Wireless Security
Discussion
Santa was kind enough to bring me a Squeezebox this Christmas, which I've been unable to make communicate with my Wifi using WPA pre shared key protocols.
So
I decided to go down another security route:
1. Broadcast disabled (you have to know the SSID to find the network)
2. MAC filtering enabled - Only MAC addresses I've specified can access
3. No security (no WEP / WPA etc)
Do you think that's secure enough? Or should I persevere with WPA and try to make the S.B. work with it?
So
I decided to go down another security route:
1. Broadcast disabled (you have to know the SSID to find the network)
2. MAC filtering enabled - Only MAC addresses I've specified can access
3. No security (no WEP / WPA etc)
Do you think that's secure enough? Or should I persevere with WPA and try to make the S.B. work with it?
I would suggest perservering with WPA-PSK and if you cant get it to work then go MAC address filtering route.
SSID non broadcast means for a bit of peace of mind you have to have an SSID like £4er%xc to make it non guessable and no security obviously isnt ideal, unless you dont mind people wandering off with your data and bandwidth...
There are also fairly advanced wireless hacking tools and WPA does seem to get the best press.
SSID non broadcast means for a bit of peace of mind you have to have an SSID like £4er%xc to make it non guessable and no security obviously isnt ideal, unless you dont mind people wandering off with your data and bandwidth...
There are also fairly advanced wireless hacking tools and WPA does seem to get the best press.
Raify said:
Is there a way to 'spoof' a MAC address?
There is, but you'd have to be pretty bloody determined to do it.
Mine at home is set up like yours except i also use a non standard IP range and no DHCP server. Although to be honest there's not much chance of havign someone just wander past and hook up without them being pretty obvious (sitting in the front garden with a laptop).
Wep is pretty useless these days, there was a recent demonstration where it was cracked using publically available tools in just over 3 minutes.
I haven't seen one yet but I'm sure they will exist as I haven't seen that many different kinds of card. Wireless cards where you can set your own MAC address.
I used to have a whole bunch of wired cards I could do this with. One of these could render MAC filtering useless in seconds
And after a quick google
www.oreillynet.com/pub/a/wireless/excerpt/wirlsshacks_chap1/
I used to have a whole bunch of wired cards I could do this with. One of these could render MAC filtering useless in seconds
And after a quick google
www.oreillynet.com/pub/a/wireless/excerpt/wirlsshacks_chap1/
But lets get a dose of reality here. With SSID broadcast disabled and MAC filtering enabled for a home setup its going to be enough to protect you, unless you have taken to keeping top secret documents on your home computer. Drive around the town where I live and in less than 1 mile there are 12 unsecured open access points. So who is going to take the trouble to try and hack into mine just to access the broadband when there are so many open systems about ? And I agree with the previous statement - a determined hacker sat outside my house is going to be pretty obvious....
Just to be sure I have firewalls on all the home PCs anyway :-)
Just to be sure I have firewalls on all the home PCs anyway :-)
WPA is a good, but if you limit your available IP range for connections, have mac address filtering on & WEP encryption, you will deter most casual hackers.
Unless you are running a radius server for WPA Enterprise, WPA-PSK is crackable if someone really wants to get in. A few of the penetration testing uber-geeks I used to work with were not all that fussed about WPA & stuck to making sure the other bits were covered.
Similarly with SSID - there are ways to find "hidden" AP's - IIRC Kismet offers that functionality.
Unless you are running a radius server for WPA Enterprise, WPA-PSK is crackable if someone really wants to get in. A few of the penetration testing uber-geeks I used to work with were not all that fussed about WPA & stuck to making sure the other bits were covered.
Similarly with SSID - there are ways to find "hidden" AP's - IIRC Kismet offers that functionality.
Hi
MAC filtering will stop unauthorised access to a point. Do not rely on stopping the broadcast of SSID as a security measure, free software on Linux and Windows can easily pull that from non SSID broadcast traffic (see http://stumbler.net).
I would configure WPA or WEP on your system, do not use clear text.
As a guide here is what I always carry out on domestic systems:
1) Ensure Router has the latest vendor patches installed. Keep any eye out for new ones too.
2) Turn on MAC filtering. Note what each MAC address is and why it is there. As Malman says, MAC addresses can be spoofed which is why you also need encryption/authentication.
3) Use at least WEP encryption, preferably more. Sometimes you have to use WEP as not all equipment supports better encryption. WEP is crack-able but much better than nothing.
4) Disable SSID Broadcast (see note above!).
5) Change the default username and password on the router. Choose strong passwords that are not actual English words.
6) I normally change the routers ip address to 192.168.x.254 too as .254 is normally where routers live on class c Ethernet LANs. You don’t need to do this, I just prefer it.
7) Never put a pc in the DMZ, no matter how hard the owner of the device requests it. I create inbound rules for each application as required.
8) Enable DHCP on the router but statically assign the ip addresses via DHCP. This makes the inbound rules much easier to handle. I put the addresses in zones too, e.g. PCs .10 to .50, printers .60 to .70, access points .80 to .90 etc to keep things tidy. Some people have 30+ devices on their home network and so using business ip practice makes sense to keep tabs on equipment.
9) Add firewall rules to stop outbound port 135, 445 etc to stop Windows PC talking out of the firewall to the internet. By default this traffic will be allowed. This may seem draconian but if your pc gets hit with a worm these ports are commonly used for further attacks and your firewall logs will show this traffic up and block it. I also stop snmp, telnet etc for the similar reasons. This depends on what the user wants to access.
10) Add firewall rules to stop devices that don’t require internet access from having it. For example wifi access points for XBOXs, wifi printers etc may not need internet access. If not put a rule in to stop it, anything dodgy will show up in your logs.
11) If the user wants this enough I configure remote access on the router but leave it disabled. I'm not keen on non encrypted/authenticated firewall admin traffic but I'd sooner remotely configure a new rule in the firewall than have the user struggle and put the pc in the DMZ. After remote access has been completed I turn remote access off and request the user, over the phone, change the router's password.
12) Disable anything on the router that is required. I have seen one unit that allows a VPN tunnel to be brought up to securely remotely access home PCs from away. This is a great idea but if it isn’t used then disable it; every additional piece of software that runs on a system is potentially a hole.
13) Discourage the use of Remote Desktop/Terminal Services, PC Anywhere, VNC or other remote access systems for home PCs. Many people use them but I want more protection mechanisms than simple username/password for access. While your home PC may not contain critical information it can be used to attack other systems or other abuse.
Some may see these actions over the top but as they are free and fairly easy to configure it seems daft to me not to configure them.
Please note I do not work on domestic firewalls for a living and I’m not touting for trade!!
HTH
MAC filtering will stop unauthorised access to a point. Do not rely on stopping the broadcast of SSID as a security measure, free software on Linux and Windows can easily pull that from non SSID broadcast traffic (see http://stumbler.net).
I would configure WPA or WEP on your system, do not use clear text.
As a guide here is what I always carry out on domestic systems:
1) Ensure Router has the latest vendor patches installed. Keep any eye out for new ones too.
2) Turn on MAC filtering. Note what each MAC address is and why it is there. As Malman says, MAC addresses can be spoofed which is why you also need encryption/authentication.
3) Use at least WEP encryption, preferably more. Sometimes you have to use WEP as not all equipment supports better encryption. WEP is crack-able but much better than nothing.
4) Disable SSID Broadcast (see note above!).
5) Change the default username and password on the router. Choose strong passwords that are not actual English words.
6) I normally change the routers ip address to 192.168.x.254 too as .254 is normally where routers live on class c Ethernet LANs. You don’t need to do this, I just prefer it.
7) Never put a pc in the DMZ, no matter how hard the owner of the device requests it. I create inbound rules for each application as required.
8) Enable DHCP on the router but statically assign the ip addresses via DHCP. This makes the inbound rules much easier to handle. I put the addresses in zones too, e.g. PCs .10 to .50, printers .60 to .70, access points .80 to .90 etc to keep things tidy. Some people have 30+ devices on their home network and so using business ip practice makes sense to keep tabs on equipment.
9) Add firewall rules to stop outbound port 135, 445 etc to stop Windows PC talking out of the firewall to the internet. By default this traffic will be allowed. This may seem draconian but if your pc gets hit with a worm these ports are commonly used for further attacks and your firewall logs will show this traffic up and block it. I also stop snmp, telnet etc for the similar reasons. This depends on what the user wants to access.
