Location Detection Tools

By Andrew Garcia  |  Posted 2008-11-09 Print this article Print


Fourth, you may already have defenses in place to protect you from this attack. Companies using Wireless Intrusion Detection and Prevention technology, like that provided by AirTight Networks or Motorola's AirDefense unit, should have some protection from this attack right away. These systems can definitely identify MAC spoofing that would be used as part of an attempt to inject traffic.

Location detection tools could also be useful: Since the attacker has to pose as an access point, the system should throw up immediate warnings if it looks like an access point suddenly moved. 

Presumably, WIPS vendors are right now cooking up new detections as well to help find and correlate any Michael errors that must occur as part of the attack. Since Michael errors are rare (it's pretty hard to accidentally change data payload without changing the checksum hash), a regular stream of Michael errors happening every 61 seconds or so should be easy to detect and send out an alert. 

As a temporary workaround solution, TKIP enjoyed a remarkably good run without coming under serious threat. However, with this first attack now published (and early-generation tools using the attack, like aircrack-ng, available in the wild), undoubtedly TKIP will come under significantly more scrutiny in the months to come. 

Consequently (fifth), even though the encryption is not yet broken, wireless administrators should start re-evaluating the use of WPA and TKIP.  Many companies are already faced with some wireless upgrades to come into compliance with PCI 1.2, which last month finally put a timeline in place for retiring WEP as a security measure on wireless networks carrying sensitive data. For those companies needing to finally retire old scanners, bar code readers or other wireless mobile devices used for transactions, make sure to look for AES support on your next equipment investments.

Fortunately, most enterprise-grade equipment bought in the last four years will have support for AES. However, some patches may be necessary to get common client devices up to speed. Windows Mobile devices running versions prior to WM 6.1 may not offer AES support, so mobile administrators should investigate whether an upgrade is available. 

Also, those who use the Windows XP and the Zero-Config wireless tool (but have not yet installed Windows XP SP3) will also need to install a patch to add AES support.

eWEEK Labs Senior Technical Analyst Andrew Garcia can be reached at agarcia@eweek.com.


Andrew cut his teeth as a systems administrator at the University of California, learning the ins and outs of server migration, Windows desktop management, Unix and Novell administration. After a tour of duty as a team leader for PC Magazine's Labs, Andrew turned to system integration - providing network, server, and desktop consulting services for small businesses throughout the Bay Area. With eWEEK Labs since 2003, Andrew concentrates on wireless networking technologies while moonlighting with Microsoft Windows, mobile devices and management, and unified communications. He produces product reviews, technology analysis and opinion pieces for eWEEK.com, eWEEK magazine, and the Labs' Release Notes blog. Follow Andrew on Twitter at andrewrgarcia, or reach him by email at agarcia@eweek.com.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel