Freakquency

Back in Black!

2017-07-06T07:49:00.000-07:00

For those of you looking at my work status and saying, "What's up with that?" Let me enlighten you.

In the past 6 months since I have left, radical change occurred at Aerohive. Two people whom I truly admire and respect, took over management of the "Product" that Aerohive produces:The worlds most advanced WLAN architecture. Alan Amrod and Abby Strong. Under this leadership, with the assistance of an incredible team and with many other changes in both personnel and strategy, they have encouraged an amazingly invigorated engineering team to squash more bugs, improve performance, add new features and improve the overall usability of all aspects of Aerohive HiveManager and HiveOS.

These improvements, so many in such a short time, visible to me on my very own Hivemanager, illustrated to me what an amazing team Aerohive has and what a terrific product they manage. Then Abby asked me to join and oversee authentication and 3rd party developer support including APIs as the product owner. With so much positive energy and real progress in place, how could I say no?

Many who know me, understand that these are long held passions of mine and now I have the opportunity to finish the work I began under Bill Hoppin, several years ago. Accompanying me will be another former member of the Aerohive BD team who shares the same passions for APIs and easier to use and access authentication (I will let him explain in his own words if he is so inclined).

So you see, this move is logical and super positive. To those who may roll their eyes at this, just you wait and see what we can do! To my colleagues at Cloud4wi, I am still a hard core believer and supporter. To my Aerohive friends, Guess who is Back in Black?!!

A Look at PCI 2.0 and the New Wireless Guidelines

2011-10-20T14:11:00.000-07:00

THE PAST
I have been predicting that the PCI Standards Council would be moving towards more stringent requirements for WLANs, specifically requirements for full time monitoring, scanning and protection. I also was waiting to see suggestions that “all-in-one” solutions that provides both connectivity and security fall short of the mark. I am happy to see these predictions coming true, especially in light of the PCI-DSS v2.0.

Near the end of last year the PCI Standards Councilpublished, Ten Common Myths of PCI DSS. The very first myth addressed is that, “One vendor and product will make us compliant”. The text reads, “Many vendors offer an array of software and services for PCI DSS compliance. No single vendor or product, however, fully addresses all 12 requirements of PCI DSS. When marketing focuses on one product’s capabilities to the exclusion of other PCI DSS requirements, the resulting perception of a “silver bullet” might lead some to believe that a point product provides “compliance,” when it really only addresses just one or a few elements of the standard.” It goes on to say, “The PCI Security Standards Council urges merchants, service providers and processors to avoid focusing on point products for data security and PCI DSS compliance. Instead of relying on a single product or vendor, you should implement a holistic security strategy that focuses on the “big picture” related to the intent of PCI DSS requirements. This approach includes people and processes, not just technology.”

A large number of merchants today are buying into the idea that a single vendor (Cisco, Aruba, Juniper etc.) can cover all your needs with regard to PCI compliance. This is a very alluring message to the CIO who is making budgetary decisions and would prefer to limit the cost and variables in implementing a compliance solution. However, aside from endangering an organization’s PCI compliance, if you ask any Information Security Engineer they will say the same mantra they have been saying for years, “Limit your exposure and risk through a best of breed - layered security model.” Or, in other words, use layers of products from different vendors and processes developed in house to best protect your organization

THE PRESENT
At the end of the summer this year, the PCI Standards Council released a new set of guidelines meant to clarify their positions in version 2.0 of PCI-DSS on the security of wireless networks, specifically 802.11 (Wi-Fi) networks and Bluetooth.

In section 1.1 of the guidelines it state the purpose that the of the document is to provide, “guidance and recommendations for deploying wireless networks including 802.11 Wi-Fi and 802.15 Bluetooth technologies, in accordance with the Payment Card Industry Data Security Standard (PCI DSS). The goal is to help organizations understand and interpret how PCI DSS applies to wireless environments, how to limit the PCI DSS scope as it pertains to wireless, and to provide practical methods and concepts for deployment of secure wireless in payment card transaction environments.”

A majority of the guidelines are normal common sense approaches to securing WLANs (such as ensuring the physical security of any wireless devices, changing default passwords and settings and securely configuring wireless devices, use strong authentication and encryption, use strong cryptography and security protocols etc.) however some new ideas were put forth which shows the increasingly urgent need for full time monitoring and the prevention of wireless intrusions.

Intrusion Detection and Prevention
Section 4.3 addresses WLAN monitoring systems, specifically WIDS and WIPS systems. It states in reference to section 11. 4 of the PCI-DSS 2.0, “Use intrusion-detection systems, and/or intrusion-prevention systems to monitor all traffic at the perimeter of the cardholder data environment as well as at critical points inside of the cardholder data environment, and alert personnel to suspected compromises.” This is a very important addition. It means companies who were previously attempting to get by with quarterly scans are now being asked to implement full time wireless Intrusion detection and/or prevention solutions.

The next sentence gets even more specific, “Keep all intrusion-detection and prevention engines, baselines, and signatures up-to-date.” A quick check of the market today reveals that almost all infrastructure vendors have a very small list of signatures and vulnerabilities to look for and furthermore, they only release new security signatures/alarms when it coincides with a new major release of the entire WLAN system. Typically, this occurs about once every 12-24 months and requires the customer to upgrade all WLAN controllers, APs and all management platforms. This, coupled with the fact that the newer code may contain bugs or anomalies tends to make IT managers cautious about implementing new code system wide.

WLAN WIDS/WIPS vendors tend to be a bit more agile releasing new vulnerability alarms and attack signatures every 6-12 months although in some cases you may get a patch release on the heels of a widespread and well publicized WLAN vulnerability with a few weeks, but again, the admin must upgrade the entire system (server, clients, sensors etc.) to get the benefit of these new alarms. AirMagnet however has implemented its Dynamic Threat Update (DTU) feature for its AirMagnet Enterprise solution in the first part of 2011, ensuring that all of its customers comply with section 4.3 of the new guidelines.

As an example of what a difference to an organization this makes, we can just look to the last highly publicized WLAN hack, the Cross Site Scripting vulnerability in ArubaOS and AirWave Administration Web Interfaces. This vulnerability which allows, “an attacker to plant an AP with maliciously crafted SSID in the general vicinity of the wireless LAN which would be able to trigger a XSS vulnerability in the reporting sections of the ArubaOS and AirWave Administration WebUIs” was posted on Wed, 6 Jul 2011. Within a few days AirMagnet had code written and was testing this attack in house with the ability to prevent access to the malicious AP. By the 25th of July 2011 every AirMagnet Enterprise 9.0 customer was protected from it.

Alerting to Misconfigurations
Lastly, Section 4.3.2 of the guideline, entitled, “Detection of unsafe activity or configurations” states that, “A wireless IDS/IPS can detect misconfigurations and unsafe activity by monitoring and analyzing wireless communications. Most can identify APs and clients that are not using the proper security controls. This includes detecting misconfigurations and the use of weak WLAN protocols, and is accomplished by identifying deviations from organization-specific policies for settings such as encryption, authentication, data rates, SSID names, and channels.” No single vendor solution monitors its own configuration. They are the configuration system, they believe you should just trust them when they say they are implementing you policy of using strong authentication. And in many cases where bugs appear how could they know that they are misconfigured in the first place? WLAN management systems (Controller, APs etc.) get bugs, all systems get bugs and at other times, people make mistakes. Only a WLAN Intrusion Detection/Prevention system, Like AirMagnet Enterprise, can do that. Just another reason for implementing a separate WIPS solution, one that looks specifically for items such as:

AP Configuration Changed (Security)
AP Using Default Configuration
AP Configuration Changed (SSID)
Device Unprotected by IEEE 802.11i/AES
Device Unprotected by 802.1x
Device Unprotected by EAP-* (the * stands in for PEAP, TLS, TTLS etc.)

THE FUTURE

While today, these rules are really just very strongly worded suggestions, I am willing to go out on a limb now and predict that, unless something dramatic changes the landscape in the next 6-12 months, the PCI Standards Council will insist on full time and independent monitoring and protection of the airspace around your facilities in the next version of the PCI-DSS. Fully integrated solutions will not work as they do a very poor job of responding to new threats and they are similarly poor at ensuring that they themselves are meeting policy and all independent wireless intrusion prevention systems will have to have dynamic threat systems, to ensure the timely delivery of new alarms for recent threats, vulnerabilities and hacks.

