Maximizing wireless security

Maximizing wireless security

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Maximizing wireless security Dan 01-26-2008
Posted by Jeff Liebermann on January 30, 2008, 12:22 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

>Another box to secure traffic over a cable in the house? Brilliant!

Yep. Paranoia is a good thing. To someone with "serious security
concerns", such added boxes will pacify them for a while. At least
until the next alarmist theoretical exploit is released in the trade
press. Besides, wearing one of those cool looking electronic key
loaders on a neck chain is high tech fashion.

I'm waiting for home Tempest qualified packaging and shielded
keyboards. Maybe home routers with built in RADIUS servers and
biometric authorization. Maybe a video camera in the laptop that
recognizes the owner. Naw, too easily spoofed. Maybe an
olfactometric (smell) sensor that recognizes the user by their
distinctive aroma. Simple fingerprint readers are so passe and can be
faked. I almost forgot the encrypting ethernet adapters for securing
LAN traffic from sniffing.

Of course, the same users that are so concerned about their security
can't seem to get OpenPGP and Enigmail encrypted email working. They
also can't seem to remember their 100+ odd passwords (or use the same
same password for everything). They also lose their X.509 certificate
dongles and barely understand how the technology is used, much less
how it works. Meanwhile, their Vista box demand approval for doing
just about everything, that genuine security alerts are lost in the
muddle.

For those with "serious security concerns" (and for those selling the
technology), no amount of additional security or additional black
boxes, is enough.


--
Jeff Liebermann jeffl@cruzio.com
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Posted by Les Cargill on January 30, 2008, 7:06 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Jeff Liebermann wrote:
>
>> Another box to secure traffic over a cable in the house? Brilliant!
>
> Yep. Paranoia is a good thing. To someone with "serious security
> concerns", such added boxes will pacify them for a while. At least
> until the next alarmist theoretical exploit is released in the trade
> press. Besides, wearing one of those cool looking electronic key
> loaders on a neck chain is high tech fashion.
>
> I'm waiting for home Tempest qualified packaging and shielded
> keyboards. Maybe home routers with built in RADIUS servers and
> biometric authorization. Maybe a video camera in the laptop that
> recognizes the owner. Naw, too easily spoofed. Maybe an
> olfactometric (smell) sensor that recognizes the user by their
> distinctive aroma. Simple fingerprint readers are so passe and can be
> faked. I almost forgot the encrypting ethernet adapters for securing
> LAN traffic from sniffing.
>
> Of course, the same users that are so concerned about their security
> can't seem to get OpenPGP and Enigmail encrypted email working. They
> also can't seem to remember their 100+ odd passwords (or use the same
> same password for everything). They also lose their X.509 certificate
> dongles and barely understand how the technology is used, much less
> how it works. Meanwhile, their Vista box demand approval for doing
> just about everything, that genuine security alerts are lost in the
> muddle.
>
> For those with "serious security concerns" (and for those selling the
> technology), no amount of additional security or additional black
> boxes, is enough.
>
>

If you have "serious security concerns", take the bloody thing
offline.

--
Les Cargill

Posted by =?Utf-8?B?QW50ZWF1cw==?= on January 26, 2008, 4:46 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
"Dan" wrote:

> - File sharing is OFF on both PC's
> - Router setup password has been changed to 14 random characters
> - Router updated with most recent firmware
> - SSID set to 13 random characters
> - SSID broadcast is OFF
> - WPA-PSK activated w/10 random character passphrase (tried a longer
> passphrase, but Windows Networking seemed to have trouble with it, kept
> defaulting to a shorter phrase). Key lifetime is the default 60 minutes.
> - Access control is ON with the MAC addresses for the 2 PC's being the only
> ones entered.

I think the average war-driver will say, 'Cor blimey, an Abrams tank has
less protection than that!' and go looking for an easier one.

A slight further improvement would be to unbind File and Printer Sharing
from the wireless card, or else to stop the Server service.

Posted by Adair Winter on January 26, 2008, 6:32 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
>I have a Netgear WGR614 v6 wireless router which I have recently begun to
>use wirelessly for my wife's work laptop. There is also a desktop
>connected to the router via cat 6. Both machines are running XP SP2 with
>all updates. I have the router set as follows & want to be sure I'm doing
>all I can to maximize security on the network:
>
> - File sharing is OFF on both PC's

If you trust the PC's turn file and print sharing back on - unless you
really don't need it.

> - Router setup password has been changed to 14 random characters

Fine, so long as you remember it.

> - Router updated with most recent firmware

Ok

> - SSID set to 13 random characters

This really doesn't matter, whether 1 or 100 it's just a ID

> - SSID broadcast is OFF

Might not be applicable if you don't have neighbors or many near by wireless
networks however I would turn it back on so that it's possible for others to
see your network and not plop down on top of making it unuseable anyway.

> - WPA-PSK activated w/10 random character passphrase (tried a longer
> passphrase, but Windows Networking seemed to have trouble with it, kept
> defaulting to a shorter phrase). Key lifetime is the default 60 minutes.

Should be fine.

> - Access control is ON with the MAC addresses for the 2 PC's being the
> only ones entered.

Not necessary and makes it a pain if a friend or family member comes over
and wants to use your internet.

>
> We live in a fairly remote suburban area, so I don't think the threat of
> "wardriving" is what it might be in a more populated area, but I still
> want to be sure I'm doing all I can in terms of security.

If you want to do everything install a RADIUS server on your network and use
it to manage encryption keys and do some sort of point to point vpn
encryption between the machines as msg stated. You could even go as far as
encrypting your most important files on the disk of each computer. But I
doubt that's necessary.

Honestly most of what you have done has just make it more difficult to
manage your small network. If you trust the computers on your network than
things like mac filtering and turning off file and print sharing is simply
unnecessary IMHO.
The odds of someone breaking a WPA/WPA2 key that is random characters, case,
numbers and and punctuation is VERY slim.
I found a website about a year ago that said it would take like 14years to
crack a 7 character WPA key. *Shrug* not sure how true that is reguardless
it would take enough time that you would notice someone sitting outside your
house.

Adair



Posted by Peter Pan on January 26, 2008, 8:25 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Adair Winter wrote:
>
>> - SSID broadcast is OFF
>
> Might not be applicable if you don't have neighbors or many near by
> wireless networks however I would turn it back on so that it's
> possible for others to see your network and not plop down on top of
> making it unuseable anyway.
>
> Adair

Actually, fairly often when people turn the broadcast off, their software
supports profiles to automatically connect when seen... no ssid, no profile,
no auto connect... forces you to re-enter the wep/wpa/etc when turning on
the 'puter.. If you sotware doesn't support profiles, then never mind....
Just a major annoyance/complaint



Similar ThreadsPosted
wireless security January 3, 2006, 1:20 pm
Wireless Security (WZC) April 28, 2007, 10:12 am
Question about Wireless Security September 20, 2006, 1:01 pm
Wireless connection security October 7, 2006, 10:05 pm
wireless and router; security issue August 20, 2006, 6:36 pm
Citrix, VPN, Remote Desktop and Wireless security November 18, 2005, 4:05 pm
wireless driver security: don't work as non-admin August 5, 2008, 1:54 pm
Wholesale Wireless Microphone - Chinese Wireless Microphone Manufacturer April 23, 2008, 8:12 pm
Wireless December 6, 2006, 8:55 pm
How can I see if someone is using my wireless connection September 8, 2005, 10:55 pm

The site map in XML format XML site map

Contact Us | Privacy Policy