WIDS/WIPS

introduction wireless intrusion detection system (wids) is a technology designed to protect wireless networks from unauthorized access it achieves this by monitoring traffic on the network to identify any suspicious activity that may indicate a security breach wireless intrusion prevention system (wips) employs a combination of techniques to detect and prevent intrusions in real time this system not only monitors but also takes action to prevent rogue access points, man in the middle attacks, denial of service attacks, and any other threats to the wireless network why are these systems important? wi fi presents a tempting attack surface for threats that can compromise data and network security while wi fi standards have evolved and become more secure with advancements in wi fi security protocols, hackers can still exploit a variety of vulnerabilities so, using wids/wips is essential for several reasons improved wireless security wids/wips are designed to detect and alert concerning any unauthorized activities on the wireless network in real time this is important to secure sensitive data and prevent unauthorized access to your network compliance some industries are required to use intrusion detection systems as a part of regulatory requirements wids/wips can help meet compliance regulations by providing a detailed audit log of network activity and potential breaches increased visibility wids/wips allows businesses to monitor their wireless networks visually this includes tracking access points, users, devices, and more, which is beneficial for identifying potential weak areas in the network and improving security measures proactive threat management using wids/wips means being proactive about threat management rather than reacting to security incidents after they happen, a wids can warn you of potential vulnerabilities and threats before they become security incidents protects from inside and outside threats wids/wips protects from external threats and potentially harmful activities originating from inside the network, providing a comprehensive wireless security solution protects wireless networks traditional ids solutions are primarily geared toward wired networks they analyze network traffic, searching for patterns or behaviors indicative of malicious activities while they are adept at detecting threats on wired networks, they might lack the specialized capabilities required to detect and mitigate threats specific to the wireless spectrum nile's way of doing wids and wips the nile access service ensures that the overlay wireless security vector is secure traditional vendor based wids solutions need a high level of expertise to configure the wids functionality the complexity in these solutions requires experts to fine tune the settings if not done right, customers get an overwhelming number of events or alerts that could be false or inactionable nile brings the ‘nile way’ to wids by making it zero configuration, always on, and turnkey the wids functionality kicks in right at service activation, taking on the onus to expertly enable the protection and alerting against top wi fi intrusion threats nile is able to effectively detect, alert, and mitigate rogue access points from the get go the nile wids uses sophisticated correlation techniques that intelligently filter out non wired neighboring/friendly access points in the vicinity, to truly alert about real threats—such as a rogue access point that is connected to the lan the benefit of the nile full wireless and wired lan service is the end to end visibility it is able to detect the port number where the rogue ap has been plugged in and block the port, thus stopping the proliferation of the intruder into the wired lan and further into the wider network furthermore, the rogue ap alert provides location information for the customer to send it personnel to physically remove such rogue aps what are the different threat vectors in wireless networks? rogue access points rogue access points, or those not approved by it, can cause a security threat if permitted to connect to the network many enterprises have a policy of not allowing third party wi fi access points to connect to the corporate network if a rogue ap connects to the network, it can broadcast its own wlan to unsuspecting users this creates an entry point for non corporate devices to connect to the corporate wlan if end to end security measures are not in place this is the classic definition of a rogue ap if not detected, bad actors can safely operate outside the physical perimeter of the enterprise, connecting to the rogue’s wlan from the parking lot, finding an entry point into the enterprise lan wids and wips help to protect against rogue access points evil twins or honeypot an evil twin ap, also known as a honeypot ap, is a form of rogue ap that makes a malicious access point look like a legitimate one once users connect to the evil twin ap, attackers can intercept any data traffic passing through this ap this is called a man in the middle attack it may result in the compromise of login credentials and other sensitive information, such as banking data if the user carries out transactions when connected to the evil twin organizations should use a wips to detect the presence of an evil twin ap and prevent any corporate clients from connecting to them what is the difference between an evil twin and a rogue ap? a rogue access point is an illegitimate access point plugged into a network to create a bypass from outside into the legitimate network it may or may not be malicious for example, an employee may connect a router that functions as a rogue ap, but without ill intent however, a lack of malicious intent does not mean that it should be connected to the network an evil twin is also a rogue, but it is by definition malicious that’s because it is set up to impersonate a legitimate access point attackers use evil twins to lure unsuspecting victims into connecting so that they can steal information sniffers and snoopers sniffers and snoopers typically operate passively, which