Tunneling over the Intranet

In the past, companies tended to think about "us" and "them," using firewalls to establish a secure perimeter between untrusted outsiders and trusted insiders. This view is increasingly giving way to layered perimeters that enforce more granular security at workgroup, system, and user levels. These policies are commonly implemented with operating system access controls - for example, file and printer sharing privileges extended in a Windows NT domain, based on login authentication through the Primary Domain Controller.

However, authentication and access control alone are insufficient. Intranet client/server applications that exchange sensitive data - for example, a payroll system - must be protected from insider abuse. Ethernet LANs are a broadcast medium. Any PC on the LAN can capture traffic passively without detection. Using readily available hacker tools, insiders can easily perform MitM attacks on cleartext LAN traffic, modifying and inserting packets.

Companies that trust Ethernet LANs need to reexamine this policy when adding wireless LANs (WLANs). WLAN access points are often incorrectly deployed behind the corporate firewall, treating all stations on the WLAN as trusted. Doing so is a blanket invitation to intruders. WLANs based on IEEE 802.11b WiFi broadcast radio signals hundreds of feet in every direction - even beyond the physical premises. Furthermore, WiFi shared key authentication and Wired Equivalent Privacy (WEP) encryption often go unused because they are difficult to administer and have serious flaws.

As a result, visitors in the lobby or a "war driver" in the parking lot can easily use freeware like NetStumbler or AirSnort to discover a WLAN. By recording packets with WEPCrack, hackers can break WEP keys and decipher WLAN traffic. At that point, the WLAN becomes vulnerable to the same Ethernet LAN attacks previously discussed. If the wireless access point is inside the firewall, nothing stands between the intruder and the corporate network.

Tunneling with Secure Shell can protect corporate intranet traffic by defeating WLAN exploits like AirSnort, NetStumbler, and WEPCrack, as well as passive eavesdropping and active MitM attacks that can be performed on any unprotected LAN. Furthermore, combining Secure Shell with proper placement of the wireless access point and a single access rule on the corporate firewall can prevent would-be intruders from penetrating the corporate network.