Layer 1 Wireless Security Basics
Let's build on the more technical aspects of the discussed policy considerations. We'll start from physical layer security. The physical layer security of wireless networks encompasses avoiding a signal leaking beyond the defined network boundaries and eliminating all intentional and unintentional sources of interference. We discussed the interference issues in the first part of the book, so here we concentrate on coverage zone spread containment. Limiting the wireless network spread is a rare example of security through obscurity that works (to some extent).
There are two ways of preventing the signal spread beyond the area you want to be accessible for the legitimate users. The first way is limiting the signal strength. In the UNIX world, less is more. The same principle applies to physical layer wireless security. The EIRP should be sufficient to provide a decent quality link to users in the planned coverage zone and not a Decibel more. Pushing the EIRP up to the legal FCC limit is often unnecessary and makes your WLAN a beacon for all war-drivers in the area and a discussion topic for a local 2600 group meeting. There are several points at which you can regulate the emission power:
Access point (all higher-end APs should support regulated power output) Variable output amplifier Appropriate antenna gain selection
In extreme cases you might have to deploy an attenuator device.
The second way is shaping the coverage zone via appropriate antenna selection and positioning. Appendix C includes examples of antenna coverage zones; assess which network shape would suit you to provide access only where it is needed. There are several tips we can provide:
Employ omnidirectional antennas only when absolutely necessary. In many cases sectored or panel antennas with the same gain can be used instead to limit the signal spread. If no outdoor wireless access is needed, position your indoor omnis in the center of the networked building. If deploying a wireless network inside a tall building, use ground plane omnis to make your LAN less detectable from the lower floors and surrounding streets. If omnidirectional coverage is not required, but irreplaceable omnidirectional antennas are all you can have, deploy parabolic reflectors to control signal spread. The reflectors reshape your wireless system's irradiation pattern, effectively turning your omnidirectional antenna coverage zone into an area resembling the irradiation pattern zone of semidirectionals. Of course, this will also increase the signal gain. A typical case when you should consider using reflectors is setting up an access point without an external antenna connector or a possibility to replace the standard "rubber duck" access point omnis with more appropriate antennas. All that a reflector should have is a properly sized, flat metal surface. You can thus make your very own reflector out of nearly anything ranging from wire screens to tin roofing material. A detailed article describing building custom reflectors is available at http://www.freeantennas.com/projects/template/index.html. We also suggest consulting Rob Flickenger's Wireless Hacks (O'Reilly, 2003, ISBN: 0596005598) hack number 70. If deploying a wireless link down a long corridor connecting multiple offices, use two patch or panel antennas on the opposite ends rather than a whole array of omnis along the corridor. Alternatively, you can experiment with a string of unshielded wire plugged into the AP antenna connector and stretched all the way along the corridor length. If properly constructed, such an improvised "no-gain omni" can provide the connectivity in the corridor and in a close space around it without leaking the signal to hostile streets. If your client devices have horizontal antenna polarization, use a horizontal polarization antenna at the access point. The wardrivers' all-time favorite, the magnetic mount omnidirectional is always positioned vertically using the car as a ground plane. If all your antennas have horizontal polarization, the possibility of wardrivers picking up your signal with the magnetic mount omni is dramatically decreased.
|
A radio wave consists of two fields: electric and magnetic. These two fields are spread via perpendicular planes, as shown in Figure 10-1. The actual electromagnetic field is a sum of the electrical and magnetic fields between which the emitted energy oscillates. The electric plane parallel to the antenna element is referred to as the E-plane, and the perpendicular magnetic plane is designated as the H-plane. The position of the E-plane referenced to the Earth's surface determines the antenna polarization (horizontal when the E-plane is parallel and vertical when it is perpendicular to the ground). The majority of access points come with vertically polarized antennas, whereas laptop PCMCIA card built-in antennas are mostly horizontally polarized. On the contrary, built-in CF cards' antennas are polarized vertically. Use your favorite signal or link quality tool to see how aligning the antenna polarization influences the link properties. You will find that when antennas are polarized in an opposite way, the link quality is dramatically decreased. The usual way of sorting out the incorrect polarization problem is by changing the access point antenna direction, but there are vertically positioned omnidirectionals that are, nevertheless, horizontally polarized. These antennas are rare and tend to be expensive.
|
Do not expect that positioning your antennas correctly will bring a perfect, desirable network coverage zone shape. First of all, there is always a small backward coverage area created by the majority of semidirectional and even directional antennas. Yagis have side and back lobes that can stretch quite far when the EIRP is significant. Thus, a wardriver can discover the network by accidentally passing behind the emitting antenna, and a cracker does not have to position himself or herself right in front of the antenna where the security personnel would expect a cracker to be.
Besides, short of building a proper TEMPEST (well, EMSEC) bunker, radio emission containment is a hard task. Due to the signal reflection, refraction, and scattering, the wireless network can be detected by chance from positions one would never imagine it reaching. This underlines the importance of removing all interesting data from the beacon frames. If a wardriver catches a single beacon showing enabled WEP and closed ESSID, he or she is likely to give such a network a miss when there are so many unprotected networks around. Whereas, if the beacon shows the absence of WEP and the ESSID is "Microsoft_Headquarters_ WLAN," the reaction could be entirely different.
|
