User's Guide

malicious user with basic computer skills, a laptop, and a CD drive can obtain various sets of open
source tool kits which will transform the laptop into a fully configured wireless attack platform.
As time has progressed these tools kits have become increasingly easier to use while oering an
increasingly sophisticated toolset. The bottom line is the wireless attack tools have become accessible
to a broader range of users. Because exploits involve active interaction with the wireless network,
AirDefense recommends timely action to understand and mitigate the threat to minimize security
exposure. Exploits Alarms are broken down into the following three sub-types:
• Active Attacks - Active attacks subcategory includes active malicious interaction with the wireless
network. Active attacks are severe and present a high security risk and potential for significant
exposure. Because these events are active in the wireless network, timely investigation is
recommended to prevent the attack from continuing. These events can be mitigated wirelessly to
minimize and prevent continued exposure; mitigation can be initiated manually by the administrator
or automatically if the system has been configured for policy-based termination.
• DoS - Denial of Service (DoS) events can cause significant disruption in the wireless networks by
preventing a user from accessing a wireless resources. In wireless networks, DoS events can happen
in two forms: the first form is a DoS attack directed at a specific device and the second form is a DoS
attack directed at the wireless medium. Device level attacks will aect one or more devices
depending on the attack setup; broadcast attacks for example can impact all stations associated to
an , whereas a more directed attack will only impact a single station leaving other stations
connected to the . In either case DoS attacks of this nature consume wireless bandwidth. The second
type of attacks directed at the medium exploit inherent flaws in the 802.11 protocol impacting all
devices on the channel by making the medium temporarily unusable. Denial of Service (DoS) attacks
by themselves are of little use to a hacker or malicious user, but they may serve as the foundation for
other more significant exploits.
• Impersonation Attacks - Many of the parameters in the 802.11 specification which are used to
uniquely identify wireless networks and the wireless devices themselves are contained in clear
unencrypted sections of the wireless trac. Malicious users who listen to trac in promiscuous
mode are able to easily learn what these parameters are. Because the current 802.11 standard
doesn't oer any validation of these parameters techniques called spoofing or identity theft have
been developed to impersonate wireless devices to exploit wireless networks. Impersonation
exploits are performed through the use of tools which craft wireless trac substituting some of the
learned parameters into the transmitted trac. Because the wireless devices are unable to
distinguish the impersonated trac from the legitimate trac, all trac is processed as legitimate
trac including the malicious trac. Impersonation is the foundation of a significant percentage of
basic and advanced wireless exploits and may be the first sign of a sophisticated attack.
Alarm Library
To view a list of Exploits Alarms for each alarm sub-type, go to Configuration > Operational
Management > Alarm Configuration, open Exploits, and then open the alarm sub-type to see all the
alarms associated with the sub-type.
Infrastructure Alarms
Infrastructure Alarms alert you to events that are generated based on the SNMP traps received from the
infrastructure devices. Each infrastructure device is capable of forwarding SNMP traps to alert the ADSP
of significant events related to the device. Examples of SNMP traps include ColdStart indicating that a
device has recently rebooted or CPU Limit Exceeded indicating that the CPU on a device has reached a
critical level for a period of time. The SNMP traps received from infrastructure devices are configurable
Configuration
Tab Alarm Configuration
Extreme AirDefense User Guide for version 10.5. 621