Wireless Security Attacks and Defenses 120
An anonymous reader writes "IT-Observer is running a comprehensive overview of wireless attacks and defenses. From the article: 'Wireless technology can provide numerous benefits in the business world. By deploying wireless networks, customers, partners, and employees are given the freedom of mobility from within and from outside of the organization. This can help businesses to increase productivity and effectiveness, lower costs and increase scalability, improve relationships with business partners, and attract new customers.'"
Wireless wants to be free. (Score:1, Insightful)
Re:Wireless wants to be free. (Score:1)
http://www.staticusers.net/wardrivingisnotacrime/ [staticusers.net]
Re:Wireless defence? (Score:2)
Re:Wireless defence? (Score:1)
I suggest shortening the phrase (Score:5, Funny)
Re:I suggest shortening the phrase (Score:1)
it will make most of the discussions a lot more blah too.
Re:I suggest shortening the phrase (Score:2)
Blah.
Re:I suggest shortening the phrase (Score:1)
Re:I suggest shortening the phrase (Score:3, Insightful)
Re:I suggest shortening the phrase (Score:5, Funny)
Re:I suggest shortening the phrase (Score:2)
Re:I suggest shortening the phrase (Score:1)
Duba Bubu?
Blah? (Score:1)
Re:I suggest shortening the phrase (Score:1)
Comprehensive... (Score:3, Interesting)
Re:Comprehensive... (Score:2)
My favorite was the suggestion to disable DHCP. Anyone that you might be afraid of can use a sniffer and find the address range. If you've got an address and don't know the mask, the router will be more than happy to give it to you, either explicity through a routing protocol or you can just take a few stabs and see if the requests are reflected back to the subnet. Why do people insist on protecting their networks from newbies and
Duh! (Score:1)
Re:Duh! (Score:5, Insightful)
Which is a very good reason for not implementing it. I would strongly advise any business not to install IT which they don't understand how to implement and secure it properly because they would be, unwittingly, leaving the door open.
Here in the rarified atmosphere of /. we may laugh at the lamers and their pathetic inability to utilise IT. Out there in the real world people are simply getting on with it. Maybe they have better things to spend their time and money on than installing all the latest geek toys.
As a frinstance, my brother is a very successful salesman. He doesn't even own a laptop and can see no reason to do so. He's too busy earning a great deal more money than I do to bother about it.
Re:Duh! (Score:1)
There is nothing wrong with not using IT or other types of office helpers in a small business. The problem though is that system does not scale well if you are growing. You eventually will not be able to effectively run your business or maintain any consistent and accurate records yourself. You will either need another person or some type of technology or some combination of both. As the
Re:Duh! (Score:2)
And on an only slightly-related note, what can home users do to secure a wireless network -- besides the obvious stuff like use encryption, change passwords, disable SSID, MAC filtering, e
Re:Duh! (Score:2)
Re:Duh! (Score:2, Redundant)
And that's a perfectly valid reason not to implement it. That's why we won't implement it. Besides, cat 5 cable is insanely cheap.
Re:Duh! (Score:4, Insightful)
OK. The cable itself is cheap. Putting it where it needs to be is expensive. At my company, we hire outside contractors to run all of our cable. It seems like I am always spools of cable lying around, and guys with their feet on a ladder and their heads in the ceiling. Since an outside company is doing this, it turns a $10/hour worker into a $30/hour or more expence to my company.
But still, the wireless is usually used for the manager laptops. They have to have to be able to check Lookout ^h^h^h^h^h^h^h Outlook in meeting.
Re:Duh! (Score:3, Insightful)
Re:Duh! (Score:2)
Re:Duh! (Score:2)
Ok...I've got to ask as I've seen it often enough before. What do all the ctl-h's mean when used like this..? Is it supposed to look like something? All I get is gibberish...
Re:Duh! (Score:1)
Here's a more in-depth answer: http://answers.google.com/answers/threadview?id=3
Re:Duh! (Score:3, Insightful)
No, its because they understand that it cannot be secured properly. If you think it can, either you don't understand the risks or you have a different definition of acceptable risk than they do. Assuming your clients are stupid because they don't agree with you isn't the key to a successful career
Or maybe they know how to implement it, and aren't willing to spend the resources (
The scenario TFA begins with (Score:3, Insightful)
Know what confidential data you can access by simply connecting a computer to the network at my school and most universities, for that matter? Almost nothing! All confidential data should be protected with end-to-end encryption, then the worst that can happen if a third party gets a machine on the internal network is that they can use excessive amounts of bandwidth. Denial-of-service attacks are much easier to recover from than (possible) leaks of confidential data.
