Windows 2003 Server SP1 a big plus for wireless LAN security

Posted on by admini

With the recent leaps in cryptanalysis tools that can even crack enterprise grade wireless LANs that use dynamically rotating WEP keys, the encryption bar has been raised to a minimum of TKIP or preferably AES. In order to run these newer encryption algorithms, hardware and software must be certified to a minimum of WPA or the newest WPA2 standard. Unfortunately, performing the upgrade is easier said than done especially if firmwares, drivers, and configuration changes have to be replicated across hundreds or even thousands of clients. While it doesn’t address all of these issues, Windows 2003 Service Pack 1 at least makes the last piece (configuration changes) relatively simple and is a huge step forward for any business grade wireless LAN.

While the original version of Windows 2003 Server already made substantial strides in easing the pain of a large secure wireless LAN deployment, its major weakness was that it couldn’t deal with WPA capable networks. SP1 addresses these weaknesses and really makes it easy to deploy a large secure a wireless LAN. The following summarizes the original feature set of Windows 2003 server and the enhancements of SP1.

Windows 2003 added PEAP authentication capability to its IAS (Internet Authentication Service) RADIUS component. This meant that client side certificates were no longer needed for TLS encrypted authentication which makes it possible to only use a server side Digital Certificate to support thousands of clients who don’t have Digital Certificates. By using the TLS tunnel to secure the password exchange, dictionary attacks on the popular LEAP authentication protocol could be avoided altogether.

The built-in Windows XP WZC (Wireless Zero Configuration) client could now be centrally managed via Windows 2003 Server using Active Directory Group Policy configuration. This meant that every single client computer on a corporate network could be centrally configured to connect to a secure wireless LAN in minutes. Since WPA was only starting to appear at the time Windows 2003 was being released, the policy configuration could only work for 802.1x/PEAP dynamic WEP based wireless LANs. WPA using TKIP or AES encryption was not supported and had to be manually configured from the client side which made it very difficult to deploy.

Fast reconnect for EAP authentication support was added to IAS. Note that this can cause problems with some Access Point manufacturers that don’t deal well with fast reconnect.

Active Directory Group Policy can now configure WPA TKIP or AES encryption settings. Any Windows XP SP1 (with WPA patch) or Windows XP SP2 client machine could now be centrally configured to connect to a TKIP or AES encrypted wireless LAN.

Clients (Windows XP SP2 only) can now also be locked down to a narrow set of administrator approved Digital Certificates and Certificate Signing Authorities. In the past, there was a potential for unsuspecting users to fall victim to man-in-the-middle attacks if an attacker could coax a user into trusting a rogue Access Point which used a fake RADIUS Authentication Server with an alternate Digital Certificate and Signing Authority. The importance of central management cannot be overstressed. This isn’t just a convenience issue but a security issue as well.

http://blogs.zdnet.com/Ou/index.php?p=47

Read more

The U.N. thinks about tomorrow’s cyberspace

Posted on by admini

That remains the province of specialized organizations such as the Internet Corporation for Assigned Names and Numbers, or ICANN; the Internet Engineering Task Force; the World Wide Web Consortium; and regional address registries. Though Zhao is far too diplomatic to state it directly, the ITU’s increasing interest in the Internet could presage a power struggle between ITU, ICANN, and perhaps even the U.S. government, which retains some oversight authority over ICANN and appears content with the current structure.

“The whole world is looking for a better solution for Internet governance, unwilling to maintain the current situation,” Houlin Zhao, director of the ITU’s Telecommunication Standardization Bureau, said last year. Zhao, a former government official in China’s Ministry of Posts and Telecommunications, has been in his current job since 1999. “Countering spam is just one of many elements of protecting the Internet that include availability during emergencies and supporting public safety and law enforcement officials,” Zhao wrote in December.

Also, he wrote, the ITU “would take care of other work, such as work on Internet exchange points, Internet interconnection charging regimes, and methods to provide authenticated directories that meet national privacy regimes.”

This article documents an interview with Houlin Zhao, director of the ITU’s Telecommunication Standardization Bureau.

http://news.zdnet.com/2100-9588_22-5648953.html

Read more

Study indicates Canadians fear identity theft over virus attacks

Posted on by admini

However, 64 per cent of Canadians surveyed were unable to accurately define the term “phishing” – the increasingly common practice of using fraudulent spam emails and fake corporate Websites to fool recipients into divulging personal financial data.

Phishing email messages mimic a legitimate source such as a bank or an online auction site. Messages notify recipients that an update is required to their account information and directs them to follow a link where they are asked to provide personal account information.

