Layer 1 Wireless Security Basics

by Hazrul Aaron.
Share
|
Homepage | Submit your article | Contact | TOS
More articles on network security  

You are here: Categories » Electronics and communication » Network security

Let's build on the more technical aspects of the discussed policy considerations. We'll start from physical layer security. The physical layer security of wireless networks encompasses avoiding a signal leaking beyond the defined network boundaries and eliminating all intentional and unintentional sources of interference. Here we concentrate on coverage zone spread containment. Limiting the wireless network spread is a rare example of security through obscurity that works (to some extent).

There are two ways of preventing the signal spread beyond the area you want to be accessible for the legitimate users. The first way is limiting the signal strength. In the UNIX world, less is more. The same principle applies to physical layer wireless security. The EIRP should be sufficient to provide a decent quality link to users in the planned coverage zone and not a Decibel more. Pushing the EIRP up to the legal FCC limit is often unnecessary and makes your WLAN a beacon for all war-drivers in the area and a discussion topic for a local 2600 group meeting. There are several points at which you can regulate the emission power:

  • Access point (all higher-end APs should support regulated power output)

  • Variable output amplifier

  • Appropriate antenna gain selection

In extreme cases you might have to deploy an attenuator device.

The second way is shaping the coverage zone via appropriate antenna selection and positioning. There are several tips we can provide:

  • Employ omnidirectional antennas only when absolutely necessary. In many cases sectored or panel antennas with the same gain can be used instead to limit the signal spread.

  • If no outdoor wireless access is needed, position your indoor omnis in the center of the networked building.

  • If deploying a wireless network inside a tall building, use ground plane omnis to make your LAN less detectable from the lower floors and surrounding streets.

  • If omnidirectional coverage is not required, but irreplaceable omnidirectional antennas are all you can have, deploy parabolic reflectors to control signal spread. The reflectors reshape your wireless system's irradiation pattern, effectively turning your omnidirectional antenna coverage zone into an area resembling the irradiation pattern zone of semidirectionals. Of course, this will also increase the signal gain. A typical case when you should consider using reflectors is setting up an access point without an external antenna connector or a possibility to replace the standard "rubber duck" access point omnis with more appropriate antennas. All that a reflector should have is a properly sized, flat metal surface. You can thus make your very own reflector out of nearly anything ranging from wire screens to tin roofing material. A detailed article describing building custom reflectors is available at http://www.freeantennas.com/projects/template/index.html. We also suggest consulting Rob Flickenger's Wireless Hacks (O'Reilly, 2003, ISBN: 0596005598) hack number 70.

  • If deploying a wireless link down a long corridor connecting multiple offices, use two patch or panel antennas on the opposite ends rather than a whole array of omnis along the corridor. Alternatively, you can experiment with a string of unshielded wire plugged into the AP antenna connector and stretched all the way along the corridor length. If properly constructed, such an improvised "no-gain omni" can provide the connectivity in the corridor and in a close space around it without leaking the signal to hostile streets.

  • If your client devices have horizontal antenna polarization, use a horizontal polarization antenna at the access point. The wardrivers' all-time favorite, the magnetic mount omnidirectional is always positioned vertically using the car as a ground plane. If all your antennas have horizontal polarization, the possibility of wardrivers picking up your signal with the magnetic mount omni is dramatically decreased.

Sidebar The RF Foundations. Antenna Polarization

A radio wave consists of two fields: electric and magnetic. These two fields are spread via perpendicular planes. The actual electromagnetic field is a sum of the electrical and magnetic fields between which the emitted energy oscillates. The electric plane parallel to the antenna element is referred to as the E-plane, and the perpendicular magnetic plane is designated as the H-plane. The position of the E-plane referenced to the Earth's surface determines the antenna polarization (horizontal when the E-plane is parallel and vertical when it is perpendicular to the ground). The majority of access points come with vertically polarized antennas, whereas laptop PCMCIA card built-in antennas are mostly horizontally polarized. On the contrary, built-in CF cards' antennas are polarized vertically. Use your favorite signal or link quality tool to see how aligning the antenna polarization influences the link properties. You will find that when antennas are polarized in an opposite way, the link quality is dramatically decreased. The usual way of sorting out the incorrect polarization problem is by changing the access point antenna direction, but there are vertically positioned omnidirectionals that are, nevertheless, horizontally polarized. These antennas are rare and tend to be expensive.