All documents referenced in this article may be found here at the PCI alliances website.

Sadder Still

2011-10-05T17:09:00.000-07:00

My Hero

Sad

2011-08-25T10:29:00.000-07:00

Turn down that NOISE!!!

2011-08-12T18:08:00.000-07:00

Here is a fun experiment if you have a 2 laptops (or 1 laptop and some other WiFi enabled device), a WLAN analyzer like AirMagnet WiFi Analyzer (or something similar such as wireshark) and a microwave oven.

We all know that microwave ovens function in the 2.4Ghz range but how much "noise" is it generating.

Go to your kitchen. Get the device without an analyzer on it and start a really long file transfer via WiFi. Make sure your AP is already on either channel 11. Now Fire up your analyzer and measure the signal, noise and the signal to noise ratio (SnR is signal minus noise) on channel 11. Get an average reading and write it down. Do it several times so you are sure you have a good sample set. Now, restart your file transfer, put a pyrex (or other microwave safe) measuring cup full of water in your microwave and set it for a few minutes on high. Re-measure your signal, noise and SnR. What did you get? Try a few different WiFi adapters with the analyzer. any difference?

Here is what I saw when I did it with the AirMagnet WiFi Analyzer. First is the image of the channel screen on channel 11 with no microwave turned on. Notice the stats.

Signal: -51dBm
Throughput: ~34Mb/s
Utilization: 68%
Noise: -88dBm
SnR: 37 (-51) - (-88) = 37

Here is the important part. Notice that the noise level is completely flat at -88dBm.

Now lets turn the microwave on and do it again, here is what I saw.

Signal: -47dBm
Throughput: ~16Mb/s
Utilization: 39%
Noise: -88dBm
SnR: 41 (-47) - (-88) = 41

Notice anything? Well first off throughput went down and I checked the capture later and packet loss went up. Seems appropriate with a 1200watt device slamming my connection from 2 feet away. Secondly, the signal strength and the SnR INCREASED? Why is that? Well after looking deeper into the frames and looking at the AP configuration, it looks like 802.11N beamforming in action! The AP senses packet loss and pushes harder (no-tech speak for adjusts the phase shift of the signal to focus the waves on top of the client so it gets the benefit of wave addition). Next thing you notice is the increase in SnR from 37 to 41. This is due to two issues. The first we just mentioned. Increased signal strength. The second is the trouble spot. The noise level stayed the same.

What?!!

You heard right, the noise level did not change. I can hear you yelling at me through the intertubes from here. But I thought microwave oven caused noise? Well. they do and they do not. Here I am about to get pretty picky.

You see we at AirMagnet call noise one thing and interference another and WiFi interference a third. Confusing but true. And with good reason. You see, noise readings are fiction. They are falsehood, fabrication, fib. It is a lie. There. I said it. Noise readings (except from a very small number of cards - namely only one kind that I know of) are made up on the spot by each WiFi adapter. They cannot give you a noise reading, they can only give you bits (e.i. 1s and 0s) about things they see and WiFi adpaters only see WiFi modulation. Period. Almost all wifi adapters throw away all other non-WiFi signal long before it ever gets to the the driver. Non-wifi modulation, such as the modulation you get from cordless phone, wireless headsets, video camers etc are thrown away by the radio long before they can be converted to bits. The radios are only tuned for the type of modulation and coding they understand. So a normal 802.11a adapter will only ever pass OFDM modulation. Never QPSK, or FHSS or any other signal that is not OFDM. Thus how can the driver tell us about a microwave oven, or a cordless phone, wireless camera etc? They can't. So we call interference from other modulation types in the same frequency band by a different name, we call it non-802.11 interference.

Then there is WLAN interference, which Tom's Hardware calls "congestion", but could also be thought of as WLAN contention and is sometimes referred to as co-channel interference or even adjacent channel interference. Tom's has a very good article on it here. It is where too many WLAN devices are all trying to use the same medium simutaneously. In 802.11 terms, only one device can talk in an area at one time. Too many devices means collisions and contention in a collision avoidance network that wishes to remain contention free.

So that still leaves us with noise. What is going here? When I open a WLAN analyzer I see a noise reading. You showed me one right there (see images above). Where does that come from?

To understand what the adapter manufacturers are doing requires that we first understand what noise is. Noise can be thought of as the level at which all radio signal become indistinguishable from one another. Wikipedia describes the noise floor as, "the measure of the signal created from the sum of all the noise sources and unwanted signals within a measurement system." You can create an analogy of this as follows: Imagine five people in a room, each yelling in a different language. You could probably figure out what each language was even if you couldn't have a conversation in there, you might even be able to work out what they are talking about. That example would be considered interference to you if you were trying to yell in English. Now imagine a room with 500 people in it all talking at the same time. in that instance you proabaly could not tell what any of the languages were or what anyone was talking about at all. That is noise. Again, the Tom's Hardware article is a great reference for this, especially slide 9.

Adapter manufacturers were asked many times for a noise reading so the person conducting the WLAN site survey could determine the signal to noise ratio, or SnR. This helps determine if there is enough signal to be heard above the RF noise floor. So under this presure they created algorythims that can fake the noise reading. I have no idea what the algorythims are but I can assume from tests we have done at AirMagnet that they include measurements of retry rates, CRC errors, channel utilization, average throughput and, mostimportantly, number of devices active in range (as determined by RSSI). The reason I can know this is because at AIrMagnet we have an RF isolation chamber - or Faraday Cage. If I take a noise reading in that chamber with one AP and no STAs (WLAN client adapters) I get a zero reading with many adapters. But if I add STAs the noise floor rises. even if the STAs are mostly dormant.

Here is another catch, aside from the fact that different manufactureres create this value differently, some adapters only give noise readings on a channel by channel basis, others frame by frame and still others give no reading at all. Symbol devices fit this last group and when asked about why they gave no noise reading they replied, "that would be lying". Does that mean that you cannot use that value to create the much sought after SnR? No, I would still use it, but I would be wary if tehre were very few STAs nearby. Or many for that matter.

I hope this helps understand what noise is, what interference is and what co-channel interference or WLAN contention is.

BlackHat 2011 and Defcon 19

2011-08-10T13:21:00.000-07:00

The scene in Las Vegas last week on the wireless security front was quiet and reserved. There was a veritable dearth of WLAN issues to report on at either BlackHat or Defcon. Sure there was the Wi-Fi hacking UAV and Vivek Ramachandran's normal Wi-Fi security and hacking class, also the wireless water meter 900mhz hack and 1 or 2 new WEP attacks (like WEP needs any more attacks against it, isn't complete penetration in under 5 minutes fast enough?) but nothing really new and interesting. Most of the talks were about making your PSKs long and secure to shield you from, "Sniff now, Crack Later" (using Rainbow Tables found here and here) and talks reminding everyone to monitor their WPA2-EAP implementations against Honeypot Radius WPE (the WPE is not a typo, it stands for, "Wireless Pwnage Edition" and info may be found here and here). This last one is an old vulnerability but many people still have not been keeping an eye on it especially if your organization uses server certificates only in their EAP implementation.

So what does this absence of new WLAN vulnerabilities mean? Are the hackers bored with the ability to enter a company’s WLAN from 125 miles away? Do not bet on it. Has the IEEE, Wi-Fi alliance and FCC finally secured Wi-Fi so that no new vulnerabilities will be forthcoming? I sincerely doubt it. So what is the deal?

My opinion is that people are sitting on some of the latest vulnerabilities and making use of them. Wikipedia states that, “Zero-day attacks occur during the vulnerability window that exists in the time between when a vulnerability is first exploited and when software developers start to develop a counter to that threat.” Meaning that a hacker can only execute the exploit before it becomes common knowledge. Once the vendor and security community find out about it, then everyone races to plug the hole. In the past, plugging the hole took several months for most major WIPS and WLAN vendors and then several more months before most customers implemented the new release (this was due to the fact that it required a system-wide upgrade). But the world is much more agile now and the ability to dynamically plug a security hole quickly just got a big boost when we at Fluke Networks released our AirMagnet Enterprise version 9.0. The version 9.0 solution has the ability to dynamically update the WLAN Intrusion Prevention System against threats as they become known. We also broke out the alarm code and implemented a much easier, non-programmatic method for creating the signature and anomaly alarms that make up the system. This means that from the time a zero-day is known to the time it is implemented can be as little as a day or two. This is a huge benefit for customers but a real drag for hackers. They will now have even more reason to hang on new vulnerabilities. It is also a clarion call to WLAN security researchers to step up their game and look for more fuzzed approaches to WLAN threats and try more anomaly-based alarms. I know our team is so ready here at Fluke Networks so bring it on!

