Trustwave pen tester says 802.11 FHSS networks aren't as safe as many companies think
A security researcher at next week's Black Hat Europe will demonstrate a simple, low-cost method for hacking wireless networks commonly used in shipping and warehousing facilities.
Rob Havelt, practice manager for penetration testing at Trustwave's SpiderLabs unit, will demonstrate how easy it is to attack legacy 802.11 FHSS networks, which are often seen as inherently secure because so few off-the-shelf tools are available for remote eavesdropping.
The 802.11 FHSS technology has been outmoded in most wireless applications, but it is still commonly used in warehousing facilities because it works so well with inventory management equipment, such as handheld bar-code scanners and printers.
"Penetrating an 802.11 FHSS network is mistakenly believed to be financially and technologically out of reach for the common hacker, costing thousands of dollars and requiring a high skill set," Trustwave says. However, using easy-to-obtain tools, such as GNURadio and the USRP, Havelt will present code and techniques to penetrate such networks at a low cost, the company says.
"This demonstration will prove particularly important for those organizations that discount the risk 802.11 FHSS networks pose to security," Trustwave says. "These access points, generally connected to the corporate LAN, if compromised, could expose personally identifiable information, such as Social Security numbers and/or cardholder data."
Often, no controls are in place between these networks and corporate LAN environments, leaving a large hole for hackers to penetrate, according to the company.
"This demonstration will prove to naysayers that these legacy wireless networks need to be reviewed for security issues and included in the scope for compliance with the Payment Card Industry Data Security Standard if the entity stores, processes, or transmits cardholder data," adds Robert McCullen, chairman and CEO of Trustwave. "We've seen security firms ignore the need to scope these types of networks, giving erroneous advice to their clients and providing a false sense of security."
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author(s)
You May Also Like
Securing Code in the Age of AI
April 24, 2024Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024