1

I'm working on an assignment and I'm given a hypothetical scenario where:

A company has a local subnet where everything shares the flat address space 192.168.0.0/8 (this means that any device can communicate with any other device else in the network). There are 2 sections: the administration buildings and the factory. The machines in the factory have their own Programmable Logic Controller (PLC) and they use open (unencrypted) Wifi to communicate. The administration PCs also use Wifi, but with WPA2 security. Both section devices can communicate among themselves or with the other party.

I want to ask about the setup. How is it possible that a single local area network can have different Wifi security levels. Aren't the devices supposed to be under the same network? And if it's possible, is it pointless to have WPA2 security for the office PCs, as I can just join the open Wifi network anyway. And say if I'm Trudy, am I able to sniff everything going on in this network, assuming no access control is implemented? Isn't this a major security flaw?

Thanks everyone.

4

A company has a local subnet where everything shares the address space 192.168.0.0/8.

Let me start out by stating that "shares the address space" does not equate to "shares the same subnet." Multiple different L3 domains can all be part of a shared address space. Any /8 is really too large to be usable as a single subnet and you will end up with a number of problems.

Second, I really hope that they aren't using a 192.168.0.0/8 as this address space includes both publicly assigned address space as well as RFC1918 address space. This would be terrible network design and indicate there are likely other issues as well (i.e. I have personally never seen a network with this kind of design flaw that didn't have others as well).

How is it possible that a single local area network can have different Wifi security levels. Aren't the devices supposed to be under the same network?

A single local area network can consist of many different VLANs and subnets each with their own access/security policy. Or you can have different ESSIDs that bridge their associated clients to the same VLAN/subnet.

And if it's possible, is it pointless to have WPA2 security for the office PCs, as I can just join the open Wifi network anyway.

Certainly not pointless, even if the two ESSIDs do provide access to the same VLAN/subnet for clients. The payloads of the wireless frames sent and received by stations connected with WPA2 will be encrypted. This makes interception over the air more difficult if not impossible.

Even if stations connected to the two different ESSIDs can communicate with each other, this does not mean that joining the open ESSID will provide you the same access that joining the WPA2-PSK ESSID does.

And say if I'm Trudy, am I able to sniff everything going on in this network, assuming no access control is implemented?

All wireless traffic that "Trudy's" station can capture (the stations must have a high enough signal to understand the data rate at which it is transmitted)? Possibly if only a single PSK is in use and Trudy has that PSK. All the wired traffic? Unless the wired traffic is vulnerable to some sort of other exploit, no.

However, wired traffic should be relatively safe in this situation. As for the single PSK, there may be different PSKs configured in different facilities or depending on vendor there may be some sort of private/dynamic/identity PSK feature enabled that can make use of different PSKs to different stations.

Isn't this a major security flaw?

Maybe? There really isn't enough information in your question to determine what level of security risk may be present. This could be a major security issue, or it could be non-existent. All depends on what is really happening "under the hood."

  • Thanks a lot for your detailed answer. I forgot to specify that the whole network is 'flat', so no VLANs, just different SSIDs I think. And the whole thing is hypothetical as well, so it would not be a surprise to detect obvious security flaws here. – Mike Pham Oct 5 at 5:03
  • This is why hypothetical (homework/interview) questions are generally considered off topic, and now that i know this I am tempted to close it as such. However, this one skirts on the edge of on/off topic as you seem to be asking more about the concepts behind the scenario than the questions the original scenario may have posed. – YLearn Oct 5 at 15:49
3

It's pretty common and normal to have multiple SSIDs on the same subnet, with different authentication methods. For example, one may be using RADIUS authentication and another may be using a PSK. Both assign IP addresses on the same subnet, but maybe some devices don't support WPA2-Enterprise auth. so you need to use the PSK SSID for them. You can still lock down the SSID to only allow specific devices to use it, so everything else requires using the RADIUS authenticated SSID.

Of course, if you CAN separate the SSIDs onto their own subnets, it would be better from a security standpoint but sometimes that's not an option or the devices all need to be on the same subnet due to certain protocols being used.

  • Thanks for your answer. So if I were to join the open WiFi network. Am I able to see the traffic from the encrypted to the open network? – Mike Pham Oct 3 at 22:53
  • @MikePham I'm not sure I understand your question. Are you asking whether or not clients connected to either SSID would be able to see eachother's traffic? – Jesse P. Oct 3 at 23:03
  • @MikePham If so, that would really depend on whether there's any filtering being done on a layer-2 level. Most APs that allow for multiple SSIDs have a feature generally called "client isolation", which prevents wireless clients from seeing each other. It's really too broad to give you a definitive answer because it's not necessarily available or turned on. – Jesse P. Oct 3 at 23:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.