Happy 802.11 day!

2011-08-02T12:59:00.000-07:00

Today is 802.11 day, August 8th 2001 or 8/02/11. As a friend of mine noted in Google+, Hallmark probably does not make a card for that. In honor of this auspicious day I think now is a great time to reflect on this amazing technology that we use every day and almost take for granted.

This all started when, in 1985, the FCC decided to release several radio bands for unlicensed use. This meant that just about anyone could use these frequencies however they felt like provided they adhered to certain rules such as low power, spread spectrum, and ensuring that the devices were not intentionally jamming or eavesdropping. I refer to this in classes I teach as the FCC sandbox. Then, round about 1997 the IEEE decided to standardize the protocols and RF effects into the 802.11 standard and rapidly followed by the creation of the Wi-Fi alliance creating one the quickest adoption cycles in history. Suddenly our computers were free to communicate without wires. When I read about this I was stunned and had to try it myself. I remember demonstrating this amazing effect using a Lucent WaveLAN Silver card and the initial Apple Airport to several of my decidedly non-technical friends in 1999. They didn’t appear to get it. I was loading webpages on my PowerBook G3 and there was nary a wire in sight and these friends of mine were commenting that this was just another geeky gadgety gimmick of mine that had no practical application for people in the real world.

Later on in my career and while working at AirMagnet I recall presenting the benefits of WLAN technology (802.11g at the time) to a high level executive venture capitalist. I was mentioning how health care organizations, amongst other verticals, were adopting the technology a break neck speed. To this he replied that he hoped he would never have to stay at a hospital where this was true, for how could he trust his life to a technology that worked as badly as it did at his home.

This type of thinking is one of the sad realities of a bottom up adoption process. And the embracing of WLAN technology and 802.11 was decidedly that. Most companies started to implement WLAN technology not as a way to cut costs and deliver an amazing amount of increased mobility to their users but as a way to appease executives who were bringing in Linksys routers from home and plugging them in under their desks. Executives were stating, "well if I can set one of these up at home, how hard can it be?"

This disparity between the attitude of "how hard can it be?" and "I can’t trust your network because mine at home in unreliable" is huge. These arguments leave out a great deal. They ignore the value of WLAN professional planners, surveyors, architects, engineers and integrators. They dismiss the years of research and development companies like Cisco, Aruba, Motorola, Meru, Aerohive, Ruckus and others have invested. They discount the impact of hackers and all the other various security needs. Lastly, they oversimplify issues that, to them, appear trivial and unimportant. This oversimplification is a serious issue today as it lowers the value of the technology and the people that research, build and implement it. WLAN vendors are not helping in this area either by suggesting that prospective customers do not need to know anything about wireless. That the WLAN system will heal itself and defend itself without the customer having to worry about a thing. Since when have networks not needed any protocol expertise in the people who properly design and run them? Does your router fix itself when something goes wrong? This is an issue that we, as an industry need to get past before we can expect to see realistic views of WLAN technology and appreciation of our talent by lay people.

Wireless networks today are invaluable. Without them we would be lost. For example, WLANs are the absolute key to the supply chain. They are the enabling technology for just-in-time delivery and short term warehousing. Additionally. they promote collaboration in the Enterprise and reduce costs through the reduction in cable pulls and per port costs on networking equipment. WLANs allow hospitals to reliably move equipment in and out of operating theatres, patient rooms and clinics. They enable Voice over IP anywhere. WLAN technology is in every smart mobile device made today from Smartphones to refrigerators to automobiles. We’ve come a long way baby, but still have a long way to go.

With the recent release of the 802.11n standard we finally have a technology that supplies the range and speeds that enterprises can use and depend on. And this is just the beginning, 802.11ac, 802.11ad and 802.11ah are coming to go beyond the gigabit realm into mutigigabit speeds. But with these advances in speed and range comes complexity. When these technologies break who will be there to fix it? How will they do so? And who will supply them with the tools they need to get the job done? I think you know who I am thinking of…

RTS/CTS and you!

2010-12-13T13:21:00.000-08:00

Imagine the following scenario:

It’s 2005 and you are at a convention.

There are hundreds of Wi-Fi devices around you. There are tens of APs. Not your run of the mill Linksys or Dlink APs but real enterprise grade, controller based APs. You fire up you trusty AirMagnet Wi-Fi Analyzer and what do you see? Specifically you see 10 APs and 700 STAs. A little math later and you realize that there are 70 Wireless Mobile devices (STAs) per AP.

“That’s Crazy!” you scream in your head. There isn’t enough capacity on this 802.11b/g network. You are correct. Then you start to imagine what is really happening and how many of the STAs cannot see one another because the network was implemented at MAX power and many STAs talking to the same AP cannot “hear” one another. Collisions go up, retries go up. Throughput crumbles and dies on the floor.

But help is on the way, the WLAN admin enables RTS/CTS in the controller and people start to behave nicely. Each STA sends and RTS and waits for the CTS from the AP before speaking. Collisions diminish. Retries diminish. Throughput gets up off the floor and makes a go at it again and you see some overall improvement. It’s still not pretty but it is better. “Great work WLAN admin!” you say to yourself.

What just happened? AirMagnet WI-Fi Analyzer says, To deal with contention, “the IEEE 802.11 standard includes the RTS/CTS (Request-To-Send/Clear-To-Send) functionality to control the station's access to the RF medium. The wireless device ready for transmission sends a RTS frame in order to acquire the right to the RF medium for a specific time duration. The receiver grants the request by sending a CTS frame of the same time duration. All wireless devices observing the CTS frame should yield the media to the transmitter for transmission without contention.”

This also eliminates a hidden node issue. Again, the AirMagnet Wi-Fi Analyzer says, “A hidden station problem occurs when a wireless node cannot “hear” one or more of the other nodes, and thus the media access protocol (CSMA/CA - Carrier Sense Multiple Access/Collision Avoidance) cannot function properly. When this happens, multiple nodes will attempt to transmit their data over the shared medium simultaneously, causing signal interference with one another. For example, imagine there are two 802.11 end-users (Station A and Station B) and one access point. Station A and Station B can't “hear” each other because of high attenuation (e.g. substantial range), but they can both communicate with the same access point. Because of this situation, Station A may begin sending a frame without noticing that Station B is currently transmitting (or vice versa). This will very likely cause a collision between Station A and Station B to occur at the access point. As a result, both Station A and Station B would need to re-transmit their respective packets, which results in higher overhead and lower throughput.”

Turning on the RTS/CTS then allows the hidden node to function without collisions.

Its 2011 and you are at work

Now fast forward to today. You are sitting in your cubicle and trying to understand what you see on the screen of your AirMagnet tool. It says, “Denial-of-Service Attack: CTS Flood”. Here is the detail text:

Description: In channel 6 2.437GHz, the system has detected 1800 CTS frames in the last minute, which matches the traffic pattern of the form of denial-of-service attack, CTS (Clear-To-Send) attack. A wireless denial-of-service attacker may suspend the wireless media for communication by taking advantage of the privilege of CTS frame to reserve RF medium for transmission. By transmitting back to back CTS frames, an attacker can force other wireless devices sharing the RF medium to hold back its transmission until the attacker stops transmitting the CTS frames.

“Why would someone be Dos’ing us?”, You inquire. “And why this particular attack?”, you wonder. “And why did he tell me all that other stuff about contention first?”, You ask.

The answer is interesting but requires another scenario. Imagine the following. There is a room with an 802.11b/g AP in it (It doesn’t matter if it is controller based or autonomous). There are 20 STAs attached to the AP and they are all 802.11g devices. That means that all the management traffic (beacons, probe requests, probe responses, etc) are 1Mb/s CCK modulated and all data traffic is faster (6-54Mb/s) OFDM modulated. Are you with me so far? Good. Here is the fun part.

