Jump to content


Photo
- - - - -

If you still think wireless security is useless because you have nothing to hide ...


  • Please log in to reply
89 replies to this topic

#1 Dan (electron)

Dan (electron)

    CocoonTech Admin

  • Admin
  • PipPipPipPip
  • 10865 posts
  • Twitter:@CocoonTech
  • Location:Central NY
  • Experience:guru
  • Software:EventGhost, HomeSeer
  • Hardware:Elk M1, Mi Casa Verde Vera, Ocelot
  • Tech:X10-RF, UPB, Z-Wave, ZigBee
  • Audio:AirPlay
  • Video:SageTV
  • CCTV:analog, ip, dvr
  • Phone:OBi100/110

Posted 26 April 2011 - 08:40 AM

For years now, I have been hearing how people insist that they don't lock down their wireless router because they have nothing to hide, or are convinced their PC's are locked down, so there is no reason to lock down the wireless network. While I have been arguing about this for years, here is an interesting article showing how NOT locking down your router can really backfire:

http://www.msnbc.msn...ience-wireless/

There are so many other reasons for locking down your router, but hopefully that article will inspire people to take another look at their wireless security.

#2 JonW

JonW

    Cocoonut

  • Registered
  • PipPipPipPip
  • 1035 posts
  • Location:Huntington Beach, CA
  • Hardware:HAI OmniPro II
  • Tech:UPB

Posted 26 April 2011 - 10:03 AM

The sad thing is that many people that do lock down their router think they are safe because they are using WEP security. Unfortunately, they are just about as open as the people who use no security. To make things worse, many ISP's like Verizon are still using WEP as a default on their routers (at least they did last year on my new router).

#3 Dan (electron)

Dan (electron)

    CocoonTech Admin

  • Admin
  • PipPipPipPip
  • 10865 posts
  • Twitter:@CocoonTech
  • Location:Central NY
  • Experience:guru
  • Software:EventGhost, HomeSeer
  • Hardware:Elk M1, Mi Casa Verde Vera, Ocelot
  • Tech:X10-RF, UPB, Z-Wave, ZigBee
  • Audio:AirPlay
  • Video:SageTV
  • CCTV:analog, ip, dvr
  • Phone:OBi100/110

Posted 26 April 2011 - 11:47 AM

It's definitely not a simple process for a typical home owner to lock down his router in real secure way. But even if WEP/WPA was used, it would at least keep out some of 'drive-by' traffic. If someone is targeting a Wi-Fi network, then there isn't much a typical home owner can do but unplug his router.

#4 JonW

JonW

    Cocoonut

  • Registered
  • PipPipPipPip
  • 1035 posts
  • Location:Huntington Beach, CA
  • Hardware:HAI OmniPro II
  • Tech:UPB

Posted 26 April 2011 - 12:45 PM

After reading the linked article, I was questioning why ICE is breaking down doors for this. I guess I'm not alone. Check out the comments in the linked article and also at Yahoo for the same article: http://news.yahoo.co...s_wi_fi_warning .

As much as pedofiles and open WiFi are a problem, I think the bigger problem is the way our Govt handles these situations (and the fact that it is ICE handing it).

#5 project_x

project_x

    Dedicated Cocooner

  • Registered
  • PipPipPip
  • 185 posts
  • Experience:average
  • Software:Premise
  • Hardware:Elk M1
  • Tech:Z-Wave, 1-Wire
  • Audio:Custom
  • Video:Custom

Posted 26 April 2011 - 06:00 PM

Can't you solve the wireless security issues by only allowing specific MAC address on to your network, in conjunction with WPA? MAC addresses are 48bit + you need to "guess" the right MAC to spoof before you get to the WPA.

#6 PaulB

PaulB

    Dedicated Cocooner

  • Registered
  • PipPipPip
  • 170 posts
  • Location:Philadelphia, PA
  • Experience:average
  • Hardware:HAI OmniPro II
  • Tech:X10-PLC, Z-Wave

Posted 26 April 2011 - 07:28 PM

Security should be like an onion. It should have layers. The more layers the harder the intruder has to work and therefore will go some place else. Just like home security.

#7 wuench

wuench

    Cocoonut

  • Registered
  • PipPipPipPip
  • 1659 posts
  • Location:St. Louis, MO
  • Experience:guru
  • Software:Harmony, Open Source Automation
  • Hardware:Elk M1, ISY-99
  • Tech:INSTEON, Z-Wave
  • Audio:Sonos
  • Video:Custom
  • CCTV:ip
  • Phone:OBi100/110

Posted 26 April 2011 - 08:10 PM

Can't you solve the wireless security issues by only allowing specific MAC address on to your network, in conjunction with WPA? MAC addresses are 48bit + you need to "guess" the right MAC to spoof before you get to the WPA.


All you need is a wireless sniffer to see the MAC addresses in use. No guessing needed. Every packet contains the source MAC address.

Strong encryption is the only answer WPA2 or if you must use WEP you can always setup IPSEC tunnels or some other VPN to encrypt traffic between your PC's. And use long keys with lowercase/uppercase and symbols and no dictionary words. Even WPA can be cracked if the keys are simple. The more complicated the keys the longer and more date that must be collected before it can be cracked.

