What’s in a Name?

hello-my-name-is-wifiMost home users select their wireless network name without much thought to the actual name except to make it easy for them to see and connect to. So many people never think that the networks name also known as the Service Set Identifier or SSID could be a security risk. Okay, a security risk may be a reach, but let’s just say some SSIDs are more secure than others, and I will list some dos and don’ts when selecting an SSID.

Before the list lets discuss what makes the SSID important. Hackers need to gather several pieces of information including the SSID to crack a networks WPA/WPA2 password. Hackers have pre-configured tables with this information including common or default SSID names and if you’re using one of these common names you have made their job easier and your network more of a target.

  • Do change the SSID from the factory set default wireless network name.
  • Don’t select a name in top 1000 most common SSIDs. Now this list is very long and at first glance you will notice a lot of factory given default names (dlink, Linksys, 2wire, Netgear, etc…), so as mentioned above change the default name.
  • Don’t use your first or last name, address, phone number, or anything else personal. Broadcasting personal information identifies who owns the network, and may aid the hacker in cracking the wireless password.
  • Do be unique when selecting an SSID, but too much creativity may draw attention to the networks name along with attempts to hack the network. With a maximum of 32 characters you have some creative capabilities, but also think camouflage, so the network name blends in with the other networks in range and does not stand out.
  • Do follow these rules even if your SSID is hidden or not being broadcast. Hidden network SSIDs can very easily be discovered and they are not immune.

The most important thing to learn is to always change the SSID from the default. Having a unique SSID can not only make the hackers job more difficult, but it may signal to the hacker that if the name was changed other settings were changed as well persuading the hacker to look for an easier target.

Cyber Spring Cleaning! Don’t Forget Your Wireless Router!

cleaning-productsAs the weather warms up articles to remind us about cleaning up our devices, online accounts, making backups, and changing passwords are sure to show up, but don’t forget to add your wireless router to this list. Over time the wireless environment may have changed and the number of devices connecting to the network has increased and you have noticed a decrease in the performance. I have listed some items to check to either improve the performance or security of your wireless network.

Upgrade the Router

Electronics age fast and if you’re still running an 802.11g router it is time to upgrade. Look for an 802.11n protocol wireless router or get the latest and greatest 802.11ac router and be ready for the next wave of wireless devices. Either way you’ll notice a performance boost and the router won’t create a bottleneck in the network.

Check for the Latest Firmware

While not as often as Windows or Apple software updates a routers software called firmware does get the occasional update. Firmware could add functionality, patch bugs, or add security features. When you log into the routers management interface look for the firmware section to verify the current version and download any available updates. The firmware update could take several minutes to complete and at some stages you may think nothing is happening, but do not power off or restart the router during the update since this could brick the device!

Move to the 5 GHz Band

This could be more technical than most people can understand, but wireless networks can run in the 2.4 GHz and 5 GHz bands. Most home wireless networks use the 2.4 GHz band and along with wireless networks the 2.4 GHz band has signals from microwaves, cordless telephones, baby monitors, and other home devices making it very crowded. With the 2.4 GHz band being so crowded there are interference issues that can affect performance of the wireless network. Setting up the wireless network in the less used 5 GHz band will result in less interference and better performance.

Change the Channel

wifianalyzerWhether you’re wireless network runs in the 2.4 GHz or 5 GHz band things around you may have changed since the original setup and a quick scan of the neighboring networks may show channel interference. Scanning utilities such as InSSIDer or WiFi Analyzer will offer a snapshot of the wireless networks in range along with channel usage. As mentioned the 2.4 GHz band will be very crowded and channels 1, 6, and 11 the most heavily used. The best option is to move the network to the 5 GHz band, but if you stay in the 2.4 GHz band move the network to a non-used channel, but know that interference from adjacent 2.4 GHz channels can still effect performance of the wireless network.

Upgrade to WPA2 Security

If your still using WEP for wireless security it is time to update it to WPA2. WEP was cracked long ago and many utilities to crack WEP are freely available from the internet. When selecting the WPA2 Passphrase don’t use a common dictionary word, your pet’s name, your phone number, keyboard pattern, ect… For the best security a completely random 20 plus character WPA2 passphrase should be used. For further advice on selecting a secure WPA passphrase please read my earlier blog post.

