Wi-Fi security has been an issue ever since wireless LANs emerged in the corporate arena during the 1990s, since signals could be snooped from physically unprotected areas. But while the security issues of enterprise Wi-Fi have been largely fixed, growing public use shared over unencrypted networks brought new risks, while the more recent and rapid proliferation in Wi-Fi offload leading towards carrier Wi-Fi has introduced a new dimension altogether. Given that Wi-Fi is relatively mature now there are many tools available for mitigating the various threats, but the problem for carrier Wi-Fi and offload is in fitting them all together in such a way that quality of service and transparent roaming are enabled.
Some of the problems spring from the fact that the public hotspots which mobile carriers are offloading onto are still unmanaged and operate in open associations with no link-layer security. This renders them open to a variety of traditional attacks, from plain eavesdropping to the capture of unencrypted personal information, to various ways of intercepting a user’s session. The latter includes the evil twin attack, where an attacker sets up a rogue access point whose SSID (the 32 bit code identifying a Wi-Fi network) is set the same as that of an access point deployed by a legitimate hotspot provider; and also ARP (Address Resolution Protocol) spoofing, where the attacker identifies two nodes and pretends to each of these that it is the other, persuading them to start communicating so that it can intercept the two way traffic. In all these cases there are then various tools such as Dsniff that can be employed to extract personal information by parsing application layer protocols.
Most threats can be avoided by users aware of the risks and deploying appropriate tools but in practice even people working on high security applications have their lapses and so human nature has to be taken into account. Not surprisingly then the Wi-Fi security problem is increasing in proportion to the level of deployment. According to the 2013 Identity Fraud Report by Javelin Strategy & Research, the number of identity fraud victims in the US increased to 12.6 million in 2012, 1 million more than a year earlier. But more striking was the finding that a large amount of fraud has switched to online with huge growth in malware and fishing exploits over unsecured Wi-Fi connections.
Most of this fraud took place where people were at least knowingly connected to Wi-Fi even if they might have unwittingly been diverted to a spoof access point. But with heterogeneous networks combining Wi-Fi and cellular, users should ideally not to have to know or care which one of the two their data is currently traversing. In that case it should be equally immaterial from a security perspective which one is used, which is why carriers have been waving the flag for the Next Generation Hotspot (NGH) and in particular the Hotspot 2.0 standards defined by the Wi-Fi Alliance, incorporating SIM based authentication.
AT&T gave the first big lift to Hotspot 2.0 in January 2013 when it introduced support for international Wi-Fi roaming featuring SIM-based authentication for automatic Wi-Fi sign-up abroad. This type of service is likely to become more commonplace later this year as the standards underpinning seamless authentication are commercialized. The Wi-Fi Alliance’s Hotspot 2.0 and Passpoint initiatives, increasingly integrated with the WBA’s (Wireless Broadband Alliance) Next Generation Hotspot (NGH) platform, will enable operators to progress from basic simple data offload via Wi-Fi hotspots to managing 3G/4G and Wi-Fi as a single pool of capacity in an integrated heterogeneous network, transparently to the user. Authentication works by handsets first connecting to a cell tower so that the service provider can then divert traffic from the macro network onto NGH Wi-Fi hotspots if the cell tower is congested or on the basis of other rules, for example automatically rerouting at times of day that are usually busy. The point is that for customers, phones will jump onto the best network available, whether that be Wi-Fi or the cellular macro network, without their having to take any action.
Then just last week, June 10 2013, Apple gave Hot Spot 2.0 its ringing endorsement at its Worldwide Developers Conference in San Francisco, introducing support for it in iOS 7. This will certainly help Hotspot 2.0 gain mainstream adoption and speed up certification of devices via the Wi-Fi Alliance’s Certified Passpoint program. Mobile devices that are Passpoint-certified can roam via the Hotspot 2.0 standard and log onto compatible Wi-Fi access points automatically.
With Hotspot 2.0 deployed there is still the issue of encryption to protect eavesdropping, which is more of a risk over Wi-Fi. This has already been dealt with in the corporate Wi-Fi world through WPA2 (Wi-Di Protected Access II), superseding the previous security specification, Wired Equivalent Privacy (WEP), which turned out to have serious vulnerabilities. Also known as IEEE 802.11i or sometimes RSN (Robust Security Network), WPA2 includes AES (Advanced Encryption Standard). This brings link level protection, using RSA cryptography with key renewal, whereby session keys are changed periodically to protect against attacks that would otherwise detect them.
The question is then what else can go wrong. The answer is plenty, with as always most risks resulting from human fallibility. After all not that many people take the various recommended precautions when accessing the Internet over public hot spots, such as ensuring firewalls are turned on if they have them, using unique strong passwords for every website that requires them, checking with the hotspot provider what the actual name is, turning off file and print sharing mechanisms to avoid personal information leaking that way, disabling settings that automatically connect to any available Wi-Fi network, and only using websites that are encrypted. Very few people do half those things.
Then the process of ensuring end to end encryption itself raises some implementation and performance related issues in heterogeneous networks where managed and unmanaged networks operate side by side. This could be a greater issue for enterprise and BYOD users accessing corporate networks, because one of the main problems arises through use of IPsec for creating secure end to end encrypted tunnels across an external or public network, including the Internet. IPsec is really designed for situations where both ends of the link are managed and trusted and works well across corporate Wi-Fi networks where this is the case. But when an IPsec tunnel is established between a mobile device and a third party carrier gateway, this can in some cases cause the data to be encrypted and decrypted twice, which causes unnecessary processing and so saps battery life in client devices. It also corrupts end to end QoS mechanisms that rely on marking IP packets to give them the correct priority, so performance of real time services can be screwed up.
So even though Hotspot 2.0 is riding to the rescue there is plenty of work for providers to do to deliver truly secure robust carrier Wi-Fi services.