February 09, 2009, 2:24 PM — A large-scale scan by Motorola's AirDefense group has found that wireless LAN vulnerabilities in retailer networks though much improved over last year, are still all too common, despite repeated, widely-publicized wireless security breaches.
The scan of WLANs in big city shopping malls found about 44% of some 3,900 client devices detected, including barcode scanners, notebooks PCs and mobile computers, could be compromised, according to Motorola AirDefense CTO Amit Sinha. (Compare Wireless LAN Security products.)
That percentage is a huge drop from last year's survey, which found 85% of the detected client devices were exposed in various ways.
Retailer access points were better protected: 68% of just over 7,900 access points were using some kind of encryption, leaving nearly one-third of them with no data scrambling at all. That percentage is worse than last year, which found that 35% of the detected access points were wide open. And of those that were encrypted, 25% in the new survey were using Wireless Equivalent Privacy (WEP), a flawed encryption scheme that can be cracked in minutes by a knowledgeable attacker, according to Sinha.
Business data breaches are mounting. In its most recent study of 43 companies that suffered a data breach in 2008, the Ponemon Institute found the total cost of coping with the consequences rose to $6.6 million per breach, up from $6.3 million in 2007 and $4.7 million in 2006. For 84% of these companies, it was déjà vu all over again: the 2008 breach was at least their second.
Not all of these are due to wireless weaknesses, but many are, including the now-notorious TJX breach. A Canadian government report confirmed attackers accessed data by compromising WEP-encrypted access points at two of the retailers' stores in Miami.
[Compare wireless LAN security products with our online Wireless & Mobile Product Guide]
The AirDefense scan was the company's second annual survey of wireless security in the retail market. Sinah and other AirDefense staff used the company's flagship monitoring software and Wi-Fi card, AirDefense Mobile, to scan, but not penetrate, some 4,000 retail locations in North America, Europe, and this year, also in Australia and Korea, during the latter half of 2008.
Twelve percent of the scanned access points were using Wi-Fi Protected Access, an industry specification based on the then-draft IEEE 802.11i security standard, which was intended to strengthen wireless LAN security. The follow-on WPA2 is based on the final IEEE standard (and adds pre-authentication and pairwise master key caching).
Both WPA and WPA2 can be configured with different authentication options, which confirm two communicating devices can be trusted, and with different encryption schemes (TKIP and the stronger AES), which scramble the data over the WLAN. The choices affect the overall security of the WLAN.
This year's survey found 27% of the access points used WPA2, but generally did not break the data down to account for the possible variables.
One breakdown that was released found that 27% of the encrypted access points used WPA with a pre-shared key (WPA-PSK). AirDefense points out that if this shared password is broken, the network is open. If the same key is replicated in scores or hundreds of stores, all of them become vulnerable if the key is broken. But in commenting on last year's survey, security consultant George Ou noted that when deployed with a "reasonably complex password of 10 or more random alphanumeric characters," WPA-PSK has not been broken.
Ou also noted a practical reason for using WPA-PSK: chain stores often lack redundant WAN links to remote RADIUS servers for 802.1x authentication, and if the WAN breaks, equipment like wireless cash registers lose RADIUS authentication. WPA-PSK can keep them operational even if the WAN goes down.
Another prime area of vulnerability, according to Sinha, results from wrongly configuring access points. Based on the scans, AirDefense concluded that 22% of the access points were wrongly configured. They retained the out-of-the-box default settings, for example. Or two-radio access points would have security enabled for the 2.4GHz band, but not for the 5GHz band. Another problem was activating both WPA and WEP in a single access point. "If you allow both, you are only as safe as the weakest [security scheme]," Sinha says.
Retailers are under some pressure to improve wireless security at least for the credit card data they handle. Aruba recently unveiled a new release of its AirWave WLAN management software, with changes to monitor compliance with version 1.2 of the Payment Card Industry Data Security Standard (PCI/DSS). Among other things, PCI 1.2 bans as of March 31 the use of WEP in new retail WLANS, and requires WEP to eliminated from existing WLANs by June 30, 2010.