10 IT Problems You Might Not Know You Have

Your Wireless LAN Is Talking About You

Even though you may have spent countless hours locking up your wireless LAN—segregating data, voice and guest traffic, implementing certificate based WPA2 (Wi-Fi Protected Access 2) security, and constantly monitoring for rogue access points or client activity—the network could still be leaking valuable information about your wired infrastructure, providing an easily detectable fountain of information that intruders could use to map out devices and services on your network.

As wireless intrusion prevention maker AirDefense pointed out in a survey of business zones within the city of San Francisco prior to the RSA conference in March, many wireless LANs are leaking unencrypted enterprise traffic like CDP, VRRP, Spanning Tree, or NetBIOS. This kind of information can be gathered to identify the types of equipment running on a corporate LAN, as well as the names and addresses of chatty Windows machines. And at least potentially, an intruder could attempt to inject incorrect protocol traffic back into the network.

Wireless intrusion prevention overlay networks like those from AirDefense or AirTight Networks will be able to detect this kind of information leakage—provided you configure the right types of alerts—but administrators can also use a number of portable analysis tools to similar effect.

For-pay troubleshooting tools like AirMagnet’s Laptop Analyzer or WildPackets’ OmniPeek are certainly useful, but even freeware tools and a sharp pair of eyes can suss out suspect leakage as well. In fact, AirDefense’s scan of San Francisco businesses was done by one man walking around town with laptop running the open-source BackTrack tool kit (www.remote-exploit.org/backtrack.html).

After detecting this kind of suspect traffic, it is then a matter of reading the documentation or talking with your WLAN provider to find out how to configure your network to staunch the egress of this telltale broadcast traffic. --AG

Next: Web 2.0 Technology Infiltration Risks >>