Comment removed (Score:3, Insightful)
Re:Want to truly secure your wireless network? (Score:3, Insightful)
Re:Want to truly secure your wireless network? (Score:2)
Re:Want to truly secure your wireless network? (Score:1)
How about just putting UTP and coax connectors in every room? Plenty of people I know that build new houses or fix old ones already do this.
Re:Want to truly secure your wireless network? (Score:2)
Surely you mean a Faraday cage ? Wilipedia [wikipedia.org]
Re: (Score:3, Funny)
Re:Want to truly secure your wireless network? (Score:2)
Faraday cages, wireless networks, and cell phones (Score:4, Insightful)
It is possible to construct a Faraday Cage [wikipedia.org] to block wireless network signals without blocking cell phone communications... Wireless networking uses 2.4 GHz signals. Cell phones use entirely different frequencies.
Try it yourself! Place your cell phone in a microwave, close the door (but don't turn it on, of course), and call your cell phone. If your phone rings, then the cell phone signal made it past the microwave's faraday cage. And microwave and wireless networking signals are almost the same -- my network throughput dies whenever I use my microwave.
NOTE: Different cell phone frequencies exist, so YMMV. I can't try this myself (no land-line) but according to what I learned in physics class (LONG ago), I'm pretty confident it should work just fine. Anyone want to give this experiment a try and post how it worked for you?
Re:Faraday cages, wireless networks, and cell phon (Score:2)
Re:Faraday cages, wireless networks, and cell phon (Score:2)
Well, I hope you're wrong.... I for one, would prefer to own a microwave whose shielding was designed for maximum attenuation at the frequency used by the microwave (somwhere
Re:Faraday cages, wireless networks, and cell phon (Score:1)
Look no further: http://ask.engadget.com/2006/03/30/ask-engadget-bl ock-wifi-the-right-way/ [engadget.com]?
Re:Faraday cages, wireless networks, and cell phon (Score:1)
Actually, the cell phone signal here is marginal, at best. I often have calls drop on me, if I can get them at all. Hence my request in the original post for others to try it and report how it worke for them.
Comment removed (Score:4, Funny)
Re: (Score:2)
From the article... (Score:2)
Dependability. (Score:2)
Re:Dependability. (Score:2)
Re:Dependability. (Score:2)
Article with pictures (Score:2, Informative)
Do they really know what they're talking about (Score:1)
No, no, no, no, NO
As Bruce Schneier says "Public security is always more secure than proprietary security"
http://www.schneier.com/crypto-gram-9909.html#Open SourceandSecurity [schneier.com]
Also, why don't they mention WPA? ( http://en.wikipedia.org/wiki/Wi-Fi_Protected_Acces s [wikipedia.org] )
Re:Do they really know what they're talking about (Score:1)
any security at all...is better than no security? (Score:1)
Re:Do they really know what they're talking about (Score:3, Insightful)
However, *bad* security (such as your ROT-13 example) is worse than no security at all, because it leads you to believe you're actually doing something, when in fact you're not.
If you implement something that doesn't actually do anything, you've wasted time. If it doesn't do anything, why did you implement it?
Because you've convinced yourself that it does do something, and the fact that it doesn't means that you've lulled your
Unbelievable fluff: why did it get posted??? (Score:3, Informative)
In a word, they should be punished. And someone should tape their eyes open while reading WiFoo or another good book on just how many zillion interesting hacks there are for wireless. And then, the site should get the check back-- if they were so silly as to have paid these guys.
And I wonder, how many more airy and light posts will there be, today? Slashdot Lite, less filling, less intelligent-- news for birds.
Re:Unbelievable fluff: why did it get posted??? (Score:1)
(ducks) (twice)
The article is 100% wrongheaded (Score:5, Informative)
Look at page 3. It's the one where they tell you what you should do to secure your network.
Bullshit. Everything you need to do this can be found on a single Linux LiveCD (Auditor Linux) including the kit for doing replay attacks. Only unmotivated "hackers" will fail to crack WEP.
Score: 0/1
Bullshit. Again, this will only get people who are unmotivated. MAC spoofing is a triviality. It typically will stop drive-by users of wifi, because they can usually find one that has no "protection" and they can use that. MAC restriction will NOT stop anyone who wants onto your network for any reason other than a minor whim.
Score: 0/2
Using a halfway decent scanner makes ANY settings changes you do (besides turning on WPA) utterly useless.
Score: 0/3
Again, a good scanner makes this irrelevant.
Score: 0/4
Uh, this is the same thing as "mac address blocking". They're the SAME FEATURE, just one is default accept, and the other is default deny.
Score: 0/5 (I should really assign a negative point for trying to use the same feature as a bullet point twice, but I'll be nice.)
