Wireless Network Security: Just some tips.

[Adam]

Keep in mind, I am not a genius. I do not know everything. These are tips I tell everyone who asks me about wireless networking. I've typed this up from my head and I've tried to make it so anyone can use this information. Basically, I tried to make it so, no matter what router you use, that this will be helpful. Of course, if you are using a Linux router, you won't need this information. This also works for those little Wireless APs you can buy and add to your existing non-wireless router. Wireless Routers and Wireless APs have the same capabilities, depending on the brand and complexity.

CHANGE THE ADMIN PASSWORD.
I will explain why. Say you just take out your new router, and just plug it in. I can pull up to your house or anywhere where I can pick up your signal and login to your router. Anyone can do it with any internet browser. http://192.168.0.1/ and login using the default admin account. So, why should you care? I can lock you out of your router, change the password, change the IP of the router. Essentially, you won't have internet or network.

WEP vs WPA
Do you know what Wi-Fi stands for? If you said Wireless Fidelity, you are wrong. It says for WEP Is For Idiots. Of course, I will tell you why. WEP is EASILY cracked. WPA or WPA2 are the best options for wireless encryption. WPA support is built into Windows XP. WPA2 support can be added, but it requires a patch. I'm not entirely sure that was included in the automatic updates or not, you can google it if you are curious. Most modern wireless hardware comes with WPA support and newer devices will have WPA2 support. The best thing about WPA and WPA2 is that their password (or key) isn't limited to letters and numbers, you can use symbols as well, which means a more secure password. [P@sSw0rD] is more secure than p4s5w0rD.

If you don't have a choice, or some of your devices can't use WPA/WPA2 (PDAs, iPods, ect), then use WEP. The best way to keep your WEP key from getting cracked, is to use a secure password. The experts recommend a 128-bit key. When making a WEP password, STAY AWAY FROM DICTIONARY WORDS. That's the first thing that advanced brute force password crackers do, they run through a list of dictionary words, basically the entire dictionary. If you want your password to be secure, use a series of letters and numbers, upper and lower case. WEP keys cannot include symbols, something you should keep in mind. I use http://passwordmeter.com/ as a kind of yard stick for making passwords, it's pretty accurate. Also, I would recommend changing your WEP key often. If I had to constantly crack your wep key every time I wanted to use your network, I would eventually get annoyed and give up.

i said WPA/WPA2 are the best options but I was lying. If you really want an ultra secure, encrypted wireless connection, build a linux router, with a firewall and use WPA2 with EAP-TLS. And, if you know what that means, congratulations, you are a huge geek.

If you are going to remain unencrypted, remember this. I can download a packet sniffer, and sit and watch your packets fly by. I can sit in my car outside of your house and watch what you are doing on the internet. I can save everything you are sending. Just keep that in mind.

MAC Address Filtering
If you are technically savy, you can use mac filtering to control what devices can connect to your wireless. It's pretty simple, but time consuming. Just find the MAC Address for every device you want to use your network and add them into the router. If a device tries to connect and it's mac isn't in the list, it cannot connect. I know this is annoying, but trust me, it's probably one of the best way to keep bandwidth sharks off your network.

Turn off SSID Broadcasting (Credit to Foxhound)
This means that an outside source cannot attempt to access your network without knowing the name of the network in the first place.

Change your routers IP address (Credit to Die Geheimwaffe)
Altering your network IP address range from something other than the standard 192.168.1.xx adds additional security since it is slightly more difficult to exploit a network if you don't know the IP addresses of devices connected to it. I use 10.76.89.xx which is another IP address range specified for internal use. Any amount of frustration you can add is helpful, even if it only adds 30 seconds, an attacker is more likely to move on to an easier target the longer he/she spends without results.

And if you've read my whole post, I thank you. I'm glad someone appreciates my effort. Also, I will probably be editing this post a lot, so check back often.

 

[aviongeno]

If you are going to remain unencrypted, remember this. I can download a packet sniffer, and sit and watch your packets fly by. I can sit in my car outside of your house and watch what you are doing on the internet. I can save everything you are sending. Just keep that in mind.

-Edited for content, NO FLAMING!-

And if you've read my whole post, I thank you. I'm glad someone appreciates my effort.

let us hope someone cares half as much as you, or gives you the same respect you gave to me.

 

[Havegooda {A|R}]

-Also edited for content-



let us hope someone cares half as much as you, or gives you the same respect you gave to me.

An open wireless network is fair game, in NY the law states that if your UNSECURED wireless router is used for illegal purposes, it is YOUR fault, not the one doing the "crime".

Packetsniffing/injection is also not illegal. What you do on the network is (or may not be). I crack wifi all the time with my laptop (backtrack) to browse the web while I'm waiting for an extended period of time and don't have my iPhone on me. The most that'll happen will be that the owner of said network will beef up their security (MAC blacklists/whitelists, WPA2, etc), which is supposed to be a good thing.

Also, it's impossible to CHANGE your MAC address. You CAN make the router think you've got a different one, but it's impossible to change it permanently.

~Gooda~

 

[aviongeno]

i meant spoof

and i was refering to federal law, not state. FBI above your state government.

 

[Foxhound]

Another great technique is to turn off SSID Broadcasting. This means that an outside source cannot attempt to access your network without knowing the name of the network in the first place.

 

[Adam]

Post has been updated, thanks for the input Foxhound.

 

[Havegooda {A|R}]

i meant spoof

and i was refering to federal law, not state. FBI above your state government.

Sure you did.

In either case, the FBI isn't going to waste their time with chasing down people who have cracked wifi. For one, it'd be nearly impossible to find the person, unless they were actively connected to the network. Second, most connections last an hour or two at most (unless you're a jerk and are leeching bandwidth for days/weeks at a time), the feds would have no chance catching you...they'd hear about it (extremely unlikely, chances are the admin would spend time locking his network down instead of calling the FBI, dur hurrrr), and the cracker would be gone before they could even get on the road to said network.

For the record, unless something's changed in the state/federal laws, it is NOT illegal to gain access to a personal network. Your actions on said network can be illegal and wouldn't be placed on the admin's lap (fault wise) if it's encrypted/protected, but yours instead.

Show me a law that states otherwise, and I'll shut my yap.

tldr; feds wont waste time, crack away

~Gooda~

 

[trykael]

I'm tired of this guys - Havegooda and aviongeno you both obviously have differing opinions on a lot of stuff. If you're going to argue about it - take it off the boards. The next time I see posts like this you're both going to get a lot more than a PM.

 

[I-Die-Often]

You will never lock me out of my router even with the admin password changed... change it all you want, I can undo your damage with a small paperclip inserted into the reset button

I have to set my wireless back up at my house... I forgot the password and set it open last night so I could play PS3...

 

[Die Geheimwaffe]

Altering your network IP address range from something other than the standard 192.168.1.xx adds additional security since it is slightly more difficult to exploit a network if you don't know the IP addresses of devices connected to it. I use 10.76.89.xx which is another IP address range specified for internal use. Any amount of frustration you can add is helpful, even if it only adds 30 seconds, an attacker is more likely to move on to an easier target the longer he/she spends without results.

 

[Adam]

Updated! Thanks for the input.

 

[Adam]

Hate to resurrect a post, but it's stupid to create another one. Was just going to add that WPA has been cracked. I don't have any details, but I just recently heard someone in China(?) has cracked WPA.