Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vendor Pinpoints Serious WLAN-RADIUS Security Breach

A known wired network security flaw is an even greater risk when enterprise WLANs are added to the mix, a wireless network security and management vendor said Monday.

The flaw enables relatively easy interception of encrypted keys between a wireless access point and a RADIUS server, according to David Callisch, communications director for Aruba Wireless Networks. The recently-ratified 802.11i wireless security standard doesn't solve the problem, he added.

While this is the same flaw that has been previously discussed for wired networks, the problem is made worse by wireless technology.

"Wireless inherited the flaw but wireless also exacerbates it," Callisch said. "With wireless, people can mount attacks more easily and use publicly available tools. They can mount the attack from outside, but also from inside. Anybody who sets up a rogue access point, even if their intent isn't malicious, also opens up (the network) to attack."

By contrast, the flaw required the attacker to tap directly into a wired network, which is a more difficult task, Callisch noted. He said Aruba will present a paper on the flaw next week to the IETF.

  • 1