If someone has physical access to your AP, you're fucked anyway. If they can do remote admin in your AP, you're an idiot anyway - and turning off remote admin isn't even listed as a good idea here.
Score: 0/6
No, it isn't. A few moments of sniffing will tell you what you need to know. Utterly useless and it just makes your life harder.
Score: 0/7
This article tells you nothing about how to effectively secure your network. In fact, it tells you to do a whole bunch of things that won't work.
Want to secure wifi? There is only one means to do so, and that is to use a tunnel with strong encryption. Whether you're using com
Re:The article is 100% wrongheaded (Score:4, Insightful)
Oh wait, they can't... following the techniques outlined in the article won't stop someone who is determined to get somewhere, just like locking your door won't keep someone who really wants to get into your house out, but as a general deterrant works pretty well.
If you're that bloody paranoid about someone scooping your shemale porn downloads, just stay on the wire.
Re:The article is 100% wrongheaded (Score:2)
Re:The article is 100% wrongheaded (Score:2)
VPN is better, but WEP is TOTALLY WORTHLESS. TOTALLY!
If you could tell someone to do ONE thing, it certainly ought to be to turn on WPA and use a long PSK. The article was a waste of time for the authors.
Cheers,
Greg
Re:The article is 100% wrongheaded (Score:1, Informative)
Re:The article is 100% wrongheaded (Score:2)
Further...
The additional cost to any small business by upgrading the infrastructure capable of WPA is trivial. In most cases, all that would n
WEP is not "Wireless Encryption Protocol" (Score:4, Interesting)
WEP is also, as you point out, not anywhere equivalent to wired privacy.
Sigh.
"Hey, look at me! I just read two chapters in a "Wireless for Dummies" book and I'm getting paid to write an article in a trade journal!"
Where's the justice?
Googlefight says its Wireless Encryption Protocol (Score:1)
wireless encryption protocol: 5,860,000 results
Wired Equivalent Privacy: 2,200,000 results
Wikipedia says Wired Equivalent Privacy [wikipedia.org]
Screw the uneducated masses -- this fool probably Googled "WEP", along with the rest of his low-rent "Wireless for Dummies" security tips.
Re:The article is 100% wrongheaded (Score:4, Interesting)
All the advice if for SERVERS but what about clients?
In my office I can reach a nearby free WiFi. For kicks I set up my AP with the same SSID and ran it open. Sniff Sniff. Not even illegal as they are connecting to ME ! Remember kids, no expectation of privacy in public places runs both ways =)
Re:The article is 100% wrongheaded (Score:1)
Re:The article is 100% wrongheaded (Score:3, Informative)
Even with its inherent weaknesses, Wireless Encryption Protocols or WEP is still a good method for preventing attackers from capturing your network traffic. Less-experienced hackers will probably not even attempt to capture data packets from a wireless network that is broadcasting using WEP.
Bullshit. Everything you need to do this can be found on a single Linux LiveCD (Auditor Linux) inclu
Re:The article is 100% wrongheaded (Score:2)
Sometimes bad security is worse than none at all as it makes people feel safe, when infact someone's just walked through that flimsy front door and nicked all the silverware.
Re:The article is 100% wrongheaded (Score:2)
Re:The article is 100% wrongheaded (Score:2, Informative)
Re:The article is 100% wrongheaded (Score:1, Funny)
If that doesn't keep people out, nothing would!
They said warchalking (Score:2)
Useless (Score:3, Insightful)
Not even a mention of WPA2, certificates (hardware/software), or any other actual security measures in there. Some decent stuff about PEBRAC errors in the beginning, and other changes that should be obvious to any netadmin with two brain cells to rub together, but TFA is really not even worth the time it takes to read.
Not so comprehensive (Score:2, Insightful)
This article may be helpful to some newbies, but I'm looking for something extra here. Where's the 802.11X and 802.11i/WPA2 information?
I see WEP mentioned and then WEP2. I think that by WEP2 the author means TKIP. Of corse there is no explanation of what either does and why WEP2/TKIP is better than WEP.
Why bother learning about MitM attacks? Rogue access points? ISD??? You're using WEP for God's sake!!!
