Wireless Security - info please!

[Nox]

Being the paranoid bugger I am, i've completely and utterly ignored/never bothered with wireless with the view that i'd never use it!!

Times change... /sigh and i've just received a brand spanking wireless router from my ISP, so before this gets enabled i'm looking for either some decent online guides, or a glowing report on a book.

Does anyone have recommendations?

Nox

[dave87]

Never bothered reading a book, just went and set mine up, so a few tips instead of a guide

When you set it up, if you are only going to have a set number of pcs (the same ones day in day out) using it, there should be a function to filter by MAC address which you can use. Otherwise WPA-PSK is probably the best way to secure the wireless with the minimum of fuss , just make sure you get the PreShared Key the same on all PCS (unlike moi the first time I set it up )

[XA04]

As dave87 said, only allow computers with the MAC codes assigned to have access to the network (that's very good security right away).


For wireless encryption, don't use WEP (even if it does sound good with it's 64/128/256 bit encryption), because it can be cracked very easily. - And obviously, use a long, strong password. If you use a weak 3 letter password then no matter what encryption you use it could be brute forced easily.


WPA-PSK is the best to use really, most manufacturers have it as an option.. if not try updating the firmware.

[Nox]

Thanks Was hoping to find something a bit stronger than 'run of the mill' to attempt to make anyone move along next door though! See above note about paranoia!

Nox

[Blackspeech]

Just make sure that you know how to set it up on your particular router. Some, like my Dlink have Restart AP and Restart for instance and you must save your changes then do the appropriate restart.

WPA-PSK easy.

Of course - make a note of all your ISP settings and the new security settings, just in case you have to return to factory settings and also so when you need them you have the settings for permissioning other clients.

If you don't have a manual detailing the processes, get a PDF from your ISP/manufacturer before proceeding to go wireless.

[geezerone]

Yep, just started using wireless myself and went for WPA encryption. Use MAC address of the WIRELESS adaptor and not the wired one (at run prompt type: ipconfig/all and note the wireless MAC address down). Use alphanumeric characters for the shared key and use 8 or more characters.

You should also configure on each client that the MAC of your new router is the only one they will connect to and also rename the Wireless connection from its default option to an ambiguous name.

You can never be too secure remember so your paranoia isn't all bad!

[Moby-Dick]

Actually MAC address restriction is easier to break than WEP

WAP or WPA2 is the way to go.

You could also use static IP's so that clients dont automatically get handed an IP if they connect.

In an enterprise situation , you'd have the wireless segment seperate to the LAN and require users to connect back to the LAN via a VPN for example.

[Agent]

http://www.winguides.com/security/password.php
Great for making WPA-PSK's

Mixed letters + numbers, max length, works great
Just make sure you have a copy somwhere

[FatalSaviour]

Hiding the SSID once setup would be a bonus too.

[dave87]

Actually MAC address restriction is easier to break than WEP

WAP or WPA2 is the way to go.

You could also use static IP's so that clients dont automatically get handed an IP if they connect.

In an enterprise situation , you'd have the wireless segment seperate to the LAN and require users to connect back to the LAN via a VPN for example.

As long as people have no reason to get into your network - apart from stealing the internet connection, then as long as your network is the most secure out of the available ones, 'hackers' will go for the easier target. A combination of static IPs, mac address filtering, hidden SSID and WPA should deter most from trying, though if you have got valuable data then as moby said, you would split the network

[geezerone]

Don't agree with the MAC lack of security it surely can only help against people scanning. Yep, a combination of MAC, WPA, fixed IP would give most the best resonably straightforward to configure setup. I don't use wireless for anything such as online shopping or banking as no wireless connection is unbreakable by its nature and use a wired connection for that.

[XA04]

Actually MAC address restriction is easier to break than WEP

WAP or WPA2 is the way to go.

You could also use static IP's so that clients dont automatically get handed an IP if they connect.

In an enterprise situation , you'd have the wireless segment seperate to the LAN and require users to connect back to the LAN via a VPN for example.

I believe there is a way of changing your MAC code (or at least, making it appear as something else). But even if you did do something like that, you would still need to know the MAC address of what your trying to be... that's what an attacker would struggle with.

[Howard]

You can change it in Windows. Makes setting up NTL internet connections easy

[FatalSaviour]

I wasn't aware ntl employed MAC restrictions any more?

[Paul Adams]

I believe there is a way of changing your MAC code (or at least, making it appear as something else). But even if you did do something like that, you would still need to know the MAC address of what your trying to be... that's what an attacker would struggle with.

MAC address restrictions will only deter a passer-by - anyone spending any time near your access point while you use it could pick up your MAC address from the millions of packets sent back & forth - the same with non-broadcast ("hidden") SSIDs - they can be seen too as your client has to associate itself with the WLAN.

You often don't need software to change your MAC, many network interface drivers have the option to enter a hardware address through the driver, overriding the built-in address.


WPA-PSK with a decent key is the way to go, and inhibiting SSID broadcasts can just cause you problems getting a connection from your own client instead of affording you extra security.

MAC address restrictions and disabling DHCP can just create administrative overhead - these are also "shutting the stable door after the horse has bolted", as anyone able to break the encryption would have zero problems sniffing the packets to get MACs & IP addresses to use the network.

[Moby-Dick]

I believe there is a way of changing your MAC code (or at least, making it appear as something else). But even if you did do something like that, you would still need to know the MAC address of what your trying to be... that's what an attacker would struggle with.

What information do you think is shown when you run a packet sniffer ?

thats right...the MAC addresses of nodes talking on the network