Disable WPS

WiFi Protected Setup (WPS) or push and connect security has a known security flaw and should be disabled in the routers management interface. Even if you’re not using WPS to connect and secure devices to the wireless network it could be enabled by default and needs to be disabled manually.

Change the Passphrase

It is recommended to change personal passwords regularly so include your wireless passphrase to that list and make sure to change it at least once a year. For further advice on selecting a secure WPA passphrase please read my earlier blog post.

Setup a Guest Network

If people come to your house and ask to get on the wireless network it might be time to set up a separate guest network. It is not a good idea to hand out the WPA2 code for the main wireless network to everyone and having the guest network and traffic isolated from the main network is preferred. Many home routers allow multiple networks or enabling the guest network. You can also use a second router for the guest network, but make sure the routers are physically 10 feet apart from each other, and use enough channel separation to eliminate interference. Do assign a simpler WPA2 passphrase on the guest network so you’re not broadcasting an open network that anyone can connect to.

Disable Slower Wireless Protocols

Disabling slower protocols basically disables slower network speeds and can improve performance of the network. If your router and devices support the 802.11n protocol then disabling the 802.11g and 802.11b protocols will keep those devices from connecting and causing the network to communicate at those slower speeds.

Conclusion

So don’t run over to the wireless router with the feather duster or throw it in the dish washer, but if the network seems sluggish or not running as smoothly as it once was there are some things you can do. Check the user’s manual or the router manufactures website for extra help and tips to set up or configure the router. Thanks for reading and post any comments or questions below. I may not be able to answer specific router questions, but I can try to respond with a link or site URL for extra help.

Security Tips for Your Home Wireless Network

October is National Cyber Security Awareness month and this past October there was no shortage of great security awareness articles and advice being posted including tips to secure your home router and wireless network. The tips listed here are nothing new and it is important to know when configuring your home router no one setting can secure the network. Configuring a combination of settings for multiple layers of security will make the network and router secure.

Selecting a Channel

The first tip isn’t so much about security as it is about performance of the wireless network. If you’re not using an 802.11n router look to upgrade and before setting up the router do a quick scan for the other wireless networks in the area and the channels they are using. A free scanning utility from Metageek called InSSIDer for Home can be used to scan the wireless environment. After scanning the environment more than likely what you will find is the 2.4 GHz band and channels are very crowded and interference from these overlapping networks may affect performance of your network. The 5 GHz band will be less crowded and setting up the network to use a channel in this band should result in less interference from neighboring networks and overall better performance.

Screen Shot Courtesy of the Metageek Web Site

Screen Shot Courtesy of the Metageek Web Site

One trade-off is the 5 GHz network will have a smaller coverage footprint compared to the 2.4 GHz network. In some instances, such as in an apartment or condo complex you may want a smaller coverage area and might even adjust the routers power to a lower level to reduce the area of coverage. Again, taking advantage of the InSSIDer application you can test router placement and powers levels. InSSIDer can report the signal strength to find the best location for the router, and this up front surveying and planning will not only help network performance, but should cut down on the support issues.

WPA2 Encryption

Wireless network transmissions essentially have no borders and anyone within range of those transmissions could potentially capture the network traffic. Encryption of the wireless traffic is crucial and using the latest and greatest encryption standard of WPA2 is recommended. It is important to select a completely random passphrase with a minimum of 20 characters for the WPA2 key. You can read my earlier blog post for the importance of using WPA2 encryption and tips on selecting a secure WPA2 passphrase. 

Never Use WEP Encryption

WEP was the original encryption standard for wireless networks and was proven crackable. Numerous utilities freely available on the internet can crack WEP encryption in minutes!

Change the Admin Password

Many, if not all default SOHO (small office home office) router passwords are widely known, or easily found on the internet with a simple search. You can configure every security setting on the router, but leaving the Admin password as the default or selecting something that is easily guessed will defeat all the security you setup. Someone logging into the router can change any setting you have made or worse yet lock you out of your own router or brick the device.

