Re: [Full-Disclosure] Wireless Security

From: Dennis Opacki (
Date: 11/28/03

  • Next message: "Re: [Full-Disclosure] Wireless Security"
    To: "Patrick Doyle" <>
    Date: Fri, 28 Nov 2003 10:44:16 -0500

    Hash: SHA1

    The NIST wireless STIG has some good reference information on deploying
    and securing wireless networks.

    Regarding registration of MAC addresses, many APs support Radius for
    MAC address authentication. I have seen setups where users are allowed
    to add their card to a radius database via a web form on a corporate
    intranet. As users typically have to authenticate to a corporate
    intranet, this can help tie a specific user to a card MAC address.
    When cross-referenced with the Radius server logs, than can provide
    some semblance of an audit trail.

    Note that it would be important to add removal of MAC address
    information to your employee termination checklist.

    - -Dennis

    On Nov 28, 2003, at 9:40 AM, Patrick Doyle wrote:

    > Hope this question isn't off topic,
    > I am currently looking at securing wireless networks using Cisco
    > hardware and wanted to check what peoples thoughts are on security.
    > I have read about using LEAP and also IPSEC, my concerns about using
    > LEAP would be that although the client and access point send hashes of
    > the username and password, and also dynamically create WEP keys, the
    > process is still vulnerable to brute force attacks. Now i know you
    > can lock down the Access Point (AP) to specific MAC addresses,
    > however, in our environment i can see wireless being used for meeting
    > rooms etc, so the users would be random which would mean the constant
    > addition / removal of MACs to the AP which would probably not be
    > possible or practical all of the time. Although policy could dictate
    > that when a wireless card is given out, the MAC address in added to
    > the AP, however if you have multiple APs in different areas of
    > building, being administered by different IT depts then this could
    > soon become be a problem.
    > To me IPSEC looks like be the better solution using SecurID tokens
    > (one time passwords) to authenticate users, any thoughts would be
    > appreciated.
    > BBCi at
    > This e-mail (and any attachments) is confidential and may contain
    > personal views which are not the views of the BBC unless specifically
    > stated.
    > If you have received it in error, please delete it from your system.
    > Do not use, copy or disclose the information in any way nor act in
    > reliance on it and notify the sender immediately. Please note that the
    > BBC monitors e-mails sent or received.
    > Further communication will signify your consent to this.
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter:
    Version: GnuPG v1.2.3 (Darwin)

    -----END PGP SIGNATURE-----

    Full-Disclosure - We believe in it.

  • Next message: "Re: [Full-Disclosure] Wireless Security"

    Relevant Pages

    • Re: radius+ wireless
      ... if you or someone else has duplicated a MAC address on the same ... current set up with weak WEP and but decent authentication, ... You didn't mention what kind of wireless, what your coverage area is, ... gear, RADIUS might be sufficient. ...
    • MAC Address Control
      ... I'm also interested in this subject (for setting acces for ... >Can I use the radius server to control MAC Addresses. ...
    • Re: 802.1x mit IAS IP-Adressvergabe
      ... ich habe mir ein 802.1x WLAN mit Cisco 1240 und IAS als Radius gebaut. ... Ich möchte ich damit eine feste Zuordnung erreichen Nutzer - IP ohne MAC ...
    • Re: Cant Use iPhone As Modem For Laptop
      ... >>> position to know precisely what Apple was developing for the Mac II. ... >> your continual suggestions that radius stole ip from apple isn't going ... >> insinuations, ...