An 802.11b STA walks into the room. He only speaks 1Mb/s-11Mb/s CCK modulated data traffic. So he starts jabbering while the “g” clients are talking and creates a bunch of collisions. Why? Because he cannot “hear” OFDM modulation. He has no idea that the “g” STAs are talking.

“That’s silly”, you say, “The IEEE would never allow that to happen”. Correct you are, Padawan. They re-used a function they already had, specifically to deal with this. And as you have probably already guessed what it is - RTS/CTS. RTS and CTS frames are 1Mb/s CCK modulated so it is as if the “g” STAs all asked for contention slots to send data and the “b” STA heard the CTS and went quiet until it was his/her turn.

But why the alarm? Well, what really happened was that awhile ago various card manufacturers as well as the IEEE noticed a problem and a loophole in the RTS/CTS scheme.

The problem : most APs are usually not configured to do RTS/CTS. Also, STAs may not decide to use it.
The loophole: The CTS frame does not have a source MAC.

No one really knows who sent the CTS frame. It could be anyone. Thus, “CTS Flooding” and “CTS-to-self” was born.

CTS Flood

Remember, The AirMagnet Wi-Fi Analyzer describes how hackers use CTS floods as follows, “A wireless denial-of-service attacker may take advantage of the privilege granted to the CTS frame to reserve the RF medium for transmission. By transmitting back-to-back CTS frames, an attacker can force other wireless devices sharing the RF medium to hold back their transmission until the attacker stops transmitting the CTS frames.” Because all STAs obey the CTS rule and also because CTS frames have no source MAC address, hackers love this attack. Please do follow the advice and go look for the hacker just to be sure but maybe something else is going on instead.

CTS-to-self

CTS-to-self is a protection mechanism (a method for protecting your frames from collision). A STA wants to talk so he does away with the RTS/CTS handshake altogether and just sends himself a CTS frame. No one wonders about the source of the frame and everyone allows that STA a time slot to send his/her data. However, in our example, this is completely unnecessary if protection is unneeded. If, for example, there is no one to protect the OFDM modulated traffic from.

Thus until the “b” STA walks in there are no CTS frames. The second he joins the AP everyone goes mad with CTS-to-self. In fact the “b” doesn’t even have to be on the same AP, just in range.

“Wait a gosh darn minute!” you yell, “That isn’t a DoS attack. That is a naturally occurring condition of the network. No hackers are bringing me down”. While this might be true, there may not be a hacker DoS’ing you, you are, never the less, definitely under a DoS attack. Especially if the 1800 CTS Frames/minute threshold is reached. This is because at 1800frames/minute you reach the 30fps value needed to cause a sever reduction in throughput. You are being denied access to the medium because you are waiting for your slot time to speak and it never arrives because everyone wants a slot time. You are being denied service. Now isn’t that the definition of a DoS attack?

How to (really) find a Rogue AP

2010-08-16T15:13:00.000-07:00

I want to tackle a problem that most people think of having been solved a long time ago. Rogue Access Points (I can almost hear the groans). Seriously, it deserves another look. Why? Well, to be truthful, I think when trying to track down and physically remove the AP, most people do it wrong.

While almost every infrastructure vendor has a method for the determination and mitigation of an unauthorized access point, what they cannot do is physically remove the device from your premises. No WLAN WIPS robot has yet been created to go out to a facility and track down exactly where a rogue is and then pick it up and deposit it in a dumpster or ask the owner to please take it home or whatever it is your security policy says you should do when one of these is found.

Instead, we rely on both our infrastructure and a variety of laptop or handheld based software tools to assist us in this task and then we send a real flesh and blood person out to do this. This is where the major mistakes are usually made.

Every person I have met that has this task as one their responsibilities have told me the following, “I want to use a wifi adapter with a directional antenna to find the device. Just point it and it will tell me where to go.” This is wrong. Let me say that again, WRONG!

Let me explain why.

Let’s take one of the “flag” antennas that are fairly popular now (fig. 1).

Fig. 1

Inside the plastic shell of this device is a Yagi-Uda antenna, commonly called a “yagi”. This is a fancy name for the type of antenna that televisions used to use before cable and satellite. Here is an example of what a yagi looks like without a shell (Fig. 2).

Fig. 2

Antennas professionals use a pattern diagram to describe the sensitivity pattern for the antenna. The diagram shows a pattern view from above and from the side (Fig. 3).

Fig. 3

The left view is looking down on the antenna from above known as the azimuth view and the right view is from the side and is known as the elevation view. This illustrates the amount of gain this antenna gets in any particular direction. The problem here is when you start to use a high gain (in this case 8dBi) antenna indoors you get some strange effects due to the lobes described by the diagram above.

Here is an example. You are determined to remove a Rogue AP physically from your building. You stand in the building and aim your antenna. As you sweep left and right you watch the signal strength of your rogue finding tool. In this case we will use the find tool in the AirMagnet Wi-Fi Analyzer (Fig. 4).

Fig. 4

You monitor the signal strength and figure that when you are aiming right at the AP it will be the strongest. The graph will be at a peak and the meter will show the highest signal strength. However the signal is herky-jerky and very difficult to know when you are aiming right at the Rogue. Sometimes it is high when you are way over to the right and sometimes it is just as high when you are pointing to the left. Why is that? Shouldn’t it just be obvious when you have the device in your sights? No. Let me show you why.

As you aim your directional antenna the gain field of the antenna sweeps out ahead of you and you get a high reading as expected when pointing right at it (Fig. 5).

Fig. 5

Then as you sweep away to the right the signal drops when you hit the gap between the primary and secondary lobe (Fig. 6).

Fig. 6

Then the signal jumps up again as you enter the second lobe (Fig. 7).

Fig. 7

Also it may jump again as the signal bounces off of the walls and reflect back towards you (Fig. 8) since when you aim directly at the Rogue AP the signal is attenuated by the internal walls but the signal reflected back to you is clear.

Fig. 8

You see the directional antenna with a very high gain can be fooled. A user may spend 20 minutes trying to track down this device sweeping left and right trying to find the correct direction.

There is a better way. I will show you how to find a Rogue AP in just a minute or two and as a bonus you get some great exercise as well.

The key here, counter-intuitively, is to use an omnidirectional antenna and walk very fast. The technique is quick and accurate. You will find the rogue in less than a minute, whereas with the previous method it may take many minutes or more.

The first step is to stand at the edge of the building and walk perpendicular to the wall. It is very important that you walk fast as the graph you will be watching will be jiggling around and you will need to be able to observe a distinct change to the graph which will be easier the faster you walk. Keep your eye on that graph and when it peaks and starts to decline, stop and back up to the area where it peaked (Fig. 9).

Fig. 9

Now turn 90° to either the right or left and start walking that direction quickly as well. If your signal immediately declines, reverse your course and walk the other direction (Fig. 10).

Fig. 10

Once again, when the signal peaks and starts to decline, turn 90° and walk quickly. In this way, you will box in on your objective and be able to walk right up to it and remove it (Fig. 11).

Fig. 11

I think once you have tried this method you will be extremely pleased with the result. If you have tried to use a directional antenna to find a Rogue AP in the past, you will know that you can spend quite a great deal of time aiming your antenna before you even try to move towards the device. Then when do start to move around the results are hard to determine and you tend to move slowly and carefully. This method that I have described is fast and efficient and enables you to quickly find your problem Rogue AP.

Our AirMagnet class instructor has taught over 5000 students how to use this method and it really is more efficient. Try it out and let me know what you think.

Entranced!

2010-08-15T14:45:00.000-07:00

Entranced: "Held at attention, as if by magic."

I am describing my mind and it's fixation with the WikiLeaks/Pfc Manning/Wired Magazine (via Kevin Poulson)/Adrian Lamo/Icelandic Law thing. I am like a person watching a car wreck. I cannot look away. I have not made up my mind on this but I am very intrigued. WikiLeaks may be a criminal enterprise, a heroic counterpoint to secrecy and big brother or we may be watching the evolution of journalism before our very eyes.

