Newsstand - Wireless LANs: Trouble in the Air




View Full Version : Wireless LANs: Trouble in the Air


wigstheone
Jan 14, 02, 12:19 pm
As the airline industry scrambles to meet a Jan. 18 deadline to screen every checked bag for explosives, security experts, analysts and government officials are raising serious concerns about the security of wireless technology that's integral to the effort.

At issue is the adoption by airlines of industry-standard 802.11b, or WiFi, wireless LANs operating in the 2.4-GHz band. These systems, which are widely viewed as inherently insecure, are being used to support such applications as bag matching and curbside and roving-agent check-in.


The concerns appear to be justified, based on two investigations that were conducted last week by professional security firms that analyzed airline wireless LAN systems at Denver International Airport and San Jose International Airport.


The analysis in Denver was conducted Jan. 9 by White Hat Technologies Inc., a Westminster, Colo.-based security firm. It revealed that American Airlines Inc. operated wireless LANs totally in the clear without any encryption in its portion of the DIA terminal.


The vulnerability of the American Airlines wireless LAN networks was highlighted by the fact that the security specialists witnessed an intrusion while conducting their monitoring. According to a report furnished to Computerworld, security of the wireless LANs supporting Fort Worth, Texas-based American's curbside check-in stands was further compromised by the fact that the IP address of the curbside terminal was prominently pasted on the monitor.


Except for an administrative network operated by the Denver International Airport authority itself, none of the networks monitored by the security specialists had turned on even the simplest form of encryption: the 40-bit Wired Equivalent Privacy encryption algorithm.

http://www.computerworld.com/storyba/0,4125,NAV47_STO67344,00.html


afang
Jan 14, 02, 6:56 pm
Thanks for the interesting read.

------------------
mailto:Ahfang@earthlink.netAhfang@earthlink.net</A>

pdx1M
Jan 14, 02, 10:56 pm
It would be interesting to know whether they require VPNs to actually access their core network. Running WEP in a net that is there merely to provide access via a VPN server is of no real value. They can run the net wide open and you still can't get anything without tunneling in. I am always warey of these sorts of stories because often the technical realities are more subtle than the headline writer can deal with.


Dorian
Jan 15, 02, 12:01 am
Thanks for the link. This is the business I am in so most interesting!

Dorian

JohnAx
Jan 15, 02, 1:09 am
There was an article linked from dslreports.com last week that explained in technical terms rich enough to convince me that the WEP process was so completely mis-designed that even 128-bit encryption could trivially be decoded. In other words, there's no use turning on the encryption, it does no good at all. If anyone really cares and can't find the article I'll go look it up and post the link.

ScottC
Jan 15, 02, 7:15 am
WEP had beem compromised quite some time ago, currently WiFi is working on a renewed system that should provide some more saftey. Our firm will not install wireless lan's for customers with mission-critical applications until WiFi/RSA have the WEP update available. Using the Linux based application AirSnort (from Apples AirPort) it is possible to "listen" to the WEP keys being exchanged and to therefor compromise security on that Lan http://www.flyertalk.com/forum/frown.gif

afang
Jan 15, 02, 8:50 am
I know some of us at home have wireless lans...it's absolutely great not to trip all over those wires http://www.flyertalk.com/forum/smile.gif

Wirless will rule when all the secruity issues are put to minimal

------------------
mailto:ahfang@earthlink.netahfang@earthlink.net</A>



SEO by vBSEO 3.2.0