From some security notes I have (WAP: Wireless Access Point). It amazes me always how little people know, or care, about computer and network security. It's mostly common sense, and a bit of know-how.
Update default passwords: Many WAPs come from the manufacturer with no password installed: the password field is often left blank. This opens up the network to all sorts of attacks. Replacing the default password with a strong password is essential.
Establish proper encryption settings: This means replacing the insecure WEP with WPA, or even better, WPA2. WPA2 uses the AES (Advanced Encryption Standard) cryptosystem for encryption; WPA, which was created as a sort of "stop-gap'" measure to counter the insecurities in WEP, uses a cryptosystem called RC4, but with dynamically changing keys.
This is often not done; a survey of over 2,500 WAPs in Indianapolis revealed that nearly half of them were not running any sort of encryption. In fact:
"People just really don't care about Wi-Fi security, and open Wi-Fi at home is a nice big target. Defaults [settings] are king.''
Control the reset function: Many WAPs have the ability to be reset to a factory default, either by pressing a key, or by inserting a pointed object into a ``reset'' hole. This will cause the WAP to revert to factory settings: often no passwords and no encryption. To avoid this, the WAP should be kept itself in a secure place, and checks of the equipment should be done regularly, including of system logs.
Change the SSID: The Service Set Identifier (SSID), is the name which identifies your WAP. It is usually an ASCII string, of variable length. A default SSID is set with your equipment. This should be changed: it prevents hackers from recognizing your hardware, and so making hardware-specific attacks.
Disable broadcast SSID: Most WAPs advertise their presence by broadcasting their SSIDs; to log in to the network, you look at the list of SSIDs presented by your software, and login to whichever one you have access. But the problem here is making yourself known in the first place. If the broadcast is disabled, a general wireless sweep will not reveal your WAP; instead you will have to perform an active search on the SSID name.
Enable MAC address filtering: Every network device has a a unique identifier
Media Access Control address; usually a string of 12 hexadecimal characters in pairs, separated by a hyphens or colons, such as: 00:12:F0:00:CB:7D. MAC address filtering only allows devices with address listed in a table to access the WAP. This is in fact easy to outwit: addresses are transmitted in plaintext, so can be captured, and a hacker can very easily "spoof'' the address by changing his own MAC to that of a recognized MAC.
However, as part of a general defense-in-depth strategy, for a small network such filtering should be enabled.
Note that some people don't consider wireless security a major issue, as long as the rest of the network is secure. Says Bruce Schneier ``I have a completely open Wi-Fi network. Firstly, I don't care if my neighbours are using my network. Secondly, I've protected my computers. Thirdly, it's polite. When people come over they can use it.'' (Later on, in his blog on
http://www.schneier.com/blog/archives/2006/06/schneier_asks_t.html, Schneier said that: ``For the record, I have an ultra-secure wireless network that automatically reports all hacking attempts to unsavory men with bitey dogs.'')
As well as securing the access point, the clients (the laptops or other wireless equipment) must be secured:
Disable wireless when not being used:I If you are in a wired environment, or if you are offline: \emph{turn off or disable your wireless hardware}. This prevents hackers from using your wireless hardware to obtain access to the network---even if you are not logged in using wireless---or gaining control of your laptop.
Enable a firewall: This is just good sense!
Disable file sharing: Again, a standard security recommendation, but more highly desirable in a wireless setting, where the less ``openings'' available to a hacker, the better.
The "take home message'' with wireless security is this: properly configure your access points and wireless clients, regularly update software, implement proper authentication (good, strong passwords) and intrusion detection systems, perform security audits (check system logs!), and enable effective encryption.
That'll do for now.
-T.
(it was 4:10 am)