Do not expect that positioning your antennas correctly will bring a perfect, desirable network coverage zone shape. First of all, there is always a small backward coverage area created by the majority of semidirectional and even directional antennas. Yagis have side and back lobes that can stretch quite far when the EIRP is significant. Thus, a wardriver can discover the network by accidentally passing behind the emitting antenna, and a cracker does not have to position himself or herself right in front of the antenna where the security personnel would expect a cracker to be.

Besides, short of building a proper TEMPEST (well, EMSEC) bunker, radio emission containment is a hard task. Due to the signal reflection, refraction, and scattering, the wireless network can be detected by chance from positions one would never imagine it reaching. This underlines the importance of removing all interesting data from the beacon frames. If a wardriver catches a single beacon showing enabled WEP and closed ESSID, he or she is likely to give such a network a miss when there are so many unprotected networks around. Whereas, if the beacon shows the absence of WEP and the ESSID is "Microsoft_Headquarters_ WLAN," the reaction could be entirely different.

Share
Leave a comment or ask a question
Total comments: 0

Network security Disclaimer

  • The e-articles directory is not responsible for any and all copyright infringements by writers and authors. If you suspect the information contained by this page for any copyright infringements, please contact us to investigate the issue
Why to Deploy a VPN - The motivation behind building VPNs is spread along different sectors of human nature, be it cost reduction or privacy of the communication. The common part lies in virtualization of communicat (more...)
Suspicious Events on WLAN - Once a sufficient number of network behavior statistics are gathered, a proper wireless IDS can start looking for the suspicious events indicating the possibility of malicious attack. These eve (more...)
Reasons why Wirelwss Networks are hacked - In the "good old days," Internet access was a privilege of the few and many used to try getting access by all means possible. A common way to achieve unauthorized access was wardialing, or call (more...)
Wireless Crackers: Who Are They - Knowing what kind of individual might launch an attack against your wireless network is just as important as being aware of his or her motivations. From the motivations already outlined, it is (more...)
Wireless Security Policy - The first thing to start from when deploying and securing a corporate wireless network is a design of a proper wireless security policy. The best source of information on writing a detailed a (more...)
The Usefulness of WEP Closed ESSIDs MAC Filtering and SSH Port Forwarding - This brings us to the topic of enabling WEP, closed ESSIDs, and MAC filtering as protective measures. Such defenses are "bypassable", you know how to do it. However, there are still sound reaso (more...)
Network Vulnerability Analysis - Vulnerability analysis, sometimes called vulnerability scanning, is the act of determining which security holes and vulnerabilities may be applicable to the target network. In order to do this, (more...)
Wireless attacks at Corporations Small Companies and Home Users - There is a general misconception that only large enterprises are at risk from cracking, wireless cracking included. This is a myth, but it is very prevalent. Large corporations are where the mo (more...)
Practical Use of Asymmetric Cryptography: Key distribution Authentication and Digital signatures - The basic idea of using asymmetric cryptography is distributing public keys while keeping the private keys private and using a person's public key to encrypt data sent to this particular indivi (more...)
Deploying a Linux Based Custom Built Hardened Wireless Gateway - We have to ensure the security of the gateway that separates our AP or bridge or wireless-connected VLAN from the wired side. Such gateways are nothing more (or less) than a flexible stat (more...)
 
free content
    Copyright © 2006 - 2012 e-articles.info.
The texts, articles and tutorials in the directory are property of their respective owners and authors.