of the access points and are able to gain access permission onto the WLAN. Data security, or protection of participating devices from attacks, is not guaranteed by the WLAN operator. Security is limited to monitoring authorized network access in order to eliminate misuse of the server administration. User identification serves solely for the acquisition and the accounting of time online.

However, how does it look regarding the protection of sensitive information during data transmission? How can the PC optimally seal itself off from attacks from the WLAN and the Internet? Because the actual security risk on the hotspot originates from having to register with the operator outside the protected area of a VPN, as a rule it has to take place by means of the browser. During this time frame, the terminal device is unprotected. This stands in opposition to a company security policy that prohibits direct surfing on the Internet and that only permits certain protocols.

Basically, VPN mechanisms and data encryption serve to protect confidentiality. The corresponding security standards are IP Security tunneling and AES (Advanced Encryption Standard) encryption for data, and X.509 v3 for access protection. Additional security mechanisms such as certificates in a PKI (public-key infrastructure) or onetime password tokens complement or replace the usual user ID and password. A personal firewall offers the required protective mechanisms against attacks from the Internet and from the public WLAN. Here, stateful packet inspection is critical. If this is not provided, it is not advised to use a hotspot for mobile computing.

VPN client and external personal firewall

For a VPN solution with a separately installed firewall, the ports for HTTP/HTTPS data traffic to the personal firewall must be activated during hotspot registration. This can take place in three different ways:

1. The firewall rules for HTTP/HTTPS are firmly preconfigured in order to guarantee the functionality with the desired hotspots.

2. The configuration allows that the ports are opened for HTTP/HTTPS as needed for a certain time window (such as 2 minutes).

3. The user has administration rights and independently changes the firewall rules.

In all three cases there exists the risk that the user may surf outside of the secure VPN tunnel on the Internet and encounter destructive software such as viruses, worms or Trojans. Temporarily opening the firewall creates the danger of deliberate misuse by the user on the basis of multiple actuations of the time window. If the personal firewall fundamentally permits no communication outside of the configuration, then the user has to activate the corresponding firewall rules for the duration of registration on the hotspot. This requirements-based opening of the personal firewall involves the greatest risk of misconfigurations. The user must have a firm grasp of the exact changes being made and the exact environment in which they are made. Employee security awareness and technical know-how determine the security level quality.

A large security risk also exists when user data (user ID and password) is spied out externally on the hotspot during the registration process. With the aid of a notebook computer, a hacker can simulate both the hotspot and the WLAN SSIDs. If a user then registers on a hotspot, he does not land at the access point of the provider but rather on the notebook of the hacker. Because of the previously mirrored access point Web pages, the user assumes that he is authenticated on the hotspot. However, in reality, he is on the notebook of the hacker and his personal registration data is now exposed.

Providers always attempt to protect the hotspot registration pages through SSL (Secure Sockets Layer) processing (HTTPS), but that does not always succeed. For example, a user who arrives at a manipulated hotspot obtains the following report from the browser: "A problem exists with the security certificate on the Web site." In the background of this report, the attacker has only recreated the hotspot registration page and does not use the original certificate. For the lay person, this may not be recognizable at first glance, and it is incumbent to him to decide whether or not he should trust the certificate. To avoid placing a user in the position of having to make this decision, the hotspot registration should flow transparently before construction of the VPN. A solution that has proven itself in practice is the so-called registration script that takes over the transmission of registration and the inspection of the certificate at the hotspot.

The requirements for the functionality of a personal firewall with mobile computing on WLANs are multilayered. They also apply to the critical phases during the registration and sign-off process on the hotspot. Requirements must be known at the earliest possible time and should be in place from system start. They also must remain when no VPN connection exists or when it has been deactivated. Furthermore, the user should be safeguarded against arbitrarily reconfiguring or completely shutting off the personal firewall.