Wireless client security

This is an excellant question and the best source for answers is located directly with those that provide service to the HotSpot Providers. Companies like Netopia and Thinwire provide their clients with with excellant solutions that limit and restrict network browsing and allow certain ports such as port 80 and 20/25 to be open.

Even still there are some concern for network administrators. Again, I strongly suggest that you review the locals of the hotspots and their providers; an extremely time consuming solution that will provide you with a lot of "I dont know"s and "I am not sure" answers.

So to cut to the chase of your concern, is more about the security of your own network and client stations. Suggestion, run a firewall such as Norton Personal Firewall or Zonealarm on your mobile clients and revisit the security around any servers that they may be connecting to through VPN's or possible means. Try not to worry too much about the medium in which your employees are connecting and be concerned with security at the points of connection.

That is interesting because long ago I suggested that creating a honeypot of an open WAP with internet access or even a bogus box with tons of stuff to search could even give the builder a chance to find and download from all open shares automatically, install trojans or any other of a plethora of possibilities. I posted it here at TR and it went largley unnoticed. This theoretical project is of course a grim reality today.

A lot of the script kids that took up wardriving will be sorry they found that WAP.

Earlier this year there was a good article about this at securityfocus:

http://www.securityfocus.com/infocus/1761

Now, about 6 months later if you plug the term "wireless honeypots" in Google you'll get tons of hits, and a lot of info you can turn around and prevent from happening.

Remember too that there are a bazillion unsecured or poorly secured WAP's that can be used as wireless honeypots without the owners consent, so even if you trust your local coffee vendor, do you trust everyone on their public network? Look around you, look out in the parking lot.... It is, after all, a public access network so Caveat Emptor to those that use it...Either the owner or someone unbeknownst to the owner may be doing bad little things to you while you are connected.

So, you need to block all unecessary ports and monitor programs going in and out of the ports you need. I also make sure pings are dropped and use other measures to avoid scans. Preferably, you want to look like you don't exist on the network. Although this is unavoidable to the WAP, you can definately lessen your chances at the old standby port scan level, and the attacker will move to greener pastures.... believe me there will be plenty of out of the box clueless targets for them to gravitate towards on most public networks.

So, secure your computer at the firewall since you can't secure the WAP. It's basically the same as any other computer on a network that you want to cut down access to. Close Ports close ports close ports...turn off sharing... use good passwords...Deny all local ips or macs unless its one you need....
As Gibson says, build a "stealth" mode...