Greg's Technical Blog

WiFi Security – Are you safe online?

Wireless networking or WiFi has become a mainstream way of communication on local networks but security is often overlooked.  In May of this year, Google "admitted" to collecting data from unsecured WiFi networks across the globe during their travels in their Street View Cars.  These cars travel the streets taking 360 view pictures that are used in Google Maps Street View feature.  Google claims that the Street View Cars were also probing for WiFi hotspots so that the hotspots could be pointed out on its maps.  After initially telling German authorities that their WiFi information contained no data other than the SSID and the MAC address of the network's router, Google later admitted that they had 600 GB of  information collected from these unsecured networks.  The "payload data," as Google refers to it, can contain private information which could potentially be passwords, credit card information, email contents, etc... any data that was being sent across that network at the time Google's car passed by.

What's the point?
The point of this is not to shame Google for their activity but more to point out the necessity of WiFi security.  All of the networks on which Google was able to gather data were open or unprotected networks.  Secured wireless networks are not susceptible to this type of activity.  While it sounds very technical, securing a wireless network is not all that difficult.

So how is it done?
Wireless security can be accomplished with 3 basic methods:  WEP, WPA & WPA2.  These methods can also be modified to be more secure by utilizing a protocol know as MAC filtering which we will cover last.  (There are also some other Enterprise level methods of creating wireless security but those will not be discussed here.)

Security Methods
WEP stands for Wired Equivalent Protocol and was the first attempt at securing wireless communications.  WEP enabled networks use a 64 or 128 bit hexidecimal string to encrypt the network traffic.   Users are required to use this unintelligible string to gain access to the network.  The encryption provided by WEP has become extremely easy to crack with readily available software tools.  As such it should not be used at all but it continues to be the default option when setting up home and small office wireless equipment.

WPA stands for WiFi Protected Access.  This protocol was invented to address the security flaws of the original WEP protocol.  There are 2 modes of WPA security, pre-sahred key or PSK mode and 802.11x mode which is more advanced and will not be discussed.  In PSK mode, instead of the hexidecimal string, WPA uses what is known as a passphrase.  Simply put this is a password that is chosen to encrypt the network traffic.  The longer, more complex and harder to guess the passphrase is, the more secure the network will be.  But, despite its improvements over WEP, WPA has be found to have some major flaws in its encryption algorithm, TKIP, which led to the creation of WPA2.

WPA2 also stands for WiFi Protected Access, but it it simply version 2.  This version operates the same way as the orignal WPA but it has introduced a more secure encryption algorithm known as AES.  AES replaces the less secure TKIP but WPA2 networks can still be set in TKIP only or TKIP/AES modes that allow interaction with older wireless devices.

The final piece of the security puzzle is MAC filtering.  Each network device such as a PC, laptop, smartphone etc... has a unique alphanumeric hardware number known as MAC address.  Since this address is unique for every network enabled device, wireless access points can be configured with a list of acceptable MAC addresses.  This means that an wireless admin must collect the MAC address from every machine that will be allowed to access the wireless network and enter those into the list on the wireless access point.  If a device that is not on the list happens to gain access to the passphrase it will still be denied that ability to connect to the network.

Final Thoughts
So is using wireless safe or not!?  The answer is yes and no!  WiFi hotspots like those found in coffee shops etc... are not safe.  This doesn't mean that you should never use them but it means you should be careful HOW you use them.  Save your online banking and shopping for your secured or wired office or home network and use the hotspot for Facebook and email.  That way if you happen to be in the path of a wandering Google StreetView camera car your personal information won't be in danger joining the other 600 GB that Google has already collected.

On the other hand, as a general rule I don't recommend wireless to be widely used in a business setting.  Due to its inherent risks, even when properly configured, sensitive data like medical records etc... is always best left to the old fashioned network cable.  The other issue with wireless beyond security is that it can be relatively unstable.  Improvements in cordless telephone technology have helped but wireless is susceptible to interference from other wireless devices be they wireless or cordless phones, other wireless networks and building infrastructure.  Wireless networks are also not as fast (54Mb/s) as a standard Ethernet network (100 or even 1000Mb/s).   For businesses that demand performance using wired networking is always the best solution.  In some cases using a wired network is not an option due to physical constraints or cost but whenever possible I always recommend wireless as a secondary option.