Here is the story so far: Mr. Assange has assisted in the crafting of legislation that was recently passed in Iceland and which subsequently creates a "free press haven" which protects him (and other journalists) from search and seizure and incarceration. He stores his data there and elsewhere where data protection laws exists. He is mirrored by hundreds of other sites and distributes his data globally. Then he leaks 92,000 US military files from Afghanistan (Actually, 77,000 - he keeps some in reserve for Insurance). He shows the horrors of war while continuing to uncover the underhanded practices of individuals, groups, businesses, religions, governments. Private Manning appears to be the leaker and was turned in by Adrian Lamo, the barefoot hacker. The story breaks on the Wired Magazine "Threat Level" blog run by hacker Kevin Poulsen. We learn that Private Manning has a pretty high security clearance and is love with a drag queen from Cambridge, Mass. We have human rights groups joining the military in asking WikiLeaks to edit the documents to protect the people assisting the US Army in Afghanistan. Lastly, we now learn of a potential war within the WikiLeaks "organization" and a potential CyberWar with the US military.

He described the original goal of Wikileaks and how it evolved and adapted over time recently at a Berkeley Graduate School of Journalism symposium. This symposium took place just prior to the passage of the law and thus prior to releasing the documents.

This is a story revolves around hackers. There are hackers at the center, hackers at the news outlets, hackers whistle-blowing on the hacker whistle-blower. This story is crawling with them.

Rather than debate the moral and ethical issues or try and talk about the impact on the newly changing journalistic world or the case details I would like to discuss what the heck happened to those pesky kids inspired by the movie WarGames and Captain Crunch.

In the past 20 years or so hackers have been portrayed by the media consciousness as teenage nerds disillusioned with their place in the world. Kids who get bullied in school and fight back by hacking into NORAD or AT&T or whatever. They have been shown as dweebs and techno punks. I never thought that any of these images were very accurate. Stories about real hackers never seemed to jibe with the images of Hollywood or the mainstream news.

I have been to a few hacker conventions and know a few hackers myself (let us not have a semantic debate about the term - Hacker - that fight was lost awhile back in 1983 if not before. It has many meanings but ask someone on the street in Des Moines or Tulsa and they have a very particular image in mind. In this I omit those folks who steal grandmas credit cards or push child porn and their ilk). The folks I have met and know are crafty and witty. They spurn convention. They want to know how things work without having someone do the work for them. They love pranks and hate injustice. Some are very vain and cruel. They want information to be free to all. Others are gregarious and kind. All of them have one thing on common, they are all very smart. You have to be smart in a subculture where "what you know" and "what you can do" are the means to establish your status.

I do not think that the general hacker populace cares one bit how they are portrayed in the media regardless in the past 10 years or so many of them grew up. Those 13 year old kids who in 1983 watched David Lightman hack into WOPR are now 40 and they are doing things.

Originally, they started out in a predictable way. They continued to hack into systems they did not like. They started network sit-ins. They defaced the sites of organizations they didn't like. Then they really evolved.

They started coordinating efforts of anti-WTO protesters in Seattle in 2000 and protesters at the Democratic National convention in Denver in 2008. All groups were open as targets as long as the hackers thought they were making news or changing the public opinion.

Assange and his crew wanted to change the way the media and "just folks" got their information. He wanted to link up all these bloggers with too much time on their hands with original source material and let them get the news unfiltered and then voice their opinions. well, It didn't work out quite how he planned but is doing something. What this something is we will see in the coming months.

The Hacker ethos has finally hit the mainstream. Google (net neutrality issues aside) has sponsored with Yahoo, Microsoft and others some "Random Hacks of Charity" and defied the work of the Chinese government to expose opposition party chinese nationals. Bill Gates wants to make a difference with his charities and has convinced many billionaires to follow his lead.

J0hnnyhax, otherwise known as Johnny Long, and some friends went to Africa and started Hackers for Charity with the goal of, "proving that hackers have amazing skills that can transform charitable organizations. We’re about stepping into the gap to feed and educate the world’s most vulnerable citizens. We are virtual, geographically diverse and different." He has done amazing work in Uganda setting up labs and user groups, computer education and training. Recently he has been despondent, however. His blog posts the following,

"HFC has done little relative to our collective capability.

We can throw an 802.11 signal a world-record distance of 275km using junk hardware. We can rootkit Android before it’s released, hack GSM, hijack global DNS, pick every lock on the planet, beat international news agencies to the punch, and weed our way into previously untrodden shadows of the digital world. There is amazing skill in our community. We build robots just because we can, and tweak just about every technology on the planet to unbelievable ends. We are motivated and brilliant. We are self-organizing and ultra-productive when assaulting “impossible” projects. We break, bend, and then re-create the rules. But can we really, honestly do some good in the world? My answer used to be a resounding “YES!” Now, my answer is a much-too-passive “Maybe”.

Yes, with me and my family on the ground here in Uganda, some positive things have happened (http://www.hfc-uganda.org). But is that work reflective of the power of our community? Hardly."

The rent for HFC just doubled in Uganda and Johnny despairs.

The world is changing. Hackers are growing up. They are attempting to do what previous of generations of folks have tried time after time. They want the world to be fair. They want to contribute. they want to make a difference. It is a hard, long, twisting road and is uphill both ways. Giving up or giving in would be easy and just chugging along in the normal pay-earning life with all our normal problems of home, job, family and personal life seem to be enough to consume all our time. Where will this go?

Will HFC continue? Will Assange get arrested? Will Google divide the Internet into haves and have nots or will it refrain from being evil? I am entranced. I cannot look away. It is magic in the making.

This blog has moved

2010-04-20T10:34:00.001-07:00

This blog is now located at http://freakquency.hubbert.org/.
You will be automatically redirected in 30 seconds, or you may click here.

For feed subscribers, please update your feed subscriptions to
http://freakquency.hubbert.org/feeds/posts/default.

Hackers Love Gray Powell

2010-04-20T09:10:00.000-07:00

I am sure by now that all of you have heard of the next gen iPhone that was left behind by an Apple Engineer at a Redwood City bar. Heck it's now even on the New York Times. I feel bad for the guy and am a little miffed at Gizmodo for sharing his name. But now that is is already out there everyone knows him, Gray Powell. I am not interested in talking about the technology or the, "Human" situation. I am interested in, "Speed to Market".

You see, the thing that really amazes me is how fast hackers have capitalized on this Internet meme. in less than 24 hours they have created hundreds of websites to fool you into clicking on an executable that will bring your poor computer to it's knees.

Take a look at this image I saved of a Google search for Gray Powell.

Notice all the nice "This site may harm your computer" notes that Google was so kind to add?

In less time than it takes to say, "Famously Secretive Silicon Valley Computer Firm", hackers have lined up to take advantage of you.

Surf carefully young padawan.

A Brief note on the the Google/Chinese intrusion/withdrawl

2010-01-13T08:34:00.000-08:00

I just wanted to publicly put my support behind Google's choice to put their foot down after the Chinese government sponsored intrusions into their networks.

By now, I am sure, many of you may have heard about this, but for those who have not here is their statement and some links:

We have decided we are no longer willing to continue censoring our results on Google.cn, and so over the next few weeks we will be discussing with the Chinese government the basis on which we could operate an unfiltered search engine within the law, if at all. We recognize that this may well mean having to shut down Google.cn, and potentially our offices in China.

Google's Statement: http://googleblog.blogspot.com/2010/01/new-approach-to-china.html

New York Times: http://www.nytimes.com/2010/01/14/world/asia/14beijing.html

US Dept of State response: http://www.state.gov/secretary/rm/2010/01/135105.htm

The EFF response: http://www.eff.org/deeplinks/2010/01/uncensoring-china-bravo-google

You can test if they are sticking to thier guns by searching the Chinese Google site yourself at http://www.google.cn/

If they choose to have a spine and stick to this they will finally resolve their problems with their own motto, "Don't be Evil". Let's hope they do.

Confusing me is easy

2010-01-09T17:00:00.000-08:00

Sometimes I am amazed at how confused I can get over WLAN configurations. What seems so straightforward and plain to me when I am advising someone else will appear convoluted and unknowable when it is my own configuration.

Take for example my own humble home network. Over the years it has evolved from a single Apple Airport (Graphite) Base station and a laptop back in 1999 which I still own to my rather complex hodgepodge of multiple networks I have today.

Today I have 3 networks which I have re-architected many times based on my own changing needs. One for media (music and in the future, Apple TV), one for testing and one for primary wireless access.