Edited by wuench, 26 April 2011 - 08:28 PM.


#8 Lou Apo

Lou Apo

    Cocoonut

  • Registered
  • PipPipPipPip
  • 2719 posts
  • Location:Austin TX
  • Experience:average
  • Hardware:ISY-99
  • Tech:INSTEON
  • Audio:Custom
  • Video:Windows Media Center
  • CCTV:analog, dvr

Posted 26 April 2011 - 09:03 PM

Does anyone know if not broadcasting your ssid makes much difference. I have mine shut off but I assume there is a way to get around that also. I just don't know how thick of an "onion layer" that is.

#9 hagak

hagak

    Dedicated Cocooner

  • Registered
  • PipPipPip
  • 142 posts

Posted 26 April 2011 - 09:10 PM

Does anyone know if not broadcasting your ssid makes much difference. I have mine shut off but I assume there is a way to get around that also. I just don't know how thick of an "onion layer" that is.

Yes not broadcasting your ssid does one thing and that is break the wifi spec. Do not bother doing this because it adds nothing to secure your network and potential will cause issues with some clients.

MAC address filter is not all that effective either since the person that can crack wep or wpa will not be bothered one bit by MAC filtering.

#10 jlegault

jlegault

    Dedicated Cocooner

  • Registered
  • PipPipPip
  • 131 posts

Posted 26 April 2011 - 11:10 PM

I was hacked about 5 years ago by a local group here in Austin posing as Austin Energy (sitting in trucks at night). They broke through 128bit WEP (which at the time was all that was available to consumers), reprogrammed my router to send packets through their gateway, and installed a key logger on my win2000 box. I didn't notice until I found a pending transfer of a significant chunk of money out of my brokerage account. The bank/brokerage company took it seriously, got the FBI involved....and basically led to their eventual capture a couple years later....my neighbor actually chased one of their guys away who was sitting at the end of our block many months after my incident. I guess my block was like shooting fish in a barrel for them.

#11 Work2Play

Work2Play

    Cocoonut

  • -=Gold Supporter=-
  • 4955 posts
  • Location:Colorado
  • Experience:guru
  • Software:Elve
  • Hardware:Elk M1, RUC-01
  • Tech:X10-RF, UPB, RadioRA2
  • Audio:AirPlay
  • Video:XBMC
  • CCTV:ip, dvr
  • Phone:3CX, Asterisk, FreePBX, Grandstream, Ooma

Posted 27 April 2011 - 01:30 AM

Just to add to this thread - last year I took a good look at how to "hack" wifi networks - as part of a test for my work. I won't get into any of the specifics, but it was way too easy. There are a couple things I learned though:
  • Hiding your SSID is pointless
  • MAC filtering is pointless
  • WEP is easy to crack - and the busier your wifi network the quicker the hacker will get access. I hacked my own house in 4 hours.
  • WPA/WPA2 are supposedly about equal to crack using brute-force; but it's really hard to crack it. Some people more recently have learned how to use the GPU (graphics card CPU) to punch through pretty quick (days/weeks of attempts).
The reason I say hiding your SSID and MAC filtering are pointless - the tools you run to crack WEP/WPA automatically hand you that information as part of the process. Even if your router isn't broadcasting SSID, your computer is searching for it - and anything your computer searches for is visible (your favorite hotels, your work wifi, etc). The MAC addresses of every computer on your network are displayed in plain sight in front of you - and you can see when they go offline (meaning you can now clone them).

I agree with the idea that security should be made up of layers - but the hassles MAC filtering add aren't worth it. You bring home a new phone, chumby, Wii, or anything else - and have to go add the MAC address to the table... and for what? Slowing a hacker down by 10-15 seconds? That's like locking the doorknob and the deadbolt on your front door. When they break the deadbolt down, the doorknob cracks anyways - that doesn't slow anyone down.

Learning how to crack wifi was educational - what I got out of it is that there's no such thing as secure wifi - any more than there's any such thing as a secure house. You can lock all the doors and windows and try to slow people down and discourage them from bothering with yours - but at the end of the day, if they want in bad enough, they're getting in. The goal is to discourage it as much as possible so they find an easier target. Now if you have something so important on your network that you can't take that chance or that would make you a target, you need to start looking at better isolation practices separating your wifi from your real network - then using VPN or other encrypted access methods as mentioned above. That at least buys you more protection.

#12 hagak

hagak

    Dedicated Cocooner

  • Registered
  • PipPipPip
  • 142 posts

Posted 27 April 2011 - 07:16 AM

Just to add you do not have to wait a machine to go offline to clone it's MAC address. No issue with the same MAC getting assigned 2 ips.

