4 ms·

Does this make enterprise/university use of rouge AP mitigation mechanisms illegal? Are Cisco and other AP controller vendors going to remove this option from

Does this make enterprise/university use of rouge AP mitigation mechanisms illegal? Are Cisco and other AP controller vendors going to remove this option from their software? (If they're shipping a checkbox that is always illegal to enable, why aren't they subject to enforcement action?)

gramsey 12y ago
I want to know the answer to this question as well; my university purposefully blocks non-authorized networks.
- superuser2 12y ago
  It is possible/likely that this refers to what Mariott was specifically doing, which is attacking cellular modem/AP combo devices that were not connected to Marott's network in any way, just physically located in/near their hotels. University Wi-Fi blocking is usually targeted at APs that students have attached to University network drops without permission, which is a completely different thing. However, the FCC did not appear to draw a distinction, which is interesting.
  - matthewmcg 12y ago
    Agreed. The university unquestionably has the right to prevent you from connecting a device to its wired network. The only question is whether it can use wireless "self-help" to prevent you from doing so.
    - gramsey 12y ago
      Right, of course they have the right to prevent me from connecting to their network. But as I understand the FCC advisory, they do not have the right to stop me from using my own personal cellular hotspot, for example.
      - pb2au 12y ago
        Does your university actually block all other wireless networks near / on campus? This is prohibited by the FCC. At my university, the wireless APs would scan for others and try to detect if they were on-network using a student's auth. They'd tell the student to remove the AP if they wanted to continue to have access to the school network. Wireless, off-network hotspots were allowed, provided they weren't impersonating the school network.
- rtpg 12y ago
  if this is an issue, send a letter to the FCC and a copy of this to your IT dep't or something (anonymised from a gmail account maybe?)
matthewmcg 12y ago
Very interesting point. A Cisco page[1] discussing this feature says: "Containment can have legal implications when launched against neighboring networks. Ensure that the rogue device is within your network and poses a security risk before you launch the containment." [1]http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/112045-handling-rogue-cuwn-00.html#RM http://www.cisco.com/c/en/us/support/docs/wireless/4400-seri... Cisco seems to think this is perfectly fine to do to rouge APs connected to an organization's wired network, however. Note that the Marriott enforcement action concerned the use of personal access points not connected to a Marriott network. I don't see any basis in the Communication Act for making this distinction though. 47 U.S.C. Section 333, the law Marriott violated, says: "No person shall willfully or maliciously interfere with or cause interference to any radio communications of any station licensed or authorized by or under this chapter or operated by the United States Government." From the Cisco materials mentioned above, it seems the mitigation method involves sending fake de-authentication packets over the air. That also seems like intentional interference to me!
- anextio 12y ago
  It's clear from the memo that the FCC considers security risks to be exempt from this requirement. It sounds like the AP being on your network is what constitutes the security risk. I doubt the FCC would have a problem with a network administrator taking action like that. Unrelated APs are different.
  - dedward 12y ago
    It's also arguably not "harmful interference"... it's a legitimate operation within your network.
    - eli 12y ago
      Yeah, big difference between limiting access to your own network and limiting access to someone else's
  - konceptz 12y ago
wmf 12y ago
There are different definitions of "rogue AP". Originally, a rogue AP was defined as an unauthorized AP connected to the corporate wired network inside the firewall; these should ideally be blocked by turning off the wired port but that's probably too complex so they resort to spoofed disassociate frames. An unauthorized AP that uses the corporate SSID is also rogue because it could be used for MITMing. Recently some people have started calling "any AP that's not ours" rogue, which is taking it too far IMO and is likely to lead to some FCC smackdown.
- dragonwriter 12y ago
  It has, in fact, led to some FCC smackdown. http://www.fcc.gov/document/marriott-pay-600k-resolve-wifi-blocking-investigation http://www.fcc.gov/document/marriott-pay-600k-resolve-wifi-b...
blueskin_ 12y ago
If they're not on your network, yes (as they should be). If someone plugs a wireless router into your office ethernet, go ahead.

gramsey 12y ago

I want to know the answer to this question as well; my university purposefully blocks non-authorized networks.

superuser2 12y ago
It is possible/likely that this refers to what Mariott was specifically doing, which is attacking cellular modem/AP combo devices that were not connected to Marott's network in any way, just physically located in/near their hotels. University Wi-Fi blocking is usually targeted at APs that students have attached to University network drops without permission, which is a completely different thing. However, the FCC did not appear to draw a distinction, which is interesting.
- matthewmcg 12y ago
  Agreed. The university unquestionably has the right to prevent you from connecting a device to its wired network. The only question is whether it can use wireless "self-help" to prevent you from doing so.
  - gramsey 12y ago
    Right, of course they have the right to prevent me from connecting to their network. But as I understand the FCC advisory, they do not have the right to stop me from using my own personal cellular hotspot, for example.
    - pb2au 12y ago
      Does your university actually block all other wireless networks near / on campus? This is prohibited by the FCC. At my university, the wireless APs would scan for others and try to detect if they were on-network using a student's auth. They'd tell the student to remove the AP if they wanted to continue to have access to the school network. Wireless, off-network hotspots were allowed, provided they weren't impersonating the school network.
rtpg 12y ago
if this is an issue, send a letter to the FCC and a copy of this to your IT dep't or something (anonymised from a gmail account maybe?)

matthewmcg 12y ago

Very interesting point. A Cisco page[1] discussing this feature says: "Containment can have legal implications when launched against neighboring networks. Ensure that the rogue device is within your network and poses a security risk before you launch the containment." [1]http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/112045-handling-rogue-cuwn-00.html#RM http://www.cisco.com/c/en/us/support/docs/wireless/4400-seri... Cisco seems to think this is perfectly fine to do to rouge APs connected to an organization's wired network, however. Note that the Marriott enforcement action concerned the use of personal access points not connected to a Marriott network. I don't see any basis in the Communication Act for making this distinction though. 47 U.S.C. Section 333, the law Marriott violated, says: "No person shall willfully or maliciously interfere with or cause interference to any radio communications of any station licensed or authorized by or under this chapter or operated by the United States Government." From the Cisco materials mentioned above, it seems the mitigation method involves sending fake de-authentication packets over the air. That also seems like intentional interference to me!

anextio 12y ago
It's clear from the memo that the FCC considers security risks to be exempt from this requirement. It sounds like the AP being on your network is what constitutes the security risk. I doubt the FCC would have a problem with a network administrator taking action like that. Unrelated APs are different.
- dedward 12y ago
  It's also arguably not "harmful interference"... it's a legitimate operation within your network.
  - eli 12y ago
    Yeah, big difference between limiting access to your own network and limiting access to someone else's
- konceptz 12y ago

wmf 12y ago

There are different definitions of "rogue AP". Originally, a rogue AP was defined as an unauthorized AP connected to the corporate wired network inside the firewall; these should ideally be blocked by turning off the wired port but that's probably too complex so they resort to spoofed disassociate frames. An unauthorized AP that uses the corporate SSID is also rogue because it could be used for MITMing. Recently some people have started calling "any AP that's not ours" rogue, which is taking it too far IMO and is likely to lead to some FCC smackdown.

dragonwriter 12y ago
It has, in fact, led to some FCC smackdown. http://www.fcc.gov/document/marriott-pay-600k-resolve-wifi-blocking-investigation http://www.fcc.gov/document/marriott-pay-600k-resolve-wifi-b...

blueskin_ 12y ago

If they're not on your network, yes (as they should be). If someone plugs a wireless router into your office ethernet, go ahead.