The network used only for music (AirTunes is Apple's name for it) consists of one Apple AirPort (Snow) Base Station on my Ethernet LAN and several AirPort Express wireless repeaters scattered liberally throughout my home attached to stereos and speakers here and there. The purpose of these are, as I already mentioned, is to provide me with ubiquitous and simultaneous music. They are all on channel 1 (2.412 gHz) so as to avoid the old Sharp Carousel microwave oven which would normally destroy my listening enjoyment when it is running if the network would use channels 5 to 13 (2.432 - 2.472 gHz). Happily this network has an option set that will not permit Clients (STAs) to attach to it and in fact does not appear on my AirMagnet WiFi analyzer except as actual 802.11 packets. The APs themselves are invisible to network scanners like Netstumbler and others unless you actually do packet analysis. Lastly it is encrypted with WPA2-PSK and is configured for 802.11g only with a 5.5Mb/s muticast rate so the music will play without skips or misses as it streams from my music server.
.

The testing network changes constantly and has AirMagnet Sensors and the Meraki nodes on it. You may have seen some of my previous posts about Meraki's cloud based wireless solutions. Very cool indeed

Now onto the primary network and here is where I got confused. You see, originally this was an 802.11b/g network using that old AirPort (Snow) Base Station. However, as a WLAN engineer I felt it important to have an 02.11n network in place but was worried about interference. This would be both co-channel and adjacent channel interference from other wifi devices as well as non-wifi interference from cordless phones, Bluetooth and my dreaded microwave oven. So I purchase the Airport Extreme Base Station N.This device supported both 802.11a/b/g and Draft N standards, it had Gigabit Ethernet and a port to connect a USB hard drive for NAS. However, I was extremely disappointed to learn that this device would only work on either 5gHz or 2.4gHz not both simultaneously. I wanted both at the same time. C'est la vie. I put the AP in place and started to have issues with the configuration right away. You see, I wanted to use the older Express devices as wirelessly connected repeaters as I had the the other AP but after 2 weeks of trying I could never get them to work so I figured that Apple must want me to upgrade them to the newer N model, however I was reluctant as there was nothing wrong with the ones I had. I chose to live with it the way it was.

Luckily for me Apple introduced a Simultaneous Dual Band version within a few weeks of my purchase and I was able to exchange mine for the newer model. This turned out to cause a new problem when I noticed that it was dropping client occasionally and had to be rebooted once or twice a week. I was perturbed and figured the problem was me or my configuration. I twiddled the settings a few times and changed the firmware but had limited success resolving my issues. I did notice that the Ethernet connectors were always loose no matter how firmly I inserted them but could not positively determine if this was the issue. Also, I suspected my aging ZyXEL DSL router to be a culprit but again could not reproduce the problem to my satisfaction. I just could not believe that it was an Apple product control issue. My internal standard for Apple's Quality control was very high after years and years of experience with their products. Finally, after awhile (2-3 moths) I grew tired of trying to fix it and gave up and just informed my family to reboot the Internet Router and the Airport if they couldn't access the Internet. To quote Julia Child, "This always works."

After a few months and independent from these issues, we decided to invest in a backup solution that was more comprehensive that the piece meal attempts at backup we were doing today. The consensus was to go with Apple's TimeCapsule as I had heard from others on how well it performed. For all intents and purposes it was identical to my current AP but with internal Hard Drive and Power supply so I was a bit trepidatious but gave it the green light. We purchased the product. Configured it in about 15 minutes and replaced the Simultaneous Dual-Band AirPort Extreme N Base Station and low and behold, all my problems went away! I was amazed and decided that 8 hours was not long enough for testing. 2 weeks later it is still going strong. I had found the weak link, or had I?

I repurposed the Slightly older AirPort to my boudoir/office and never had a problem again with either connections. To this day I am at a loss to explain it. Some combination caused the problem, once separated however, the problem disappeared.

You see, sometimes I get confused.

Why we need (and should already have) a 4 channel plan in 2.4GHz

2009-10-08T13:10:00.000-07:00

A long time ago I took the original AirMagnet Academy class. At the time it was known as AM-101. In the class I was taught that there were 14 channels in the 2.4GHz ISM spectrum for 802.11b. I also learned that there were only 3 non-overlapping channels because the AP spreads out it's signal in a channel mask 20MHz wide. So an AP on channel 1 would use the frequencies from 2.402GHZ to 2.422GHz. Channel 6 would go from 2.427 to 2.447 and channel 11 would use 2.453 to 2.472. Channel 14, I was told, was not used here in the USA because it was too close to 11 and would overlap it so the FCC mandated we not use it.

It took me 2 more years before I realized that the FCC had allocated the channels (in my opinion) incorrectly and that channel 14 was in the wrong place. I just never actually looked deeply enough nor calculated it out enough to catch it. Then one day I did calculate it and said, "hmm".

Lets take a look. Each channel is positioned 5MHz over from it's neighbor and the counting starts at 2.412 (I assume this is so someone doesn't try and put an AP up on 2.400GHz and have the left hand side 10Mhz hang out into the 2.3GHz spectrum.) So channel 1 is 2.412 and channel 2 is 2.417 channel 3 is 2.422 etc. Reference here.

Here this should help:

Notice what happens above channel 13, suddenly it jumps from 2.472 to 2.487. Why? I have no idea. It always remained a mystery to me.

Nowadays, however, we have a very crowded frequency range. Every mother's son has an AP not to mention all the non-802.11 interferers. This makes it hard to find room to breathe. I recently went back to my original spreadsheet and tried to see if we could use some of that real estate up around channel 14.

I was pleasantly surprised to see that if we continue to extend the 5HMz per channel philosophy up all the way to 2.497 GHz we can create channels 14, 15 and 16. This allows us to put an AP on (the newly created) channel 16 at 2.487 that will not overlap with channel 11 and will also not leave the 2.4 range. Nirvana!!

See?:

An interesting byproduct of this would be 2 non-overlapping 40HMz wide 802.11n bands as well. One from 2.402 to 2.447 and another from 2.452 to 2.497.

Unfortunately, I learned while researching this that the FCC will not allow use from 2.4835 GHz to 2.5 GHz. This is probably legacy from outdated military radar or other radios that caused similar restrictions in the UNII bands as well. The regulation may be found here

Which is really too bad. Funny enough, we found a way around military interference with 802.11h using Dynamic Frequency Selection and transmit power control in the 5GHz band. Why can't we do the same here, we could really use the bandwidth regardless of Voidmstr's Law. What do you think?

Disposable Income??

2009-06-09T17:02:00.001-07:00

Well here we are, half way through 2009. This year saw the culmination of, arguably, the worst financial crisis since the Great Depression. Yada yada yada. We have heard this all before.

I thought we were going to talk about Wi-Fi?

Well today I thought I would talk about disposable computers. Several weeks ago an associate of mine saw her beloved 17 inch iMac G5 all-in-one start to shut down for no apparent reason. She had Apple Care and had no problem trucking it down to the local Apple Store Genius Bar for a looksie.

They had her Mac for a week and then called and said, "you better come down here". When she got there they broke it to her gently, her mac was dead. The logic board was failing and a replacement would cost more than the worth of the unit. A few tears were shed before she realized this would mean she would need a new iMac - STAT!

So she cam home with a new improved 20 inch, Aluminum Bezel, Glass front, 2.66GHz Intel Core 2 Duo iMac .

The poor old unit sat next to the front door accumulating dust until I stripped some parts off of it and sent the remainder to the recycling plant here in San Francisco where they are used to this kind of recycling, as I am sure they are elsewhere these days.

I felt bad. Seemed like a waste.

Then I did the worst thing a husband can do to a Wife's computer. I spilled a drink on my wife's MacBook. I freaked out, flipped the unit over, yanked out the mag-safe power cable and the battery and spent the next several hours wiping it down and blowing air through the unit to get it dry. I failed, the next morning she had a host of keyboard and restart issues. She was not happy, however, to her credit, she was not super mad at me either, just at the situation.

So, guess what I did? Yep. I took the unit down to the Apple Store, where again the Genius Bar Dude said it was covered by AppleCare and that they would call us in a few days and tell us what was up. And guess what the verdict was? 800 dollars, 100 dollars cheaper than the Brand New Macbook. Worth the investment? Probably not.

Now here is where most folks would start to rail against the new disposable society. Everything from cell phones to TVs are all disposable now. Right? Wrong.