This is is basically something I'd expect to see on Digg. Any self-respecting /. visitor already kn
Re:Not so comprehensive (Score:1)
Re:Not so comprehensive (Score:1)
Just the other day I configured a network across a couple of offices using OpenVPN and WPA-PSK with 'AES only' requiring WPA2. I was slightly wondering about my configuration as I selected to use a 64-bit Hex static key - Except for the VPN ports I mostly blocked all comunication over the regular cards, (except for allowing internett access to al
Re:Not so comprehensive (Score:1)
article doesn't cover quite a few things (Score:4, Interesting)
worthless (Score:4, Funny)
MODERATORS ON CRACK AGAIN (Score:2)
Hardly comprehensive...barely even useful (Score:5, Insightful)
a) 'default' SSIDS are irrelevant. It doesn't make the networks easier to find. It's not like when I ask windows to "View Wireless Networks" it only shows me the ones called "linksys". Perhaps at one time seeing a router called 'linksys' might have made me think that the user is less likely to be running encryption but under XP it tells me right away which ones are encrypted and which aren't.
b) Warchalking - old hat. Perhaps before it was feasable to simply leave my PDA running as I walk around and report all the AP's it sees this might have been useful.
c) WEP - You've got to be joking. The article mentions the 'newer 128-bit specification' doesn't mention DWEP using 802.1x or WPA. Either make it much harder to crack.
d) IDS - Possibly useful but really only once someone is accessing your system via your wireless.
e) MACs - The article seems to vassilate here, on one hand saying that MAC isn't meant for access control and on the other saying that you should use them for ACLs. MAC authentication is useless, it's trival to find a useful MAC address on any network that's used regularly.
f) DHCP - Stupid. Disabling it stops very little for very long. The vast majority of WLANs are using one of the three non-routable IP ranges. It wouldn't take me long to find one that's accessable. It also introduces a serious pain for the maintainers for the network.
What it should mention are the following:
a) Authentication - 802.1x preferably. I personally don't like web portals as it makes it easier to fool users with "evil twin" attacks.
b) WPA2, using WEP or idealy AES.
c) For corporate WLANs use a system that can use your own wireless networks to detect rogue AP's. I'm using Nortel (now cisco) 2270 (with 2230 aps) and I have SNMP traps which warn me when someone in the WLAN starts up an AP.
d) VLANS - keep the WLAN traffic restricted to particular ports, destinations.
e) Have a written policy for your users. Make them understand that adding their own wireless equipment is forbidden.
f) Using some kind of authentication on your ethernet jacks helps - it's hard to find an AP that will do 802.1x on the WAN side. Even so, it would be tied to a particular user. Using the information from (c) you can just disable their account.
f) Invest in a solution that keeps users OS and Virus software up-to-date.
Re:Hardly comprehensive...barely even useful (Score:1)
Re:Hardly comprehensive...barely even useful (Score:2)
I disagree. If you don't change your SSID, then someone can figure out what router you are using, and therefore will have an easier time breaking into it. They could either:
a) Try the default password OR
b) Using a known hack for that type of router (Although, I admit I don't know of any.)
Re:Hardly comprehensive...barely even useful (Score:1)
http://coffer.com/mac_find/ [coffer.com]
Will tell you the make of any WAP just from it's ethernet address. You don't even need to associate with it.
Re:Hardly comprehensive...barely even useful (Score:1)
Warchalking is not so much old hat, as been dead for 4 years... and according to wikipedia [wikipedia.org] "The symbol is now widely used as a shorthand in logos and advertising" I don't think its possible to get more old and busted (at least without the aid of a truss).
Re:Hardly comprehensive...barely even useful (Score:1)
WPA2 and WEP do not mix. WEP is a specifically prohibited encryption method when using WPA2. Your choices
are AES and TKIP, and the spec does allow you to mix the two together at the same time.
WEP - even dynamic WEP - is evil. It can be cracked in a period of a few minutes, which means you have to do key rotation faster than the time required to crack the key. Unfortunately, 802.1x with dynamic WEP does not have a standardized way of doing key rotation. Often the AP will
Scary stuff (Score:1)
That kind of experience is breathtaking, gained from years and years, or even minutes, of reading the Kismet FAQ.
I'm going across the road to see if any of my neighbours want me to set up their Wireless Routers for them. If they aren't going to read the manual, they certainly wont have read that article. Which begs the question, who exactly is supposed to read
Article Can't Be Current (Score:4, Informative)
Re:Article Can't Be Current (Score:2)
You do have to wonder, though. I picked up a wireless router in summer 2004, and WPA was a standard, off-the-shelf option for security. All the material I read in preparation to set up the network indicated that WPA was a better choice than WEP. The references for this article include one dated December 2004 -- several months after I did my own research.
Re:Article Can't Be Current (Score:2)
It's okay, though, I post old stuff on my site too.
My solution. (Score:2)
I call it "wire."
Re:My solution. (Score:2)
Easy yet effectivsolution for rogue access points. (Score:1)
WEP = Wireless Encryption Protocol? (Score:1)
Any linux programs that detect rogue APs & not (Score:2)