Re: wireless network security best practice?

From: erik (erik_at_geenspam.vanwesten.net)
Date: 09/06/03 

Date: Sat, 06 Sep 2003 22:20:06 +0200

wesley wrote:

> On Mon, 25 Aug 2003 17:46:30 +0000, /dev/null wrote:
>
>> We have a local wireless net. Is 128 bit WEP and MAC filtering
>> enough?
>>
>> I tend to think not, anyone could sniff and pick up MACs and then set
>> their card to use that MAC, and eventually break the WEP at brute
>> force.
>>
>> Feedback/Comments?
>
> To figure if your security is good enough, you first have to take a
> look at the type of traffic you're running on your wireless network,
> both in terms of security sensitivity and traffic volume. For example,
> Fort Knox needs a lot more protection than the average home.
>
> One of the big issues with wireless is that your radio waves from your
> access point don't stop at your home or office's walls. That feature
> makes it possible for others to intercept and use your signal.
>
> While breaking a WEP transmission is certainly possible, it still
> requires a LOT of data be gathered. Airsnort needs 5 to 10 million
> packets in order to break a code, according to their info. In my case,
> that means someone would have to park in front of my house for months
> at a time to gather enough data to crack my 128 bit WEP code.
>
> On the other hand, an office with many high traffic users on their
> wireless network could generate enough traffic in a short period of
> time for their code to be cracked. Or, someone located in an apartment
> building might have a neighbor who could monitor their connection for
> months on end to try and break into their network.
>
> In my case, if I'm going to get paranoid about my wireless network at
> home, then I also need to be paranoid about my ISP monitoring my
> traffic in general. I need to quit giving my credit card to waiters
> and salespeople when I buy stuff. I need to replace all the wood doors
> in my house with metal security doors, and so on.
>
> Yeah, WEP has it holes and should be improved. WPA is going to help do
> that and there will certainly be continued improvements down the road.
>
> But that doesn't mean I need to stop using wireless right now. A
> typical home user is not a high-profile target for a wireless crook.
> What hacker wants to spend months gathering data so he can break in
> and get... what?
>
> Businesses, OTOH, need to be more careful as they generate a lot of
> traffic, do so faster, and typically have more people trying to break
> into their networks to get critical info. Some others have already
> described methods to address those issues.
>
> But wireless security is just like any other security issue. One needs
> to do a good risk assessment before going whole-hog. Your security
> efforts should match the risk probablility involved.

Wile you may have some points you forget several things:
1 It is signicantly harder to do anything wrong with a hardwired
configuration, your ISP is not worth looking at security wise.
2 It is definately possible to crack WEP without considerable effort.
3 It is not about breaking in into your network, but about _abusing_
your network. You do not want to be disconnected because your gateway
was used to send spam or worse things.
4 Efficient security measures are very simple.

In general security is not only about your (probably invaluable) data,
but about being used as a stepping stone. The latter is something you
need to prevent at all costs.

EJ 

-- 
Remove the obvious part (including the dot) for my email address

Relevant Pages

  • RE: palm VIIx wireless modem
    ... Here is a Wireless LAN Security FAQ, ... What are solutions to minimizing WLAN risk? ... that connects clients to the internal network. ...
    (Security-Basics)
  • RE: Wireless Audit Cost
    ... "complete analysis" - to me this means that a full audit of both ... the wired and wireless networks is taking place. ... network off the internal LAN. ... >network has the usual security measures in place, ...
    (Pen-Test)
  • RE: [Full-Disclosure] Wireless ISPs
    ... If they put WEP in, that's one more thing for customer to do and they'll ... Therefore end-user security ... Im using this venue to influence several wireless ISPs ... >> All transactions done via secure websites are ...
    (Full-Disclosure)
  • RE: 802.11i research papers
    ... IT Infrastructure - Network Design ... Subject: 802.11i research papers ... with WPA which is the replacement to WEP (TKIP is ... WEP and other security features that the protocol has implemented. ...
    (Security-Basics)
  • Re: Wireless security question...
    ... > related to wireless security. ... to the computer on that network that's a little different, ... Can this hacker take control of the wireless laptop? ... but it depends on the security running on said laptop..if they have ...
    (Security-Basics)
Loading