OT: unathorized network user.

Mikkel L. Ellertson mikkel at infinity-ltd.com
Thu Jan 24 19:09:04 UTC 2008


Dave Ihnat wrote:
> 
> Similarly, leaving SSID on doesn't stop the determined hacker with tools.
> But none of the common WiFi connection agents on laptops will show a
> non- broadcast SSID; you have to go out, get the tools, and work on it.
Well, the connection management for XP that came with my Toshiba 
laptop do show access points that do not broadcast their SSID. I 
would have to check, but I think the connection management software 
supplied by AT&T if you have their WiFi service will also do this. 
(I have to connect to an AT&T access point to re-activate the software.)

> Restricting MAC addresses can easily be overcome--but you have to have
> gotten the tools to do so.
Getting around the blocking of a specific MAC address is easy with 
the standard tools on both Linux and Windows. To discover the MAC 
addresses in use does require a bit of work, but the software is so 
easy to find. So that is about like closing your door - it keeps 
people from wandering in, but not much else. So it may or may not be 
worth the effort. If you have visitors that you want to give access, 
it is a lot more complicated then just giving then a USB key with 
the network configuration, or a pass phrase so that they can hook 
up. You also have to copy their MAC address to the router.

What I am trying to say is that things like this can be handy in 
keeping honest people honest, but they may not be worth the trouble. 
Things like disabling the SSID can cause you trouble without adding 
any benefit. Changing the default SSID will stop accidental 
connections, and allow auto-connection by authorized computers. But 
you are not talking about something that will slow down someone 
trying to crack your network. The danger is in someone thinking that 
it will, and not taking real security precautions.

It can also backfire on you, in that it can make you a more tempting 
target for someone that is learning to crack wireless networks, 
because it is more of a challenge then an open network, but is not 
as intimidating as a WPA protected network. (Or I got this neat 
script that is supposed to grab the SSID and MAC address of the 
wireless connection. Here is one that is not broadcasting its SSID, 
lets try it out.)

> DHCP--eh, it's too convenient to get rid of.
> Logging--preferably with forwarding to an internal system--is useful.
> But after all of these, let the cracker find the WPA encryption behind
> all the lightweight stuff.  You've got to have someone who really wants
> into your network at that point.
> 
The trick is to secure your wireless network without making it too 
inconvenient for you to use. After all, if you wanted it totally 
secure, you would turn off the wireless part of the router 
completely, or only turn it on when you need it. You can also take 
some of the more complicated measures, like only allowing VPN 
connections between computers on your network, or putting a firewall 
between the wireless router and the rest of hte local network.

Mikkel
-- 

   Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20080124/4f18d693/attachment-0001.sig>


More information about the fedora-list mailing list