Interesting discussion about the wireless infrastructure. The best way (and also one of the question you posted) is how the vendors such as cisco and others are doing to provide features that addresses some of the problems you listed with wireless technology. I'm hoping that by knowing and understanding the BIG vendors prescriptive you can perhaps revise your current assumptions about the actual attacks and problems faced in regard to WIDS. Following is my analysis:-
BACKGROUND & LIMITATIONS
(citations excerpted from a Cisco whitepaper)
- Current IDS/IPS systems cannot detect access points
running with proprietary extensions such as Super
G (from Atheros). These readily available devices go undetected. Additionally, it’s possible for a hacker to take standard Wi-Fi equipment (for example, running Linux) and modify it to operate on nonstandard channels or with other nonstandard modulation schemes. These extended or modified devices can be detected only if you analyze
the RF physical layer. As Beyond Wi-Fi devices, many other types of non-Wi-Fi equipment - including Bluetooth access points, access points running older standards such as
802.11FH, and proprietary wireless bridges - can also be used to open up holes in the network
- They do not detect RF layer DoS attacks that can be implemented through jammer devices or Wi-Fi devices that have been set in a diagnostic jamming mode.
- At a fundamental level, a standard Wi-Fi chipset has limited ability to implement Spectrum Intelligence. The reason is that Wi-Fi chipsets are specifically designed to receive Wi-Fi signals only - they do not recognize other types of signals. Standard chipsets are not even designed to pass up enough information for SI to occur at higher levels of software. And there is no ability for software to access the actual data received from the burst for further analysis
Cisco has created an integrated solution with patented chips and software that has been specifically designed to analyze and classify all RF activity. Cisco Spectrum Analysis Engine (SAgE) hardware core, which has been integrated directly into Wi-Fi chipset.
Spectrum intelligence (SI) is data about RF spectrum activity derived from advanced interference identification algorithms similar to those used in the military.For every device operating in the unlicensed band, SI reveals : What is it? Where is it? How is it impacting the Wi-Fi network? Cisco has taken the bold step of integrating SI directly into the chipset of new access points.
Using clean-pipe & MSE (mobility security engine) coupled provides physical location of wireless interferes, context aware software,rogue device, wire devices.
The security services it provides the following advantages:-
- Location,correlation,history / with forensic context based for
clean spectrum intelligence
- Context-aware software for locating wireless devices.
- Adaptive ips
Full range of 802.11 attacks and threats against network rogue access points and clients , network recognizance , eavesdropping , authentication and encryption cracking , MITM , Wireless dos, day 0 attacks.
EXAMPLE of AIPS
Network Reconnaissance and Profiling Detection
Analyzes traffic behavior and performs pattern matching to detect tools and techniques such as Netstumbler, Wellenreiter, Kismet, honeypot access points, and other methods, providing an early alert that a hacker is looking for avenues of attack
Authentication and Encryption
Cracking Detection Analyzes traffic behavior and performs pattern matching
to detect tools and techniques such as AirSnarf, AirCrack, ASLEAP, Chop-Chop, and other methods, providing an alert of potential or attempted data theft