In rating security, men and women differed slightly in their online priorities in the Aol study. Forty-two per cent of women versus 36 per cent of men rated identity theft as their number one concern. However, more men (22 per cent) than women (10 per cent) rated spyware or adware tracking their online habits as their primary online security concern.

While Canadians list identity theft (39 per cent), viruses (31 per cent) and spyware (16 per cent) as major security concerns, they are less fearful of spam in general.

Only nine per cent of respondents listed spam among their primary security concerns.

http://www.canada.com/technology/story.html?id=917533a9-8e14-4410-9e5b-3f5c71977cfd

Read more

Phishing attacks ease off

Posted on by admini

Research from the Anti-Phishing Working Group (APWG) found 13,141 new phishing emails were reported to the organisation in February, an increase of just two percent compared to results from January.

The number of phishing Web sites supporting these attacks only rose by 1.8 percent — from 2,578 to 2,625 — over the same period.

Phishing scams attempt to lure victims into parting with confidential information. Scammers typically send an email, purporting to be from a bank or e-commerce vendor, that links to Web sites that mimic those companies, but are actually hosted by scammers.

The group claims that the monthly growth rate of phishing attacks since July 2004 is 26 percent.

However since the APWG results depend on the number of people that report phishing scams to its Web site the increase in reported scams could simply have been due to growing awareness of the APWG and its actions.

It’s not clear why there was such a small rise in reported phishing scams between January and February 2005.

The report also confirmed that scammers have started using a new practice called pharming — a technique that hijacks domain names and secretly redirects users to fraudulent Web sites.

http://news.zdnet.co.uk/internet/security/0,39020375,39193153,00.htm

Read more

Europeans worry about online banking security

Posted on by admini

That means, according to Forrester, banks can’t rely solely on governments or ISPs (Internet service providers) to make the Internet a safe place to do business but must deploy or strengthen two-factor authentication — such as PIN (personal identification number) and TAN (transaction authorization number) — and educate Net users about security precautions, such as firewalls.

European consumers are losing trust in the Internet as a channel for doing business as computer attacks on them and the companies they do business with mount, according to Forrester. Just 30 percent of the 22,907 Europeans polled by Forrester said they are confident of the security of personal financial information, such as credit and debit card numbers, when used to make transactions online.

http://security.itworld.com/4337/050330bankingsecurity/page_1.html

Read more

IPv6 addresses its problems

Posted on by admini

Google has been allocated an address range, marking the start of its permanent presence on the new frontier. And Microsoft has tried to patent it, surely a rite of passage for any new technology that aspires to be taken seriously. In the US and Europe, it is still not on many people’s lists of things to worry about.

It promises to relieve the lack of address space in IPv4, replacing a mere four billion addresses with enough to label every atom on the planet, but so far the use of NAT to hide private networks behind a single public address has meant that nobody is hurting too much so far. It has better security, quality of service and routing, but IPv4 has proved flexible enough to incorporate its own advances here. These take some managing, so the thought of adding the challenges of an entirely new protocol to the mix — everyone expects that both versions will have to run concurrently for many years — will not come easily to those charged with looking after a company’s network.

All that means that ISPs are reluctant to spend the extra money to provide IPv6 — if nobody is prepared to pay more for it, then you’re better off spending on bandwidth, better security and higher reliability. The Japanese love it: major ISPs such as NTT and IIJ support it, and more are joining in. That is due to a rather over-generous allocation of IPv4 address ranges to the US accentuating the shortage elsewhere, and an enthusiastic take-up of mobile access and multimedia services in Asia. When every mobile and fixed phone, television, recording device and games console has its own network address, a household’s need for multiple independent connections to the Internet can overwhelm NAT’s somewhat limited and inflexible support for multiple services running on multiple devices behind the router.

This value is enhanced by the protocol’s other features, such as automatic configuration and understanding of quality of service requirements: at the moment, for example, there are plenty of problems running VoIP telephony through home routers. As a result of such moves, all the major infrastructure manufacturers have been including IPv6 in routers and other devices for some time — so ISPs and major customers have been acquiring the capability by default as part of the normal cycle of equipment upgrades.

Behind the scenes, IPv6 has already been rolling out — and large, specialist networks such as the 33 country European GEANT research system have provided a lot of practical experience in deploying and managing the protocol. 30 out of the 34 Internet exchanges in the European Internet Exchange Association support IPv6, and between them they have 201 IPv6 customer networks — around 11 percent of the total.

http://comment.zdnet.co.uk/0,39020505,39192571,00.htm

Read more