#13 drvnbysound

drvnbysound

    Cocoonut

  • Registered
  • PipPipPipPip
  • 2857 posts
  • Experience:average
  • Hardware:Elk M1
  • Tech:Z-Wave
  • Audio:Custom
  • Video:SageTV
  • CCTV:analog, ip, dvr

Posted 27 April 2011 - 07:29 AM

Just to add to this thread - last year I took a good look at how to "hack" wifi networks - as part of a test for my work. I won't get into any of the specifics, but it was way too easy. There are a couple things I learned though:

  • Hiding your SSID is pointless
  • MAC filtering is pointless
  • WEP is easy to crack - and the busier your wifi network the quicker the hacker will get access. I hacked my own house in 4 hours.
  • WPA/WPA2 are supposedly about equal to crack using brute-force; but it's really hard to crack it. Some people more recently have learned how to use the GPU (graphics card CPU) to punch through pretty quick (days/weeks of attempts).
The reason I say hiding your SSID and MAC filtering are pointless - the tools you run to crack WEP/WPA automatically hand you that information as part of the process. Even if your router isn't broadcasting SSID, your computer is searching for it - and anything your computer searches for is visible (your favorite hotels, your work wifi, etc). The MAC addresses of every computer on your network are displayed in plain sight in front of you - and you can see when they go offline (meaning you can now clone them).

I agree with the idea that security should be made up of layers - but the hassles MAC filtering add aren't worth it. You bring home a new phone, chumby, Wii, or anything else - and have to go add the MAC address to the table... and for what? Slowing a hacker down by 10-15 seconds? That's like locking the doorknob and the deadbolt on your front door. When they break the deadbolt down, the doorknob cracks anyways - that doesn't slow anyone down.

Learning how to crack wifi was educational - what I got out of it is that there's no such thing as secure wifi - any more than there's any such thing as a secure house. You can lock all the doors and windows and try to slow people down and discourage them from bothering with yours - but at the end of the day, if they want in bad enough, they're getting in. The goal is to discourage it as much as possible so they find an easier target. Now if you have something so important on your network that you can't take that chance or that would make you a target, you need to start looking at better isolation practices separating your wifi from your real network - then using VPN or other encrypted access methods as mentioned above. That at least buys you more protection.


+1 for this post.

Going through all the trouble of "securing" your WiFi is only to give yourself some delusional warm-fuzzy feeling, and makes it harder for you to use. As others mentioned, when you bring home a new device, you will have to spend the time adding the MAC to your table, entering in all the information, etc. but when it comes down to it, you are still not secure, and you can still be hacked (fairly easily) - most likely within a couple of hours. This is why I have said many times, that if you do a couple of things on this list, the LARGE majority of people (e.g. your neighbors) will have no idea how to get into your network, and the only way that you are going to be hacked, is if you are targeted..... and if you happen to be that lucky "targeted" one, nothing that you have done or could do is going to stop anyone - other than turning off the router (as someone else mentioned).

I have seen about a hand-full of 802.11 wireless systems that are "secure" ... they take about 2 days to hack.

#14 drozwood90

drozwood90

    Cocoonut

  • Registered
  • PipPipPipPip
  • 1196 posts
  • Experience:guru
  • Software:HomeSeer
  • Tech:X10-RF, UPB, Z-Wave
  • Audio:Custom
  • Video:Custom

Posted 27 April 2011 - 08:00 AM

Yes not broadcasting your ssid does one thing and that is break the wifi spec. Do not bother doing this because it adds nothing to secure your network and potential will cause issues with some clients.

MAC address filter is not all that effective either since the person that can crack wep or wpa will not be bothered one bit by MAC filtering.


I disagree. Breaking spec. or not, I don't care. It is more secure in my area. Think about it. In my area, it seems EVERY house has a router. From my living room, I can pickup ~20 routers on any sniffing software I've used (I was trying to figure out if there was any channels NOT in use). So, unless someone is SPECIFICALLY trying to get into my network, they are not going to be targeting my system. A quick scan gives them a LOT to play with. If there are no other routers in the area, no SSID shows up, but there is wifi traffic, of course it doesn't mean anything.

"layers"...this is just one, and it's not a very difficult to add.

I was considering adding a second router, then use that on a second IP subnet, then use SSH/VPN to tunnel into my local network. Just another layer. For the moment, I just use one laptop on the wifi...so, turning it on and off via script is not a big deal.

--Dan

#15 video321

video321

    Dedicated Cocooner

  • Registered
  • PipPipPip
  • 959 posts
  • Location:NJ
  • Hardware:Elk M1, Mi Casa Verde Vera
  • Tech:Z-Wave
  • Audio:Custom
  • Video:Custom
  • CCTV:analog, dvr
  • Phone:Ooma

Posted 27 April 2011 - 08:15 AM

I disagree. Breaking spec. or not, I don't care. It is more secure in my area. Think about it. In my area, it seems EVERY house has a router. From my living room, I can pickup ~20 routers on any sniffing software I've used (I was trying to figure out if there was any channels NOT in use). So, unless someone is SPECIFICALLY trying to get into my network, they are not going to be targeting my system. A quick scan gives them a LOT to play with. If there are no other routers in the area, no SSID shows up, but there is wifi traffic, of course it doesn't mean anything.

Sorry, but that is naive. There is nothing wrong with going through the hassle of it if it makes you feel better though.
And, yes, it may cause issues with some clients and just makes it harder for you to trouble shoot.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users