2. The Rogue Access Point
The definition of unauthorized access point (or
rogue access point) is the "wireless access point that
are installed without explicit authorization from a
local network management" [1] Some define the rogue
access point as "Wi-Fi Access Point which is setup by
an attacker for the purpose of sniffing wireless network
traffic" In this paper we summarize the rogue access
point as two definitions:
− Definition 1: Rogue access point is the access
point that is installed to the network without
authorization and does not follow the
organization’s security policy.
− Definition 2: Rogue access point is the access
point that is setup based on the malicious intention
to compromise the company’s information system
i.e, data sniffing going through the rogue access
point.
An access point with the criteria that falls in either
definition is considered to be the rogue access point.
There are four common types of rogue access point as
the follows:
1) Employee’s rogue access point: Employees buy an
access point and installs it on the company’s LAN
for their own convenient uses without the
authorization. The rogue access point creates the
vulnerability to the network. It enables
unauthorized users or attackers from outside to
access the company’s network. This type of rogue
access point is very common especially in the
organization that is lacking of the wireless security
policy and secuity awareness training for
employees.
2) Attacker’s external rogue access point: The rogue
access point is setup outside the company and
does not connect to the company’s network.
Typically the attacker will use the high
transmission power and high antenna gain rogue
access point with the spoof SSID. It aims to allure
the target employee to connect the rogue access
point. All user traffic is redirected through the
rogue access point and analyzed by the attacker.
This attack is called Man-in-the-middle-Attack.
3) Attacker’s internal rogue access point: The rogue
access point is setup inside the company and does
connect to the company’s network. The attacker
will use this rogue access point as the backdoor to
access the network at later time.This rogue access
point is unlikely because the attacker has to bypass
the physical security and access to the internal
LAN. But once it is successful, it would be a
serious security breach. Typically the attacker will
disable the broadcast SSID in order to hide it from
others to notice.
4) Neighborhood rogue access point: The access
point is setup by other company in the close
vicinity. Some people do not consider this as the
rogue access point because of the unlicensed and
share media of wireless LAN. The administrator
has no authority to control or shut down legitimate
access points of other company. But it is the good
practice to educate their employees to be aware of
neighborhood access point. Inadvertantly
connecting to the neighborhood access point
would compromise the security.
In order to mitigate rogue access point it needs two
processes 1) Rogue access point detection to identify
the rogue access point and 2) Rogue access point
countermeasure to disable the rogue access point.
Previous works in rouge access point detection
focus on two approaches: 1) Client based rogue access
point detection and 2) Network based rogue access
point detection. Client based rogue access point
detection use the client computer to implement the
rogue access point detection [2][20]. [2] proposed
technique called Client Conduit to detect rogue access
point by changing wireless network interface card (i.e,
client NIC) to act like an access point then collect
wireless data for analysis. [20] proposed agent-based
solution install on the client computer to operate the
real time rogue access point detection by compairing
MAC address from sniffing with the registered MAC.
Network based rogue access point was proposed in
[3][4]. [3] proposed rogue access point detection based
on temporal traffic characteristics. The paper measured
inter-packet time of the traffic to differentiate between
traffic from regular wired LAN and traffic from
wireless LAN. Result of paper described 80% of wired
LAN inter-packet time is less than 1ms, while 90% of
wireless LAN inter-packet time is greater than 1ms. [4]
proposed the measurement of TCP-Ack pairs traffic to
differentiate between traffic from wired LAN and from
wireless LAN. In addition, there are quite a few
commercial rogue access point detection available in
the marker. Most of them are based on the dedicated
wireless sensor to perform the RF detection. The
commercial products like AirWave[5], AirDefense [6],
AirMagnet [7], Wifi Manager [8] and Cisco WLSE [9]
are proprietary.
2. The Rogue Access Point
The definition of unauthorized access point (or
rogue access point) is the "wireless access point that
are installed without explicit authorization from a
local network management" [1] Some define the rogue
access point as "Wi-Fi Access Point which is setup by
an attacker for the purpose of sniffing wireless network
traffic" In this paper we summarize the rogue access
point as two definitions:
− Definition 1: Rogue access point is the access
point that is installed to the network without
authorization and does not follow the
organization’s security policy.
− Definition 2: Rogue access point is the access
point that is setup based on the malicious intention
to compromise the company’s information system
i.e, data sniffing going through the rogue access
point.
An access point with the criteria that falls in either
definition is considered to be the rogue access point.
There are four common types of rogue access point as
the follows:
1) Employee’s rogue access point: Employees buy an
access point and installs it on the company’s LAN
for their own convenient uses without the
authorization. The rogue access point creates the
vulnerability to the network. It enables
unauthorized users or attackers from outside to
access the company’s network. This type of rogue
access point is very common especially in the
organization that is lacking of the wireless security
policy and secuity awareness training for
employees.
2) Attacker’s external rogue access point: The rogue
access point is setup outside the company and
does not connect to the company’s network.
Typically the attacker will use the high
transmission power and high antenna gain rogue
access point with the spoof SSID. It aims to allure
the target employee to connect the rogue access
point. All user traffic is redirected through the
rogue access point and analyzed by the attacker.
This attack is called Man-in-the-middle-Attack.
3) Attacker’s internal rogue access point: The rogue
access point is setup inside the company and does
connect to the company’s network. The attacker
will use this rogue access point as the backdoor to
access the network at later time.This rogue access
point is unlikely because the attacker has to bypass
the physical security and access to the internal
LAN. But once it is successful, it would be a
serious security breach. Typically the attacker will
disable the broadcast SSID in order to hide it from
others to notice.
4) Neighborhood rogue access point: The access
point is setup by other company in the close
vicinity. Some people do not consider this as the
rogue access point because of the unlicensed and
share media of wireless LAN. The administrator
has no authority to control or shut down legitimate
access points of other company. But it is the good
practice to educate their employees to be aware of
neighborhood access point. Inadvertantly
connecting to the neighborhood access point
would compromise the security.
In order to mitigate rogue access point it needs two
processes 1) Rogue access point detection to identify
the rogue access point and 2) Rogue access point
countermeasure to disable the rogue access point.
Previous works in rouge access point detection
focus on two approaches: 1) Client based rogue access
point detection and 2) Network based rogue access
point detection. Client based rogue access point
detection use the client computer to implement the
rogue access point detection [2][20]. [2] proposed
technique called Client Conduit to detect rogue access
point by changing wireless network interface card (i.e,
client NIC) to act like an access point then collect
wireless data for analysis. [20] proposed agent-based
solution install on the client computer to operate the
real time rogue access point detection by compairing
MAC address from sniffing with the registered MAC.
Network based rogue access point was proposed in
[3][4]. [3] proposed rogue access point detection based
on temporal traffic characteristics. The paper measured
inter-packet time of the traffic to differentiate between
traffic from regular wired LAN and traffic from
wireless LAN. Result of paper described 80% of wired
LAN inter-packet time is less than 1ms, while 90% of
wireless LAN inter-packet time is greater than 1ms. [4]
proposed the measurement of TCP-Ack pairs traffic to
differentiate between traffic from wired LAN and from
wireless LAN. In addition, there are quite a few
commercial rogue access point detection available in
the marker. Most of them are based on the dedicated
wireless sensor to perform the RF detection. The
commercial products like AirWave[5], AirDefense [6],
AirMagnet [7], Wifi Manager [8] and Cisco WLSE [9]
are proprietary.
การแปล กรุณารอสักครู่..