means that they do not send or transmit data over the network instead, they simply listen in on network traffic, intercepting and recording data packets as they are transmitted between devices on the network criminals can use commercially available software to spy on unencrypted data in transit over the air between devices and wireless access points while traffic on most websites is encrypted, this is not the case for every site mobile apps also sometimes fail to encrypt data traffic, in part because encryption imposes an overhead cost on the computing resources that support the app on the back end wids and wips do not protect against snoopers and sniffers it teams can use wpa2 or wpa3 to encrypt data in transit over the air between devices and access points dos attacks dos attacks can take several forms for example wireless interferers affecting wi fi frequencies can be used to jam certain frequencies ad hoc networks or peer to peer wi fi networks typically involve a corporate issued device connecting to another non corporate network that may have been set up as a wireless network by a malicious actor connecting to one of these makes it easy for malware to infect a network since its traffic is not going through the corporate network firewall attackers can send a flood of de authentication messages to connected devices, causing disruption to end users as they become disconnected from the network worse, this can be the first step in an evil twin/mitm attack, because when users get disconnected from a legitimate source of wireless connectivity, they may connect to the evil twin when they attempt to restore connectivity this is one example where these hacking techniques are used in combination nile's approach to wids/wips classify successful detection starts with successful classification by learning the environment authorized aps nile aps will be authenticated automatically by our switches, they use a trusted processing module to authenticate the nile ap to our cloud and also use macsec to authenticate the ap to the neighboring/connected switch authorized end devices following the zero trust principles within a nsb, every device connected to the nile service will be authorized and authenticated neighbor's aps in a shared environment, all the other aps in the vicinity that are not wired to the nile infrastructure are classified as neighbor's aps nile aps have a 3rd radio which is dedicated towards wireless scanning which will be able to identify the other bssids that are bring broadcast into the network detection/alert nile service will be able to detect and categorize the threats into the following rogue ap any non nile element that is connected to the service should be authorized and authenticated on to the network, so when a third party access point is connected to the nile service, assuming these devices are not authenticated via 802 1x, they will be waiting for approval please navigate to the nile portal >> settings >> access management >> wired without an admin manually approving this request, the device will not be able to get an ip address and hence cannot pass any traffic on to the network in case, someone approved the request, based on the fingerprinting data that we collect, our system will detect that the device is a third party access point and create an alert that a suspected rogue access point is detected please navigate to nile portal >> alerts >> search for security events as this is a rogue ap, most likely it might nat all the traffic out of its interface onto the nile system when the traffic is nat'ed even though the source mac address and the ip address will be re written by the rogue ap, the nsb will see two packets with the same ip and mac address with two different ttl values and that confirms the detection of a rogue ap if the user navigates to the nile portal >> devices page, the 4th tile shows the overview of the clients detected under wids/wips if you click on the rogue ap, you can go into further details about the client and find out the vendor it belongs to and the timeline of the events if the rogue ap is not nat'ing the traffic, based on the fingerprinting data and also by comparing the wired mac address with the bssid's broadcasting from the rogue ap, we will be able to detect them and an alert is showed on the nile portal misassociated clients in case of a rogue ap that is in bridge mode where the packets are not nat'ed, as the traffic from that client is ingressing from the same switch interface as the rogue ap, it will be categorized as a misassociated client and it will also show the details related to which rogue ap it is connected to honeypot ap a non nile ap broadcasting the same essid and/or bssid that of a authorized nile ap, should be detected as ‘honeypot’ impersonation attempt these aps are defined as non wired malicious aps that are impersonating an enterprise ap to lure clients to it as the first step to what’s to follow later such aps can be detected by tracking the presence of vendor specific information element (ie) in the beacons of the impersonating ap as nile has its own custom ie in the beacons that is encrypted, any other third party ap that is trying to impersonate a nile ap certainly differs from the ies in our beacons and hence can be detected easily mitigate rogue ap after a succesful detection of a rogue ap, the nsb will take the following actions so that the ap will not be able to pass any traffic shutdown the wired port on the access switch where the rogue ap is detected change the mab rule on the nile portal from approved to denied send an alert to the customer via email/webhook if they have subscribed for it customer user case a healthcare customer with several clinics across the us, deployed nile naas and found a wireless rogue ap connected to their network within minutes of activation the customer was unaware that this rogue ap existed in their network most likely it was put in months ago to create a temporary network this ap created security vulnerabilities by potentially creating entry points into their network from outside