Security Issues in IEEE 802.11 WLAN: Wi-Fi Risks and Solutions

Introduction to IEEE 802.11b and Wi-Fi Technology

A relatively new standard introduced by the Institute of Electrical and Electronics Engineers (IEEE), known as 802.11b, has been gaining significant momentum in the marketplace and is poised to change the nature of telecommunications (Patrick 2001). With approval from the Standards Board Review Committee of the IEEE in September 2002, a veritable "Wi-Fi" (wireless fidelity) revolution has been taking place in portions of the unlicensed spectrum, based on the IEEE 802.11b standard. "Products equipped with 802.11g Wi-Fi capability have been on the market for some time now, but a green light from the IEEE is a huge step for 802.11g that could usher in a high-speed wireless networking standard" (Yo! G. September 2003). This new technology is threatening to undermine parts of the business plans of traditional telephone companies; further, such Wi-Fi technology may be an enabler for a future "killer app" (Anderson, Bikson, Hundley & Neu 2003). Two new standards have been established: 802.11a, which extended the speed of 802.11 to 54 megabits per second (though it is not backwards compatible with 802.11b); and 802.11g, which operates at 20 megabytes per second and is compatible (Patrick 2001). Nevertheless, Driscoll (2002) suggests that until there is a pressing need for ultra-high-speed Internet access, or for a proprietary high-speed Ethernet network to allow the exchange of very large files, 802.11b will likely remain the primary standard in most public places for the next several years.

According to Driscoll (2002), 802.11b is the wireless Ethernet standard created in 1997 by the IEEE with the goal of creating unified technology standards. The original 802.11 provided wireless Ethernet and Internet access with top speeds of one to two megabits per second (Mbps); however, in reality it was frequently much slower. The letter "b" was added to the nomenclature in 1999 as a new standard extending the theoretical top speed of 802.11 to 11 Mbps, with an actual speed typically between three and six Mbps. Driscoll suggests this level of processing speed "is plenty fast enough for virtually all of today's broadband applications" (2002, p. 31). The signals for 802.11b are transmitted on the 2.4 gigahertz (GHz) frequency range of the broadcast spectrum; the technology quickly became the de facto wireless Internet standard of choice, with more than 11 million consumers already having some form of 802.11b access, according to a CNN study. Today, 802.11b exceeds wireless application protocol (WAP), 3G (third-generation wireless), and Bluetooth; further, the 802.11b standard can be used with virtually any type of laptop and many PDAs as well (Driscoll 2002).

Unlike WAP and 3G, 802.11b is not restricted to tiny cell phone screens; rather, any laptop, PDA, or desktop computer can be equipped with an 802.11b-compatible card for access to the Internet. In addition, 802.11b has far greater range than Bluetooth, providing 11 Mbps, on average, at 75 feet from a transmitting source (known as an "access point" or "node") and slowing down to 1 Mbps at a maximum distance of about 1,500 feet. By sharp contrast, Bluetooth's transmission distance is approximately 100 feet; however, it should be noted that Bluetooth may be especially useful in fixed devices such as Internet-enabled appliances or wireless connections from PCs to printers (Driscoll 2002).

The flexibility, reliability, and retrofitability of 802.11b have also made it an extremely popular choice for home networking and for retrofitting older buildings where Category-5 local area network cables would be difficult or impossible to install. A local area network (LAN) is a configuration of interconnected computers that can share data, applications, and resources such as printers. Computers in a LAN can be separated by distances of up to a few miles but are typically used in offices or across university campuses. A LAN provides fast and effective transfer of information within a group of users and reduces operational costs as well (Spurgeon 1997). Each computer network can be categorized as either a LAN or a wide area network (WAN). A LAN configuration generally consists of a fairly limited number of computers in a single building or building complex. A WAN, on the other hand, may connect an enormous number of machines on a global basis; in fact, by connecting a number of existing networks, the Internet was born. "Today, the Internet is a worldwide combination of WANs and LANs involving millions of machines. Each network in the Internet is connected to another network by a machine called a router" (Brookshear 2000, p. 142).

The closing decade of the 20th century witnessed the Internet connecting millions of computers all over the world. During these earlier years of development, a number of commercial computer network and data services also provided at least indirect connection to the Internet. These technologies provide the ability for more than one computer to communicate within a defined network: "A LAN is defined as a privately owned data communications system that usually covers a limited territory, hence the term 'local area'" (Spurgeon 1997, p. 17). All such networks employ so-called "protocols" — simply a set of rules by which computers exchange information through a single shared connection. These protocols allow the transmission of data without "collisions," which can be caused by the simultaneous transmission between two or more computers; computers on most LANs today use protocols known as Ethernet or Token Ring (Spurgeon 1997). In 2000, for example, the University of California at Berkeley identified security flaws in the Wired Equivalent Protocol encryption standard used by 802.11 cards and access points, making them vulnerable to decryption by hackers. The IEEE is working on an improved specification that will authenticate users in response to this need for security and standardization in wireless LAN access.

According to the guide for the 802.3 Ethernet system (and the 100BASE-T Fast Ethernet segments which are part of that system), there are two LAN standards that can carry Ethernet frames at 100 Mbps. When the IEEE standardization committee met to begin work on a faster Ethernet system, two approaches were presented. The first was to speed up the original Ethernet system to 100 Mbps while maintaining the original CSMA/CD medium access control mechanism — an approach called "100BASE-T Fast Ethernet." The second approach was to create an entirely new medium access control mechanism based on hubs that controlled access to the medium using a "demand priority" mechanism. This new access control system transports standard Ethernet frames using a new medium access control mechanism, and was further extended to allow it to transport token ring frames as well; as a result, this approach is now called 100VG-AnyLAN. The IEEE decided to create standards for both approaches. The 100BASE-T Fast Ethernet standard is part of the original 802.3 standard, while the 100VG-AnyLAN system is standardized under IEEE 802.12 (Spurgeon 1997, p. 17). The IEEE 802.11b working group created a set of protocols for wireless Ethernet local area networks in 2.4 GHz bandwidth space, describing IEEE 802.11b as "a way to connect our computers and other gadgets to each other and to the Internet at very high speed without any cumbersome wiring — or a significant price tag" (IEEE 802.11b Working Group 2000, p. 5).

Generally speaking, the benefits of installing a WLAN for enterprises and individual consumers include the following:

Flexibility. In older buildings, re-wiring is not always an option due to physical restraints of the building; existing space may also not allow for additional cabling.

Ease of use. Installing a WLAN requires less physical work than installing or adding to a LAN. WLANs have also increased communication and encouraged spontaneity.

Growth capability. WLANs can expand in size and functionality; access points can be added and upgraded. WLANs can start off small and grow in size and complexity as needed.

Mobility. WLANs allow users to move freely around the room, to wherever access points are in operation.

Cost. For general use, a WLAN does not save a great deal of money. The cost of network interface cards increases from about $67 for a standard card to about $180 for a wireless type; however, the overall investment in a WLAN is less expensive than retrofitting cables into old buildings (Charp 2002).

Despite these clear benefits and advantages in terms of ease of use and cost-effectiveness, there are certain risks associated with wireless networking, which are discussed in detail below.