Not me. Why? Well I have a small contribution to make to help stop this madness.

I found two places that were willing, with a little effort, to show me how to take care of these problems myself. No fancy Apple Store Genius, know-it-all, Fixer Upper, dude (BTW, most of the time, they do not even do their own repairs at Apple, they farm it out). It should be mentioned that I am no stranger to this kind of stuff. Awhile back I repaired my first original AirPort Basestation by replacing a burnt out capacitor. Heck, a logic board replacement for the MacBook doesn't even involve soldering

The first site I am sharing is run by a pair of guys who were in college and decided to try and fix their Mac themselves, then they were fixing their pals computers and then, weell, they said, You do it. They started iFixit. Ifixit will sell you the parts and show you how to replace them. This, of course, voids the warranty, but, hey, you were going to throw it out and get a new one anyway, right?

Here is their story in their words

It bugged us that most consumer devices lacked repair instructions. We think it should be easy for people to learn how to fix things.

So we wrote some instructions the first chance we got. And we posted them online, for free. For the first time, it was easy for someone with no technical background or experience to take apart a Mac. Our step-by-step instructions were enabling people to repair Macs they wouldn't have been able to repair on their own.

We thought the instructions would be useful to our customers -- and they were. But it turned out that they were useful to a lot of other people as well! We've heard repair success stories from forensic detectives, field translators, and even kids. From New York to Alaska, Tibet to the Faroe Islands, people have used our guides to fix their stuff. They saved money, they kept their Macs out of the landfill, and they did it completely by themselves.

And the amazing thing? They enjoyed doing it. It's fun to take stuff apart. It's interesting to see what's inside that magic iPod you carry around every day. It's gratifying to fix it with your own hands. Don't believe us? Try it! Fix your Mac yourself. Show a friend how to fix something.

We're all in this thing together, and if we work together we can fix the planet. Join us.

Neat! And they are helping the environment while making a good buck or two in the process. Oh, and not just Macs, Nintendos, Palm Pre's, iPones and iPods, and even bananas

Next up, I found there guys, The Powerbook Medic folks. Theyare similar to iFixit in that they sell parts and show you how to fix stuff. They also will fix it for you (for a reasonable fee) and they also have video tutorials on YouTube

Lastly, they have made their own Mac Tablet PC from an old MacBook - it looks pretty sweet

The total cost to fix my Wife's Macbook now looks to be around $250-$350. A far cry from the $800 plus I was quoted to do the same thing by the Apple Store. Don't get me wrong, AppleCare is awesome. It has saved my bottom so many times. Well worth every penny, but aside from that, do we really need to be tossing out so many electronics in this day and age?

So it turns out you do not have to chuck out that pretty awesome Apple MacBook after all. I am sure there are sites for Dell, Toshiba, Gateway, Sony and homegrown BYO (build it yourself) FrankenPuters and others as well. A quick google search shows you that anyone can do this kind of repair.

Oh, now, how I wished I could go back and get that iMac G5.

UPDATE!

We finally got the MacBook back from Apple and now it will not boot. It booted before, just had crazy keyboard shenanigans. Now, Dead.

So now we have to move forward with the plan. I will update as I do it.

Personal PSKs (Wi-Fi Masterminds)

2009-05-28T08:11:00.000-07:00

I participated in a virtual roundtable discussion with some other tech savvy minds over at WiFiJedi's (Douglas Haider's) Blog. The topic was Pre-Shared Keys and some of the new techniques Aerohive and others are bringing to the table. You can find the discussion here.

Let me know how I did.

Maturation of the WiFi Market

2009-04-23T18:08:00.001-07:00

I think we are reaching a stage where people are actually starting to depend on their wifi networks the way they do their wired ones. They expect blanket coverage everywhere. Network Admins are starting to actually trust these networks now as well.

How did I reach this conclusion? Well, I was told this by a very large healthcare organization. This company has over 60 thousand employees and hundreds of locations. I was teaching a class in WLAN management when a couple of router guys chuckled in the back of the room. You see, to them wifi was a part time gig. They managed the core. I would have said something however, I never had to. Another attendee, a real leader in the group, took over and said, "You wired guys want to chuckle but let me tell you, moving forward, wireless networking will be the primary access method for all new connections and applications."

I was stunned as this was a pretty hefty statement to make in front of a vendor (me).

And this is not the only place I heard this. I was recently at the headquarters for a major media company. I mean really major. The WLAN Admin Exec. said almost the exact same thing.

Are we reaching a milestone? I think so. I think mobile devices are pushing this forward. It was all fine and good that companies provide wifi for big ol' laptops but when people have an iPhone in their pocket and are surfing the web non-stop round the clock... Well, let's just say, people can get pretty demanding for something they never had before but are getting used to using everyday.

To illustrate my point, please watch this comedian from the Conan O'Brien show. His name is Louis CK and he is spot on. If you are impatient, tune to 2:16 for the particularly poignant part.

"Everything is amazing and nobody is happy"
Uploaded by Meowbay. - Click for more funny videos.

Ahh, yes. I remember it well... Last refuge for the lost.

2009-03-26T10:43:00.000-07:00

Waaaaayyyy back in the day, right after I moved to NYC I discovered an online social network. This was a social network of fugitives from the law, writers, misfits, artists, rock stars and geeks. I logged in several times a day and was amazed at what I read. Some of it psychadelic and off the wall but most of it compelling and intelligent. As with all social networks, I, the n00b, posted what I thought at the time, were intelligent ideas on computers, politics, civil rights, books, movies and whatever else came into my scheming and much younger head. I argued and I lost. I argued and I won. But mostly I made friends and learned.

I learned how to use Internet tools. I learned how some folks hacked and phreaked. I learned how to get along with those I disagreed with. I learned that many of those ideas I did not like were at least as valid as mine and in many cases these discussions caused me to change my mind. I discovered what I really felt about things by being challenged. It was social. It was lifechanging.

This social network was on the Internet in 1992 however it had no web page - since web browsers had not been invented yet (that would come a year later). In fact, it didn't even have a GUI. just this strange ASCII welcome image:


/\_-\(:::::::::)/\_-\
<((_))  MindVox  ((_))>
\- \/(:::::::::)\- \/

I met some very interesting people there. Like voidmstr, the person who would later be quoted for voidmstr's law, "Bandwidth expands to fit the waste available." Also, reive, galt, leq, dross, evan, sassy, and tomwhore. All names in 8 lowercase characters or less as required at the time. I also met some famous people there, like Billy Idol, Wil Wheaton, Charles Platt and Bruce Sterling. But it was the core users of the bandwidth forum on Mindvox and #mindvox on EFnet that made it for me. Smart people. Inciteful people. I knew them and they knew me even though I only ever saw a small handful of them face to face - once - (at a William Gibson reading in Central Park, no less).

The point I am trying to make here, or more factually, the idea my wife pointed out. Is that it took 17 years for the Internet to realize that social networks are where it is at. Meanwhile, way back in 92' and 93' folks were already aware of this. Mindvox, The Well, Panix. Folks who hung out there, they had social networking down. And the best part was, you networked with folks who, at the begining at least were not friends and acquaintances. It was like a micrcosm of New York City itself. Shoved face to face with a bunch of strangers and forced to deal with them.

I think, all criticisms of the current UI and direction aside, Facebook and others get it all wrong. There is no confrontation with "the other", it is all about you and your homies, your posse, your family. There really is no tolerance for arguement and, like twitter, no space to do it in anyways.

Well, maybe there is a chance to get back to what mindvox had initially. That cowboy, f%#& You!, "Hell's Angel's of the Internet" type of community. How?

Mindvox might be back.

In many ways I fear it's return. I fear that all my memories of it's initial incarnation will disappear in an Ibogaine forum haze. Or that, more likely, folks will be too busy with life and work and surfing the Tubes of the The Internets to offer real discussion and input worth reading.

I am hopeful, however. +)=[ dood! ]=(+

Digg It!

How to find a WiFi antenna?

2009-02-09T11:50:00.000-08:00

Finding the right Wifi Antenna is a pain in the connector. When I meet with WLAN managers the most often asked question about antennas is, "Where can I get one that is camoflaged or hidden in some way?" Most antenna sales or manufacturers websites are really bad. Either these websites haven't been changed since 1997 or the are broken or just plain unusable.

