A.P. Lawrence

Wireless Network Security

More Articles

Wireless networks are not just popular and convenient for mobile computer users. Crackers are finding them an easy target to gain entry into corporate networks. Digital intruders are compromising defenseless air space at corporations, public hot spots and homes to gain illegal entry to computers. A hot spot is an area within range of a wi-fi antenna, which allows internet access or network connectivity to happen by sending the packets via radio waves.

According to Gartner, the market researcher, about 90% of all mobile devices (laptops, tablets, pda's and cellular phones) are unprotected. What this points out in earnest is that no matter how much money is spent on your corporate network, if someone breaches a remote device at a wireless access point, you have been hacked. They also point out, that over 50% of work-related laptops will have wireless capability by the end of 2004.

When you log on to a network via a wireless access point you are transmitting your login name and password over open airwaves. In 2003, a survey revealed that up to 90% of all wireless networks do not use encryption to protect their wireless network segments. What this means is that anyone with a laptop and a wireless adapter could intercept and read the data packets being sent or received by legitimate users. All that is needed is the ability to capture packets or "sniff" the airwaves, a trivial function offered by dozens of downloadable programs that are used by wardrivers. The term wardriver is in reference to those who drive around with wireless gear looking for network segments to jump on.

While no network is 100% secure, you can make your wireless segment as safe as the wired one and all you will need is time and a little network knowledge.

So what steps can be taken, to make your wireless network segment safer? Here are some helpful tips to better secure a wireless segment:

1) Change default information - It is easy to find out what the default name and password are for various manufacturers, it is posted on the internet. Many also use a standard default IP subnet address, like 192.168.x.x. You should rename the router, assign a strong password for accessing the router configuration software, change the SSID (see step 3) and consider changing the IP addressing.

2) Enable encryption - WEP (Wired Equivalent Privacy) or WPA (Wi-Fi Protected Access) is the original wi-fi encryption schema and comes in several strengths (40, 64 and 128-bit). However, its underlying algorithm is flawed and subject to relatively easy cracking.

To see how flawed, you can use tools like:

AirSnort - http://airsnort.shmoo.com
kismet - http://www.kismetwireless.net

3) Turn on infrastructure mode - Disable the "ad-hoc" mode, which lets clients set up peer-to-peer networks and could allow rogue users to connect to your network through a legitimate wireless client.

3) Disable broadcast of the SSID (Service Set Identifier) - The SSID is like the network name for the wireless portion. In order for wireless clients to connect they first must know the SSID. A wireless access point (AP) or router in open network mode will periodically broadcast a beacon signal which announces to the world that the network is live and ready to go. The beacon also includes data such as the signal strength and functional capabilities of the AP as well as the SSID.

4) Change default community names - Network management tools like SNMP come with default names that can be easily guessed.

5) MAC addressing filtering - Most access points let you restrict access to known MAC (Media Access Control) addresses. Each network device (such as a computer, wireless card, or printer) has a unique MAC address and by allowing access only to pre-defined MAC addresses you greatly reduce the risk of rogue clients connecting with or perusing your network resources.

6) Access points on separate subnets - Allow for all access point traffic to the internal (trusted) network to pass through a firewall or other security appliance.

Corporate wireless security should also address the use of wi-fi in their security policy and procedures documentation. They should also be using enterprise-level security tools like RADIUS authentication servers and dedicated Virtual Private Networks (VPNs) to help achieve a more secure environment.

None of the steps that we have mentioned by themselves will totally prevent a possible network invasion. But if they are all used in tandem to create a "defense in depth" strategy, the wireless experience can not only be fun, but secure also.

To respond to this or previous newsletters or to inquire about an on-site presentation, please feel free to call us at 508-995-4933 or email us at mdesrosiers@m3ipinc.com.

Need eyes on the ground at your customer's site?
Installation and light training Boston and New England
Reliable and experienced, punctual and professional.

Until next month.....

Regards,

Michael Desrosiers
Founder
m3ip, Inc.
1-508-995-4933
mdesrosiers@m3ipinc.com
www.m3ipinc.com

Enter your email address for automatic notification of new posts here
(be sure to whitelist 'feedburner.com' if you use spam filtering)

/MDesrosiers/wirelesssecurity.html copyright April 2004 Michael Desrosiers All Rights Reserved

Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more. We appreciate comments and article submissions.

Publishing your articles here