24-Aug-2006/23-Sep-2006

The support for Peer-Peer (Ad Hoc) wireless on Microsoft Windows workstations is problematic at best and should be avoided. Man in the middle attacks and "Evil Twins" can be avoided with a little care.

Discussion

Wireless on Microsoft Windows includes support for "Peer-Peer (AdHoc)" as well "Infrastructure" networks. Peer-Peer networking involves two or more laptops communicating directly with one another -- it is sometimes used for gaming. Infrastructure support involves an access point that the laptop connects to that relays traffic to the larger Internet. The campus wireless network is an Infrastructure network with robust connectivity to the Internet.

If you are not careful you may automatically connect to a Peer-Peer network when you mean to connect to an Infrastructure network. That can have nasty consequences if the peer you connect to is malicious -- the peer can act as a man in middle to capture all traffic you send and receive (also known as the Evil Twin). Further, if you have connected to a Peer-Peer network your laptop will advertise that it is ready and willing to connect to or host similarly named networks in the future. This can be a problem for those connecting to you.

A convenient option is to have your wireless card automatically connect to any available wireless access point. This saves you a few steps at home or at work when getting online. The downside of an automatic connection is that you may end up connecting to a rogue access point, otherwise known as an "evil twin."

Recommendations

• Disable your wireless when not in use -- on most laptops a function button is used to shut it down (on my Dell laptop it's ALT-F2). This will extend your battery life so you can work longer without a battery recharge.

• Before connecting to any wireless network you should make sure you know what you are connecting to. You should never connect to any peer-peer (Ad Hoc) networks.

• If you do connect to a peer-peer network make sure you remove it from the list of networks you will automatically connect to.

• We strongly recommend that you disable automatic connection to any new networks and limit your connections to Access point (infrastructure) networks only:
  1. Click the "Start" button and navigate to the "Control Panel" and then to "Network Connections."
  2. Right mouse-click on the "Wireless Network Connection" and choose "Properties".
  3. Pick the "Wireless Networks" tab, then the "Advanced" button:
     • Make sure that the check box next to "automatically connect to non-preferred networks" is not checked.
     • Click on Access point (infrastructure) networks only to avoid ad hoc networks.

  This configuration prevents you from automatically connecting to any new networks and refuses all ad-hoc networks.

See also

• Microsoft Windows Silent Adhoc Network Advertisement (by) Nomad Mobile Research Centre, 14-Jan-2006.
• Tip of the Day - Home Wireless Gateways (by) SANS Handler's Diary, 20-Aug-2006.
• Using Wireless Technology Securely (pdf) (by) US-CERT, 2006.
• Evil Twins a Menace to Wireless Security (by) Jack M. Germain, TechNewsWorld, 06/04/05.

Credits

Much of the above is from the Nomad Mobile Research Center -- we are greatful for the information provided.

---

Finally, if you have any questions/concerns or need help please let us know.

Information Systems & Technology
University of Waterloo
200 University Avenue West
Waterloo, Ontario, Canada N2L 3G1
519 888 4567 x37070

Contact Us | Give Us Feedback | Privacy Statement