Wireless Security

[Apophis]

I'm writing up a whitepaper to using wireless access points and routers in a home network environment but I wanted to do a quick poll first. If you guys could answer this poll it would be greatly appreciated. Of course, I will be posting this whitepaper to the forums to benefit any of you thinking about, or currently using wireless networking.

[Apophis]

Whoever voted that you use WEP with MAC address filtering, can you send me a PM please so I can get some additional information? Please don't post that publically though, for your own sake.. :-)

[Lirix]

Hmm, my wireless router supports a 64-bit WEP(or at least claims to). I haven't actually used it yet since I'm not the biggest fan of wireless anything, but thought I'd throw it out there.

[Sniper]

I think my Dad uses a wireless with 128 bit WEP encryption.. and mac filtering. I'm not sure though

[TheFeniX]

For your average home/SOHO network: 128+bit encryption + MAC address filtering will do just fine. Also, make sure to disable SSID broadcasts. This alone beats out any "wireless warriors" or neighbors trying to "bogart" your bandwidth.

Enterprise applications depend soley on what your needs are. It's like asking what's the best car/truck to buy* without any knowledge on what it's to be used for.

Needless, any enterprised should be using WPA. It's easy to get even people with almost no knowledge to configure them. MAC filtering depends on if you have a static amount of laptops or plan to allow teachers/employees to bring in anything they want (bad idea unless you isolate them from the rest of the network or make sure they are patched with AV).

I can't answer the poll because different solutions warrant different applications. Give me a scenario and I'll go into details.

Wait, I'm an idiot: you did say home network. A small home is so easy to administer that there's no reason to use anything strong than WEP + MAC filtering. Yes, WEP is flawed and crackable, but it takes a large amount of packets to do it. Enterprise wireless networks crank them out in no time, but if someone has to clone a MAC (when it's offline), then sniff packets for a week just to see the Pamela and Tommy Lee video you're downloading: he's going to move on.

Just make sure you copy the hex key in a text file onto a floppy. Typing those things by hand sucks. Also, if you do use Linksys's WEP password: do not set it to your SSID. You'd think this is self-evident, but you'd be wrong.

PM me if you want any other specific info.

EDIT: If you do use WEP only and live in an apartment or other tightly packed living area I strongly recommend you enable MAC filtering. If you need help, PM me.

* Buy Dodge

[Apophis]

Originally Posted by TheFeniX

For your average home/SOHO network: 128+bit encryption + MAC address filtering will do just fine. Also, make sure to disable SSID broadcasts. This alone beats out any "wireless warriors" or neighbors trying to "bogart" your bandwidth.

Disabling SSID broadcasts will not keep your SSID secret. It only disables the active SSID announcement. As long as you're using 802.11x and sending packets, your SSID is still going through the air and very easily picked up.

Enterprise applications depend soley on what your needs are. It's like asking what's the best car/truck to buy* without any knowledge on what it's to be used for.

Needless, any enterprised should be using WPA. It's easy to get even people with almost no knowledge to configure them. MAC filtering depends on if you have a static amount of laptops or plan to allow teachers/employees to bring in anything they want (bad idea unless you isolate them from the rest of the network or make sure they are patched with AV).

Personally. I don't think wireless should be used in enterprise applications at all. At least not without WPA encryption with some external form of authentication mechanism and an active 802.11 IDS system.

Wait, I'm an idiot: you did say home network. A small home is so easy to administer that there's no reason to use anything strong than WEP + MAC filtering. Yes, WEP is flawed and crackable, but it takes a large amount of packets to do it. Enterprise wireless networks crank them out in no time, but if someone has to clone a MAC (when it's offline), then sniff packets for a week just to see the Pamela and Tommy Lee video you're downloading: he's going to move on.

Give me 5 minutes outside your home while you're playing a game or just surfing around the web and I'll give you your WEP key. Give me 2 more minutes and I'll have your MAC address spoofed and be associated to your access point. :-)

[Wyzcrak]

Give him another 90 seconds and your dog will be pregnant.

My company is a software vendor for Fedex. They will not allow us to use wireless networking in our facility if we access their network remotely.

[TheFeniX]

I understand where you're coming from Apo, but you have to look at it realistically.

A person at that skill level is not going to wate his time on the Wireless network "BillyBobsApart." It goes back to the old addage: "Why do you lock your doors at night? To keep honest people out."

Network security follows the same rules. If a determined hacker (with the proper skills)wants in your network: he's going to get in. You can really only slow him down to the point where he gets pissed off and leaves. Some script kiddy sitting on his parents computer is usually not going to have the knowledge to bust WEP and MAC filtering. Not to say it won't happen, but the chances are slim.

I won't even quote a business customer who says he wants WEP ( or god forbid no) security on his wireless network. The risk is too high for us. But if Jim Bob wants a cheap quote on wireless for his home so he can download MP3s from his backyard, I do feel comfortable quoting him a cheap WEP capable router.

I'd like WEP to dissappear, but as long as it's the cheapest implementation of wireless security, some customers are only going to want to pay for it.

[CingularDuality]

OK, I know nothing about wireless security. I do know that while I was in Arizona, I bought a wireless "G" card for my PC so that I could access my hotel's wireless network.

Since I did nothing to configure any security at all, was I opening my PC up to anyone that wanted to browse my HDD?

[Apophis]

Originally Posted by CingularDuality

OK, I know nothing about wireless security. I do know that while I was in Arizona, I bought a wireless "G" card for my PC so that I could access my hotel's wireless network.

Since I did nothing to configure any security at all, was I opening my PC up to anyone that wanted to browse my HDD?

Well. That's a large concern. You were certainly opening up your network traffic to be captured and viewed by anyone listening in on the air. If you checked your e-mail you transmitted your username/password through the air in plain text, any data you sent would be easily captured and readable.

Most people look at the issue of security from the standpoint that no one would ever want to get into their computer. There's nothing worth going on it for. Truth be told, most people have enough personal information on their computers to have their identities stolen. Identity theft is a rapidly growing crime in the US and it IS just the casual user that is being attacked in these situations. The technology available to break things like WEP is becoming easier and easier to obtain and use, it's putting more power in the hands of non-computer savvy individuals and making it easier for them to engage in identity theft.

[Apophis]

Originally Posted by TheFeniX

I understand where you're coming from Apo, but you have to look at it realistically.

A person at that skill level is not going to wate his time on the Wireless network "BillyBobsApart." It goes back to the old addage: "Why do you lock your doors at night? To keep honest people out."

This is a big part of the concern. Your statement may have been true a year or two ago, but it doesn't take someone with a high skill level to break WEP anymore. The number of individuals interested in gaining access to BillyBobsApart is rapidly growing. BillyBob is on the verge of being a greater target than his local school or university.

I won't even quote a business customer who says he wants WEP ( or god forbid no) security on his wireless network. The risk is too high for us. But if Jim Bob wants a cheap quote on wireless for his home so he can download MP3s from his backyard, I do feel comfortable quoting him a cheap WEP capable router.

I'd like WEP to dissappear, but as long as it's the cheapest implementation of wireless security, some customers are only going to want to pay for it.

WPA can be had for the cost of a $70 access point. People should think of it as a simple one-time insurance policy.

[=Sarc=]

I voted 48-bit WEP but it was the closest to the 64-bit WEP that I use. I'm in a small one-bedroom apartment and don't have too many neighbours. None of them seem to use wireless and I set the signal strength on my router to 25%.