Disable SSID Broadcast

Disabling the broadcast of the network SSID sounds like a great security option and some people think this will completely hide the network, but this is for from true. Anyone with a little knowledge and the right utilities can scan the airwaves and discover the hidden network SSID, so disabling the SSID broadcast should never be relied on as an end all security setting. Always combine the hidden SSID setting with the other settings mentioned to have strength with multiple security layers.

Disable Management of the Router from a Wireless Client

Force clients to be physically plugged into the router with a network cable to log in to the management interface. This setting will  not allow wireless clients to access the routers management interface to make any configuration or security changes.

Apply Firmware Updates to the Router

Every router has internal software called firmware loaded on it that manages the capabilities of the router. The router vendors occasionally release updates to their firmware to either improve functionality or patch vulnerabilities. Checking every so often for firmware updates will guarantee your router has all the latest features and security patches applied.

Conclusion

As mentioned a layered method of security works best to guarantee your router and wireless network is secure as possible. Someone trying to get access to your network would likely move on to an easier target after discovering the multiple layers of security.

For additional security tips be sure to check out the links below. Thanks! Dale

Securing Your Home Network

Security is Your Responsibility When Using Free Wi-Fi

Hotel Customers Want WiFi But Most Ignore the Risks

How Stores Use Your Phone’s WiFi to Track Your Shopping Habits

Cracking WPA using Fern WiFi Cracker

Note: For this demo I’m using a lab environment network that is not routed to the internet. I will be using the Fern WiFi Cracker open source wireless security tool included in the Kali Linux and Backtrack 5 r3 security distros. Before attempting to use Fern or any other utility in Kali or Backtrack please make sure to read the help and MAN pages for a complete description of the program options and switches. This demo is for wireless pentesting educational purposes and to emphasize the insecurities of using a weak or common dictionary word for wireless network authentication and encryption security key or passphrase.

Fern Wi-fi Cracker can crack WEP, WPA, and WPA2 secured wireless networks. Fern basically takes the command line utilities to crack these networks and puts them in a GUI. Very simple to use… scary easy! Fern also provides some extra functionality for hijacking sessions and locating a computers geolocation via its Mac address, but I have not tested with these features.

For this demo I will be using Backtrack 5 r3 running in VMware Workstation on a Win 7 host.

Originally I was using Fern in Kali and ran into some issues with my wireless adapter and with the program freezing or not opening after updating it. I have the fixes I discovered in another blog post for anyone else that may have these same problems.

Router Setup

I’m using an old Cisco/Linksys 802.11g wireless router for this demo and all the settings are defaulted except the security settings, which I set to WPA Personal with a Shared Key passphrase of “password”. The word password should never be used for a real password or passphrase and I’m using it here since I know the Fern program will quickly crack it. In real world situations a WPA/WPA2 passphrase should be completely random and not a common dictionary word. For help on creating a secure WPA/WPA2 passphrase please read my earlier blog post.

wpakey

Setup the Wireless Adapter

Plug in the USB wireless adapter (I’m using the Alfa AWUS036H 802.11b/g USB wireless adapter) and open the Terminal and run iwconfig to verify the USB adapter interface.

iwconfig

On occasions I have had to bring the wireless adapter interface up using the following command.

#ifconfig wlan0 up

Starting the Fern Program

To start Fern from the Terminal type in the following commands

#cd /pentest/wireless/fern-wifi-cracker
#python execute.py

or start Fern via the GUI using the Backtrack menu

Applications/Backtrack/Exploitation Tools/Wireless Exploitation Tools/WLAN Exploitation/fern-wifi-cracker

Using the Fern Program

Select the Interface and Fern enables monitor mode. If your wireless interface does not show in the list hit the Refresh button and try again.

interface

Before starting the scan double-click on any blank area of the Fern home screen to bring up the Access Point Scan Preferences screen. You can set the channel option to scan a single channel or leave it at the default All Channels. One nice feature is to check the Enable XTerms option which will have Fern open up the Terminal windows during its usage to see what the program is doing in the background. Click OK when done.

xterms

Back on the Fern home screen click the Scan for Access points button.

scanaps

Two Terminal windows will open; one showing the WEP enabled networks (no screen shot), and another showing the WPA enabled networks. The top part of the WPA Scan Terminal window shows the networks being found, and the lower part shows any connected client devices. For a WPA attack to work it requires a connected client. The most important part of the attack will kick the client off the wireless network and capture the 4-way handshake when the client device re-authenticates to the network. If the network you want to pentest has no connected client your out of luck!

wpanetworks

On Ferns home screen the networks being detected will start populating next to the WiFi WEP or WiFi WPA buttons. (I have been seeing less and less WEP enabled networks, so that is a good thing!)

networks

Clicking on the WiFi WEP or WiFi WPA button will bring up the Attack screen and the top pane will list the networks found. Select the AP to crack, but before clicking the Attack button to the right let’s go over a couple of settings.

networkwpa

I will use the Regular Attack option, but there is a WPS Attack option and I believe Fern uses the Reaver utility to launch the WPS attack. You can read more about Reaver by clicking here.

Common.txt is the wordlist that comes with the Fern program, but any wordlist you download or have created on your own can be used by hitting the Browse button and pointing Fern to the alternative wordlist file.

wordlist

With the Regular Attack and the wordlist selected hit the Attack button.

attackbutton

Fern will start the attack and on the left side of the screen the attack steps will turn yellow as Fern works through the various steps. The most important step is capturing the 4-way handshake and Fern will open an aireplay-ng Terminal window showing the progress of deauthentication (if XTerms is checked in the preferences) of the connected client.

settings

It may take several attempts to deauth a client and capture the 4-way handshake.

deauth

Once Fern has captured the handshake it will start the bruteforce attack. Viola! If the WPA key is in the wordlist being used it will display the found key in Red.

wpakeyfound

As I mentioned I setup a passphrase I knew would be found quickly, and from start to finish this attack took under 4 minutes!

Back on the Fern main screen is a Key Database button and it now shows one entry.

database

Clicking the Key Database button will display the found keys.

database2

Conclusion

Using a common dictionary word for a WPA or WPA2 passphrase makes it easier to hack with utilities like Fern. The Fern utility is free to download and simple to use, and not everyone is going to use it for legit wireless pentesting purposes.

With possession of the WPA key a person can associate to network and have a gateway to the internet, or they could launch other attacks. For example, with possession of the WPA key the attack could be expanded to include decryption of the data traffic of the legitimate clients on the wireless network.

Thanks for reading and stay wireless secure!

Keys, Keys, and Even More Keys!

I thought I had a good understanding of how the WPA/WPA2 encryption key generation process worked, that was, until I read Chapter 5 of the CWSP (Certified Wireless Security Professional) Study Guide. I was definitely amazed and a little confused of what all happens in the background when a client authenticates and the encryption keys are created. Dealing mostly with personal or small office wireless environments I took a special interest in the process to generate the encryption keys in small office home office (SOHO) networks. I’m a firm believer that a strong passphrase is mandatory when using WPA/WPA2 Personal, and part of writing this blog was not only my way to fully understand the encryption key creation process, but at the same time to stress how important it is to select a completely random WPA/WPA2 passphrase. An easily guessed passphrase or a common dictionary word can expose your wireless network and connected devices to hacking or decryption of the data. The passphrase will not only authenticate clients to the access point, but it is also the initial seeding material to create the master keys that are then used to create the transient and temporal keys that encrypt the unicast data frames and broadcast and multicast frames.

Definitions

Let’s start by defining the alphabet soup of letters and give some quick definitions to the important terms being used in the article.

WPA/WPA2 Passphrase: Selected by the network owner and entered as a simple ASCII character string from 8 to 63 characters. The passphrase is configured on the access point and manually entered on the client devices that will join the APs wireless network.

Authenticator: In a SOHO network this will be the access point.

Supplicant: Any device wanting to join an access points service set.

Pre-Shared key (PSK): The result when the passphrase goes through the passphrase to PSK mapping formula.

PMK (Pairwise Master Key): Is the highest order key and derived from the pre-shared key (PSK).

GMK (Group Master Key): Generated by the authenticator (access point) and is the seeding material for the group temporal key.

4-Way Handshake: Uses the pseudo-random function to create and distribute the dynamic encryption keys.

Nonce: A randomly generated value only used once.

PTK (Pairwise Transient Key): Final encryption key used to encrypt unicast data traffic.

GTK (Group Temporal Key): Final encryption key used to encrypt broadcast and multicast traffic.

Selecting the Passphrase

The first step is to choose the passphrase and enter it in the security section of the wireless routers management interface. Notice I did not say select a password! As mentioned before avoid using common dictionary words, and don’t use your name, address, phone number, pet’s names, favorite sports team name, etc… It is recommended to select a completely random passphrase and using a passphrase generator is the best option to select a random passphrase. For help on selecting a highly secure passphrase read my earlier blog post on creating a secure WPA/WPA2 passphrase.

WPA/WPA2 passphrases are static and susceptible to offline dictionary attacks, and it will become very clear why this passphrase be absolutely random for maximum security of the wireless network.

The graphic below shows the encryption key generation process and can be referenced throughout the article.

WPA/WPA2 Encryption Key Generation

WPA/WPA2 Encryption Key Generation

Passphrase to PSK Mapping

Manually enter the passphrase on the client devices that will be joining the wireless network. The passphrase authenticates the device to the APs wireless network, and behind the scenes the passphrase will go through the “passphrase to PSK mapping” function to transform it into the 256-bit Pre-Shared Key (PSK).

Here is the formula to convert a passphrase to the PSK.

PSK = PBKDF2(PassPhrase, ssid, ssidLength, 4096, 256)

The whole point of the passphrase to PSK mapping formula is to simplify configuration for the average home network user. Anyone can remember an 8 to 63 character passphrase compared to a 256-bit PSK.

Master Keys

The PSK will become the Pairwise Master Key (PMK), so basically the PSK is equal to the PMK.

The authenticator (access point) generates the Group Master Key (GMK). The GMK is derived by the authenticator and used to create the Group Temporal Key (GTK). The GTK will be used by the AP and all the authenticated clients to encrypt multicast and broadcast traffic.

4-Way Handshake

The graphic below is from Chapter 5 of the CWSP Study Guide to further explain the 4-way handshake process.

4wayhandshake2

The 4-way handshake is a 4 frame exchange (not including acknowledgements) between the supplicant and the authenticator. Using a pseudo-random function (PRF) the 4-way handshake will create the Pairwise Transient Key (PTK) by combining the PMK, an authenticator nonce, a supplicant nonce, the authenticator’s MAC address (AA), and the supplicant’s MAC address (SPA).

Here is the pseudo-random function formula and below the formula is a brief description for the 4 frames exchanged during the 4-way handshake.

PTK = PRF (PMK + ANonce + SNonce + AA + SPA)

Message 1: The authenticator sends its ANonce to the supplicant. The supplicant now has all the information needed to generate the PTK using the pseudo-random function. The PTK protects the unicast data traffic.

Message 2: The supplicant will send its SNonce to the authenticator. The authenticator now has all the information needed to generate a matching PTK using the pseudo-random function.

Message 3: The authenticator generates the GTK from the GMK and transfers the GTK to the supplicant. The GTK is encrypted using the PTK and a secure exchange takes place. The GTK protects the broadcast and multicast traffic.

Message 4: An acknowledgement that the client has successfully installed the PTK and GTK.

The client is now authenticated and possesses the dynamic encryption keys and can securely send and receive traffic through the access point.

Conclusion

In a SOHO network the passphrase is not only used for keeping unwanted devices from joining the network, but also the seeding material to create the transient and temporal encryption keys. If an attacker obtains the passphrase they could not only join the wireless network, but they could crack the PTK encryption key. If an attacker captures a 4-way handshake exchange between a client and the access point, and with possession of the passphrase the attacker has all the variables needed to duplicate the PTK. With the PTK the attacker can decrypt any unicast encrypted data frames between the individual client and the AP. Passphrase secrecy and having a passphrase that is not susceptible to dictionary cracking methods is vital for the security of any network using WPA/WPA2 Personal.

Extra Security Note: Having one person control the passphrase is probably a harder thing to do in a home network, but in a small office environment ideally one person should know the passphrase and enter it on the devices needing to connect to the wireless network. The less people who know the passphrase the more secure the network will be!

Use Reaver to Crack WPA/WPA2 Passwords

Premium Accounts 2014

Let’s use Reaver to crack WPA/WPA2 passwords! Through all this journey of cracking passwords (with permission), I learned you need two things: Time and Luck. There is no easy way to get a networks password, unless you actually go and ask for it nicely… but that’s not an option sometimes.

(Note: Consider this post educational, or a proof-of-concept intellectual exercise. The more you know, the better you can protect yourself. Breaking through someone’s Wireless Network is ilegall, use it at your own risk)

There are 2 methods to hack WPA/WPA2:

  1. With Dictionaries: Usually takes plenty of time and if the password is not on the dictionary, you won’t find it.
  2. With Reaver: Uses a vulnerability called Wi-Fi Protected Setup, or WPS. It exists on many routers and can take between 5 and 10 hours to crack.

When we tried using dictionaries and had no luck, we can move on to…

View original post 311 more words

Why You Should Password Protect Your Wireless Network

I see examples all the time of people either wanting to know how to hack their neighbors wireless network (I’m also asked how to do this), or like the screen shot below shows almost bragging about using a wireless network that belongs to their neighbors. This example leads me to believe people are buying wireless routers and plugging in the devices to their DSL or cable modems and not changing any of the factory default settings on the router. While plugging in a wireless router is the quickest way to get the wireless network up and running, out of the box most home or small office wireless routers have no security set up.

Yahoo! Answers Example of Person Accessing Neighbors Wi-Fi

One essential security setting to configure on the router is a WPA or WPA2 passphrase. The WPA passphrase will then be entered on the wireless devices accessing the wireless network thus controlling what devices can connect. Not only will the WPA passphrase control what devices can join the network, but it will also be used to encrypt the communications of the network.

Some helpful tips:

  • If you’re unfamiliar with your wireless router consult the user’s manual for how to get access to the management interface and how to configure the security settings. If you do not have the manual most manufacturers have them available for download from their web sites.
  • DON’T USE WEP! WEP encryption has known flaws and can be cracked very easily.
  • Visit my earlier blog post for tips on selecting a strong WPA2 passphrase.

Leave me a comment or question if you need some help setting up WPA encryption on your specific router. I will definitely post a replay or offer a link to assist with your question.

Is Your WPA2 Protected Wireless Network Really Secure

You’ve set up a wireless network in your home or small office and configured it with the highest level of encryption using a WPA2 passphrase. But is that WPA2 passphrase strong enough to protect the wireless network? A weak WPA2 passphrase could be hacked allowing an unauthorized person to use the wireless network. Even worse this unauthorized person could decrypt the communications revealing emails you send, web sites you visit, and passwords you use for access to websites.

You’re probably saying to yourself if WPA2 encryption could be broken on my wireless network is there anything I can do to improve security for the network? Yes, with a couple of safe guards WPA2 can provide the required security, and I will describe how to apply these safe guards by always changing the factory default network SSID, and how the WPA2 passphrase should be a completely random string of characters.

All small office home office routers ship from the factory with a default SSID assigned to the wireless network name. It might be Dlink, Linksys, or something else the vendor selected. You should always change this SSID to something of your choosing, but avoid a network SSID that might identify who owns the network, or something found in the top 1000 SSID names. Along with the WPA2 passphrase, the SSID is used to create the key to encrypt the wireless communications. Even though the SSID name can easily be found, if you’re using the factory default SSID or a common SSID name you make the job of the hacker that much easier.

With the SSID changed let’s move on to WPA2 passphrase. The WPA2 passphrase should be a completely random string of letters and numbers. Don’t use common dictionary words, names, a famous quote, the name of your favorite sports team, etc… At a minimum the WPA2 passphrase should be 25 characters, and you can bang on the keyboard until you get something with 25 characters or use a password generator web site. I like to use the password generator on the WhatsMyip.org website. If you use this site scroll down to the bottom of the page and look for the WPA Password Generator section, and use the “Better” option to generate a random 32 character passphrase.

WPA Password Generator

WPA Password Generator

After getting WPA2 passphrase entered into the wireless management interface on the router you should copy it into a Notepad file and save that to a USB storage drive. You can plug the USB drive into the other wireless devices and open the file to copy and paste the WPA2 passphrase into those devices to quickly add them to the network. Some devices may not have USB ports, and may require you to manually type in the passphrase, but this will be a onetime entry since the devices will save the passphrase.

The two suggestions above will increase the security of your wireless network and make it harder for a potential hacker to break. Making your wireless network a difficult target will more than likely cause a hacker to move on to an easier one.

Additional Reading:

To learn more about passphrases check out the Wikipedia page.

If you’re looking for more security tips when setting up a home wireless network check out my earlier blog post.

Is Hiding the Wireless SSID All the Network Security You Need

Every wireless network has a service set identifier or SSID, which is the name given to the wireless network. The SSID is used to distinguish wireless networks from one another. Small office home office (SOHO) routers come from the factory with a default SSID and owners of the SOHO router should always change this default SSID name to something of their choosing.

Along with changing the SSID name another very popular setting for individuals to enable on the router is to not have it broadcast the SSID or wireless network name. Hiding the SSID requires more overhead by the network owner to manually configure any wireless devices that need to be part of the network. Many network owners believe hiding the presence of the wireless network and configuring the devices that join it as a great way to secure the network, but this is providing a false sense of security. You’re not really hiding the network you are just hiding the network from advertising itself. A moderately skilled hacker with the right utilities can still find hidden wireless networks, and if there is no other security defined on the router you open your network up to several attacks.

Anyone with knowledge of wireless networks can use free utilities downloaded from the internet to scan the airwaves and capture specific communication frames to discover hidden networks. Once the hidden network name is discovered, and assuming no other security is setup an intruder could connect to the wireless network and use it for free internet access.

If an unauthorized person connects to the wireless network this would expose the other computers connected to the network. Any shared folders setup on your computers could then be browsed by the intruder and the data in them downloaded.

Hiding the SSID has one attack method that most people are not aware of. When you take your wireless device to a Wi-Fi hot spot the device will try to search for your hidden network. Basically the device will be announcing the name of the hidden SSID to anyone that may be listening. If a bad guy is at the hot spot he could create a fake access point with the SSID that your device is searching for and then try to trick you or force your device to connect to his “evil twin” access point. If the bad guy can get you to connect to the fake AP it can open up your device to numerous attacks. This may not sound like a big risk, and so many people feel the public Wi-Fi network at their local coffee shop or cafe is safe, but I always recommend when you’re using a free wireless hot spot to treat that network as unfriendly. What I mean by unfriendly is free wireless hot spots usually have no security setup and they are just convenient portals for internet access. With hot spot networks having very little or no security setup it is a prime location for the bad guys to take advantage of unsuspecting victims, so don’t think your local coffee shop or cafe is not susceptible to these types of attacks.

Regardless if your wireless network is hidden or not encryption should always be used. Encryption will scramble the network communications so they are unreadable by anyone capturing the traffic. The bad guy doesn’t need to know if a wireless network is hidden or connect to the network to capture unencrypted traffic, and this unencrypted traffic could be divulging emails you send, web sites you visit, and passwords you type into log in pages. Encryption is an important security setting to enable on your wireless network and should be setup on all wireless networks whether they are hidden or not.

Used by itself hiding the network SSID does not provide adequate security, but using this feature along with encryption and other security settings available on your home wireless router will give you a more layered approach to security. The more layers or harder you make breaking the security of the network the more someone wanting to access it will move on to an easier target.

Home Wireless Network Security Tips

A small office home office (SOHO) wireless router can be setup in just minutes, and can be a convenient and cost effective way to extend your home network. Many people don’t do much in the way of configuration or security on a SOHO wireless router when installing the device. However, just plugging in a wireless router without changing any of the factory default settings presents an insecure wireless network and can serve as an open internet portal to anyone nearby. Not only will it be an open internet connection, but it could open up unauthorized access to the computers on the network and the data stored on them. Anyone with a little knowledge of wireless networks and with the right utilities can sniff unencrypted wireless communications potentially capturing any data including passwords traversing the air waves.

Here is a list of some wireless security strategies that can be configured on most wireless routers. While no one feature will simply secure the wireless network, applying most or all will provide a layered approach to security. Some of these settings require an intermediate to advanced knowledge of wireless routers. For assistance or additional help with these settings consult the user’s manual for your specific wireless router.

  • Change the default Admin password used to access the wireless router.
    • Default passwords for routers are well known or can be found on the internet with some simple Google searches. If you setup encryption along with some of the other advanced security measures on the router it will all be useless if someone can just log into the router using the default password.
  • Enable Encryption.
    • Setting up encryption on the wireless network and protecting the traffic from being read by an unauthorized person is the most critical security feature to enable on the router. If someone in range of your wireless network was capturing the traffic encryption will scramble the data so it would appear as gibberish to that person. WEP was the original encryption method for wireless networks, but WEP has several known flaws and therefore should not be used. It is recommended to use WPA encryption or the stronger WPA2 encryption if all your wireless devices can support these levels of encryption. When using the WPA encryption methods a preshared key must be entered on the router and the same key is also entered on all of the clients wanting to join the network. When selecting a key avoid common dictionary words and use a random stream of letters, numbers, and symbols with a minimum of 20 characters in length. A wireless network using WPA encryption provides both security by controlling who can connect to the network, but also privacy by encrypting the communications as they travel across your network.
  • Change the default name of your wireless network (SSID).
    • The service set identifier (SSID) is the name of the network the wireless clients will use to connect to the network, and like the default password the factory set name given to the wireless network can be found out very easily. When selecting a name for the SSID don’t use anything that would identify who owns the network, such as your name, address, phone number, etc… You also don’t have use anything cryptic for the SSID, and a good choice is something that doesn’t bring attention to the name of the network and lets it blend in with any of the other surrounding networks.
  • Enable MAC Address Filtering.
    • Every network device is hard coded with a unique physical address called the MAC address. Wireless Routers can be configured with a list of MAC addresses allowed to connect to the wireless network. This sounds like a great setting to control the devices that connect to your network, but a reasonably skilled hacker can use free utilities from the internet to monitor traffic on the network to capture MAC addresses of devices on the allowed list. With the allowed MAC address the bad guy can spoof the MAC address on their device to make it appear as if it is in the allowed list.
  • Disable SSID broadcast.
    • Disabling the broadcast of the network name and essentially hiding the presence of the network sounds like a great feature, and I have seen some people rely on this feature alone for the security of their network. Similar to the MAC filtering setting mentioned before, anyone with a little bit of knowledge and the right utilities can scan the airwaves and discover hidden network SSIDs, so disabling the network broadcast should never be relied on as a cover all security setting. Don’t use this setting by itself, but combine it with other settings mentioned to have strength with multiple security layers.
  • Disable managing the router from a wireless client.
    • Force any client to be physically plugged into the router using a network cable to log in to the management interface.
  • Enable HTTPS for accessing the management interface.
    • Whenever HTTPS is available to encrypt communications it should always be taken advantage of. Using HTTPS to manage the router will prevent the user name and password from being compromised.
  • Centrally locate the wireless router in the house.
    • If you can locate the wireless router in a central location in the residence it should theoretically provide an even coverage area and control some of the leakage of the signal seen by your neighbors. You can also control the coverage area by adjusting the power setting on the wireless router, but this is a bit more of an advanced setting and not all SOHO routers allow power settings to be adjusted. Setting the power level to low may create dead zones in the wireless network coverage. Consult the user’s manual for your router for specific instructions on adjusting the power level.
  • Set time constraints to disable access to the wireless network.
    • Set restrictions when no one can use the wireless network without powering down the entire network or affecting the wired connections. For example if no uses the wireless network overnight a time restriction banning clients from connecting from 11:00pm to 6:00am to the wireless network can be configured. Powering down the router during vacations or during extended periods of non-usage can be the ultimate security setting to prevent outside hackers from trying to connect to the network.
  • Check for firmware updates on the router.
    • Routers have software called firmware loaded on them that control the capabilities of the router. The router vendors will release updates for the firmware to improve functionality or patch vulnerabilities. Checking every so often for firmware updates will guarantee your router has all the latest features and security patches applied.

Plugging in a wireless router and not configuring any of the security settings is the equivalent of leaving your house and not locking any of the doors. Hopefully the overview here will give you some information on how to lock down your wireless network and keep your neighbors from using you as an internet service provider.