I get a lot of requests for sources of antennas. Not high gain, site to site antennas. Not parabolic or Backfire. Not a 4 foot long ultra-high gain omni.

All the requests I get are for one simple thing. A disguised antenna. This could be an antenna that looks like a smoke detector, an alarm light, a speaker grill or anything except a wifi antenna. In almost every case the antenna must do 2.4GHz and 5GHz. More recently it also must do 802.11n.

How hard is it. I am pretty good at Google but I have a real hard time finding one. Everytime I look I get pages that look like this:

Now why is that? I searched for "camouflaged WLAN antenna" and I get the above. When what I want is this:

Anyway, here a short list of websites I have fouond for wifi antennas. If you have a better resource, especially for camoflaged antennas, please post a comment.

WiFi Antennas|| RadioLabs

WLANMall.com

WLANAntennas.com

Sub-$300 internet tablet

2009-01-19T10:16:00.003-08:00

I like this idea a lot. No applications, just a browser in a sub-$300 tablet. Personally, I would prefer it be sub-$100. What do you think?

The Sky is Falling!!

2008-12-16T11:18:00.000-08:00

My Brother-in-law sent me an email the other day that made me wonder about how WiFi is progressing with most folks at home.

For me WiFi is my occupation and my hobby. I get a thrill that most people would find unbearable out of debugging wireless network problems and analyzing layer 2 management frames. But I sometimes forget that most folks just want their WiFi to work. Take note that my B-in-law is no slouch at solving networking issues. As a developer of WebBased applications via Linux and as the maintainer of a (as he puts it), "3-tier, cross-platform application development framework, written in Python atop the wxPython GUI toolkit" I am pretty sure he can handle a couple of wireless packet issues. Here is the email:

Bruce,
Of late, it seems all my neighbors are getting 2Wire/AT&T DSL wifi routers.I think their signals are interfering with mine. What channel should I put myself on given this list I just got from kismet, although I've seen the number of devices at almost twice this list:
Channel   AvgSignal   SSID
1         22       2WIRE365
1         18       2WIRE341
5         19       2WIRE248
6         18       pete
6         18       2WIRE675
9         28       2WIRE219
I've also seen devices on channels 3, 10, and 11. I'm
currently on channel 8 (previously on 3) and 8 seems better, but still not great. I'm going to be wiring fast ethernet wired connections to [name omitted]'s office and my office, but it would be nice to be able to wander around the house without the connection dropping sporadically (I watch my wifi signal go from 5 bars to 0 bars, stick there for 5 seconds, and go back to 5 bars, and 10-20 seconds later, the same thing happens). Then several hours may pass with no incident.

Maybe someone's microwave or cordless phone is interfering?

Any ideas other than putting ugly repeaters all over the house?

Thanks!

I feel for him. This is a common problem. 2WIRE and other manufacturers of consumer grade access points don't really get WiFi. If they did they wouldn't have the devices auto-choose interfering channels like channel 5 or 9. I do not mind that they sample the air and select an unused channel but please select a non-overlapping channel instead. I also have had my share of issues in my 120 year old home in San Francisco. Normal 802.11b/g doesn't like old fashioned plaster and lathe walls. It also doesn't like the 40-60 APs on my block all vying for the same airspace and sure as heck hates my 15 year old 1200 watt microwave oven.
Then I read about one of my favorite technology writers, Andy Intakho suggesting we go back to wires. I saw the first post at Glenn Fleishman's WiFiNetNews site and followed the link to Andy's. It is an amusing read but I am a little perplexed. Andy does not share the steps he tried to solve the issue. He doesn't share the equipment he was using that gave him such frustrations. We have no sense of why he made what is, IMHO, a rash decision to abandon the future for the past.

Glenn Fleishman has it right when he suggests,

"Andy, maybe you need a working 802.11n router and some modern hardware? Or maybe your apartment building is simply being bombarded by untoward RF interference.
Don’t get me wrong: I like my copper Ethernet wiring, too, especially when I’m moving big files around my network. But with Draft N, I’m more likely to have a gating factor at my Internet gateway or a particular computer’s ability to shoot files over a given protocol than I am by the network’s raw speed."

As a former Apple loyalist, I would have suggested the Apple Airport Extreme with both 2.4gHz and 5gHz 802.11n (and a ton of other high-end features). It is easy to setup, easy to use and goes really fast!
However, I also see both Andy's point and that of my Brother-in-law. It shouldn't be this hard. The average home user should not have to worry about "RF Interference" this and "Channel Congestion" that. It should just work.

So whose responsibility is this? The manufacturers? The IEEE? The WiFi Alliance guys?

Maybe I am limiting my future as a WiFi engineer but I would like to see it fixed. If a groundswell of disaffected WiFi users starts now, with WiMAX on the horizon, 3g-4g cellular becoming really popular and iPhone users now having the same bandwidth as the DSL in my last apartment, we might see the sky falling after all.

XKCD on Moving and WiFi

2008-08-26T10:33:00.000-07:00

XKCD, funniest geek comic strip ever.

Where the hell is Matt?

2008-07-15T07:09:00.000-07:00

There is no real reason to post this other than it made me happy.

Where the Hell is Matt? (2008) from Matthew Harding on Vimeo.

Cease and Desist!

2008-04-12T08:31:00.000-07:00

My ISP (Speakeasy) sent me a nice letter recently informing me the Eurpopean Union's copyright infringement division was displeased with me. The said that based on these allegations, I would be in violation of the Speakeasy Acceptable Use Policy. "How can that be?", thought I. I buy my music on iTunes, I do not partake in bittorrent, limewire or any other version of the now dead Napster (old school version not the new subscription based system) music/file-trading system Hell, I pay for stuff!. I have encoded all my purchased CD's and boxed them away but I keep them to myself. In fact I am a true supporter of "legitimate" digital music use via iTunes or any other service that, in some way, supports the artisits that create the music I love. This includes freely distributed music a la Radiohead.

So why was the European Union comin after me? Speakeasy's Tech Support and Security groups were very helpful in pointing out to me that they could track streams of file sharing originating at my IP address. So I thought deeply about this (for 2 seconds) and arrived at the most logical conclusion. My neighbors were connecting to me via Free The Net, the Meraki based San Francisco free wifi network and uploading/downloading music to their hearts content. I have 2 repeaters on my roof and 4 others in houses nearby providing firewalled access to the Internet. This made me sad. I was very pleased to provide an un-asked for service to my neighbors who may not have - or may not be able to afford - Internet access. I wrote to Meraki explaining my dilemma and asked of there was someway to restrict my neighbors from conducting file trading on my network.

People in my hood are sharing music over my wireless network and
abusing my speakeasy acceptable use policy. Speakeasy.net has warned
me that any continued abuse will result in disconnection of my
service. Therefore I must inform you that unless you can lock it
down so only port 80 is being used I will have to disconnect the
Meraki repeaters and access points from my network.

I am very sorry. This seems like a real shame. I was very eager to
participate in "Free the Net" but now I am a bit saddened that folks
are abusing it.

Please get back to me and let me know if there is anything you can do
on your end.


They replied back with...

Hey Bruce,

grr. that's really irritating. but actually what's surprising is that
we haven't had to address this issue so far. as far as blocking
everything but port 80: I don't think any of us would be happy with a web-only Internet connection, so that doesn't seem like a good answer. to me it seems the real solution here would be to figure out who the culprit is and block them.

I looked on your gateway and didn't see anyone transferring an
inordinate amount of traffic. do you happen to have any idea who it is? do you know if it is bittorrent they are using? maybe they are using a different gateway at least part of the time (probably mine, hehe).

next week I guess we can figure out how to set up the right counters on your gateway so that we can figure out who it is (any insight or additional info you can provide would obviously be super helpful). hopefully Speakeasy can wait that long. if you need to unplug, we understand, but leaving your repeater plugged into power would at least soften the blow.

ugh,

So far they have found no way to track or stop the activity and I love my Speakeasy service. So I have no choice. Until such a time as I can trust my neighbors not to conduct activity that the European Union deems as illegal or until Meraki finds a way to filter this traffic out, I must disconnect my network from "Free the Net". I still have repeaters on my roof but they are no longer connected to my network, file traders now siphon off some other guys pipe or tube or truck that backs up and unloads Internet.

Comments and suggestions, as always, are very welcome.