10) Add firewall rules to stop devices that don’t require internet access from having it. For example wifi access points for XBOXs, wifi printers etc may not need internet access. If not put a rule in to stop it, anything dodgy will show up in your logs.
11) If the user wants this enough I configure remote access on the router but leave it disabled. I'm not keen on non encrypted/authenticated firewall admin traffic but I'd sooner remotely configure a new rule in the firewall than have the user struggle and put the pc in the DMZ. After remote access has been completed I turn remote access off and request the user, over the phone, change the router's password.
12) Disable anything on the router that is required. I have seen one unit that allows a VPN tunnel to be brought up to securely remotely access home PCs from away. This is a great idea but if it isn’t used then disable it; every additional piece of software that runs on a system is potentially a hole.
13) Discourage the use of Remote Desktop/Terminal Services, PC Anywhere, VNC or other remote access systems for home PCs. Many people use them but I want more protection mechanisms than simple username/password for access. While your home PC may not contain critical information it can be used to attack other systems or other abuse.
Some may see these actions over the top but as they are free and fairly easy to configure it seems daft to me not to configure them.
Please note I do not work on domestic firewalls for a living and I’m not touting for trade!!
HTH
Raify said:on any Linux computer, for example, find the network startup script for the node you want to use, and add the line
Is there a way to 'spoof' a MAC address?
thanks for the reply,
LLADDR=<desired MAC>
Everybody can do this with a normal text editor.
>> Edited by Bodo on Friday 30th December 00:07
Thanks again for all the advice, particularly Chumpers. Some very good ideas there.
I've managed to get the Squeezebox to connect with WPA Pre shared key so I've turned the security back on. I think that WPA, MAc Filtering and no broadcast should be fine.
Rather annoyingly, my PSP (which I was going to use as a remote) won't connect now. That can wait for another day...
I've managed to get the Squeezebox to connect with WPA Pre shared key so I've turned the security back on. I think that WPA, MAc Filtering and no broadcast should be fine.
Rather annoyingly, my PSP (which I was going to use as a remote) won't connect now. That can wait for another day...
Raify said:
Thanks again for all the advice, particularly Chumpers. Some very good ideas there.
I've managed to get the Squeezebox to connect with WPA Pre shared key so I've turned the security back on. I think that WPA, MAc Filtering and no broadcast should be fine.
Rather annoyingly, my PSP (which I was going to use as a remote) won't connect now. That can wait for another day...
Ahh - you need to upgrade the firmware on the PSP. 2.5 upwards allows you to authenticate with WPA-PSK. It is one of the few good reasons to upgrade. Mine works fine with SSID disabled and encryption enabled at home.
Glen
>> Edited by GlenMH on Friday 30th December 11:04
Just ever so lightly off topic..
Has anyone actually had a look over their shoulder as to how much technology, time, money and effort is involved in setting up a 'secure' wireless network how it should be?
Me personaly, I've gone back to wired, as I had nothing but bother with dropped connections, channel overcrowding, War Drivers (net stumbler is your friend here) and have now done the whole house in CAT5e (obsolete I know). I just turn on my wireless when I want to use my laptop, and turn it off afterwards. I call it risk managment.
I don't trust wifi as far as I can throw it
Has anyone actually had a look over their shoulder as to how much technology, time, money and effort is involved in setting up a 'secure' wireless network how it should be?
Me personaly, I've gone back to wired, as I had nothing but bother with dropped connections, channel overcrowding, War Drivers (net stumbler is your friend here) and have now done the whole house in CAT5e (obsolete I know). I just turn on my wireless when I want to use my laptop, and turn it off afterwards. I call it risk managment.
I don't trust wifi as far as I can throw it
Good post from Chumpers above, surprised myself with how many of those measures I'd managed to implement despite being a wireless virgin. Not rocket science so why not do it once you've figured it all out.
I too use the "switch the wireless bit off until I want to use the laptop" approach. Made sense to me. Not much effort.
Just amazes me how many wireless networks I can find when I visit a mates house. Sitting in his front room looks like 2 out 3 are completely unprotected.
I too use the "switch the wireless bit off until I want to use the laptop" approach. Made sense to me. Not much effort.
Just amazes me how many wireless networks I can find when I visit a mates house. Sitting in his front room looks like 2 out 3 are completely unprotected.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff