How to Crack WEP - Part 3 Securing Your WLAN

8/14/2019 How to Crack WEP - Part 3 Securing Your WLAN

1/8

Introduction

Please see How to Crack WEP...Reloaded for the most up-to-date WEP cracking how to.

After demonstrating in How To Crack WEP - Part 1 and Part 2 that WEP cracking is easier than you mayhave thought, I will now switch gears. In this last part of the WEP Crack How To, I will show you how to take acommon sense approach to protecting your wireless network.

As any security professional knows, there is no such thing as perfect security. A good security plan takes intoaccount the value of what needs to be protected, the cost of implementing the protection and the nature andskillset of the potential intruder in order to formulate an effective security plan. In other words, rather thanimplementing every defensive measure known to man, a more prudent (and cost-effective) approach may be totailor your defense to the threats that you most likely face.

For example, wireless networks located in cities generally face more possible intrusions than those located insparsely-populated areas. During the course of a day in a city, dozens, maybe hundreds of people may pass byyourwireless LAN. And a car could also be parked outside your home for hours, without attracting notice. But awireless AP located in a home on a ten-acre farm would be unlikely to see any client but its owner's and anyunfamiliar vehicles would be noticed and investigated in short order.

Why Bother?

For some people, setting up a secure wireless network is so daunting, they give up and run it wide open, ie.unsecured. I also hear people say, "I just surf the web and have nothing valuable on my computer. Why should I

bother with security?" Good question, but here are some equally good answers.

Running your WLAN wide open entails three major risks:

1) Your network resources are exposed to unknown users

Once someone wirelessly connects to your LAN, they have the same access as users directly connected intoyour LAN's Ethernet switch. Unless you have taken precautions to limit access to network resources and shares,intruders can do anything trusted, known users can do.Files, directories, or entire hard drives can be copied, changed or entirely deleted. Or worse, keystroke loggers,Trojans, zombie clients or other programs can be installed and left to work for their unknown masters.

2) All of your network traffic can be captured and examined

With the right tools, web pages can be reconstructed in real-time, URLs of websites you are visiting captured,and most importantly passwords you enter stolen and logged for future mis-use, most notably identify theft.
http://www.smallnetbuilder.com/content/view/30114/98/http://www.smallnetbuilder.com/content/view/24244/98/http://www.smallnetbuilder.com/content/view/24242/98/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/content/view/30114/98/http://www.smallnetbuilder.com/content/view/24244/98/http://www.smallnetbuilder.com/content/view/24242/98/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/


2/8

3) Your Internet connection can be used for illegal, immoral or objectionable activities

If your open WLAN is used to transfer bootleg movies or music, you could possibly be the recipient of alawsuit notice from the RIAA. In a more extreme case, if your Internet connection were used to upload child

pornography to an FTP site, or used to host the server itself, you could face more serious trouble. Your Internetconnection could also be used by spammers, DoS extortionists and purveyors of malware, viruses and their like.

It may be a noble sentiment to give free Internet access to anyone within range of your wireless LAN. But

unless you put some serious protection between your "open" LAN and the one you use, you are exposing yourdata, and perhaps more, to serious risk.

The approach I'll take in formulating WLAN security recommendations is based on the expected skill level ofpotentialwireless intruders. I'll then provide recommended security countermeasures for each skill level.

NOTE: I will generally use "AP" (Access Point) throughout this article, but this should be read as meaning"Access Point or wireless router".

Skill Level 0: Anyone with a wireless computer

It doesn't take special skills to "hack" an unprotectedwireless LAN - anyone with a wireless-enabled computerand the ability to turn it on is a potential intruder. Ease of use is often touted as a selling point of wirelessnetworking products, but this often is a double-edged sword. In many cases, people innocently turning on theirwireless computers will either automatically connect to your access point or see it in a list of "available" access

points.

The following countermeasures should help in securing yournetwork against casual access, but offer no realprotection against more skilled intruders. These are listed in relative order of importance. But most of themare so easy to do that I recommend doing them all if your equipment allows.

Countermeasure 1: Change Your Default Settings

At minimum, change the administration password (and username if your equipment allows), and defaultSSID on your AP or wireless router. Admin passwords for most consumerwireless gear are widely available.So if you don't change yours, you could find yourself locked out of being able to control your own WLAN(until you regain control via a factory reset)!

Changing the default SSID is especially necessary when you are operating in proximity of other APs. Ifmultiple APs from the same manufacturer are in the area, they will have the same SSID and client PCs willhave a good chance of "accidentally" connecting to APs other than their own. When you change the SSID,

don't use personal information in your SSID! During my Netstumbler sessions, I have seen the following asSSIDs:

First and Last names Street Addresses with apartment numbers Social Security Numbers Phone Numbers

Changing the default channel of your AP might help you avoid interference from nearby wireless LANs, but ithas little value as a security precaution since wireless clients generally automatically scan all available channelsfor potential connections.

Countermeasure 2: Upgrade Your Firmware, and maybe Hardware

Having the most current firmware installed on your AP can sometimes help improve security. Updatedfirmware often includes security bug fixes and sometimes adds new security features. With some newer
http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.google.com/search?q=default%2Bpasswordshttp://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.google.com/search?q=default%2Bpasswordshttp://www.smallnetbuilder.com/


3/8

consumer APs, a single click will check for and install new firmware. This is in contrast to older APs whichrequired the user to look up, download and install the latest firmware from a sometimes difficult-to-navigatesupport site.

APs that are more than a few years old have often reached their end of support lifecycle, meaning that no newfirmware upgrades will be made available. If you find that your AP's latest firmware doesn't support at least theimproved security ofWPA (Wi-Fi Protected Access), and preferably the latest version called WPA2, youshould seriously consider upgrading to new gear. The same goes for your wireless clients!

Virtually all currently-available 802.11g gear supports at least WPA and is technically capable of beingupgraded to WPA2. But manufacturers are not always diligent in their support of older products, so if you wantto be sure that your gear supports WPA2, either check theWi-Fi Alliance's certification database, or do someGoogling in both the Web and Groups.

Countermeasure 3: Disable SSID broadcast

Most APs allow users to disable SSID broadcasting, which will thwart a Netstumbler scan. This will also stopWindows XP users using XP's built-in Wireless Zero Configuration utility and other client applications frominitially seeing the wireless network. Figure 1 shows the control labeled "Hide ESSID" that will do the trick on a

ParkerVision access point. ("SSID" and "ESSID" both refer to the same thing.)

Figure 1: Disabling SSID Broadcast on a Parkervision AP

(click image to enlarge)

NOTE: Disabling SSID broadcast will not prevent a potential intruder using Kismet or other wireless

survey tools such asAirMagnet from seeing your wireless network. These tools don't rely on SSID broadcastfor available network detection.

Skill Level 0 Countermeasures - more
http://www.wi-fi.org/knowledge_center/wpahttp://www.wi-fi.org/knowledge_center/wpa2http://certifications.wi-fi.org/wbcs_certified_products.php?lang=enhttp://certifications.wi-fi.org/wbcs_certified_products.php?lang=enhttp://www.stumbler.net/http://www.smallnetbuilder.com/http://www.kismetwireless.net/http://www.smallnetbuilder.com/content/view/24639/96/http://www.smallnetbuilder.com/content/view/24639/96/http://www.wi-fi.org/knowledge_center/wpahttp://www.wi-fi.org/knowledge_center/wpa2http://certifications.wi-fi.org/wbcs_certified_products.php?lang=enhttp://www.stumbler.net/http://www.smallnetbuilder.com/http://www.kismetwireless.net/http://www.smallnetbuilder.com/content/view/24639/96/


4/8

Countermeasure 4: Turn it off!

People commonly overlook the simplest way of securing theirwireless network- turning off the AP! A simplelamp timer can be used to turn off your AP during the overnight hours when you're not using it. If you have awireless router, this will mean that your Internet connection will also be disabled, which also isn't such a badthing.

If you can't or don't want to periodically shut down yourInternet connection, you'll have to remember to disable

your wireless router's radio manually - if it has this feature. Figure 2 shows a typical wireless disable control.This manual method is more prone to error, however, since it's just one more thing to forget. Perhaps at some

point manufacturers will add radio disable to the features that can be scheduled on wirelessrouters.

Figure 2: Shutting off the radio

Countermeasure 5: MAC Address Filtering

MAC Address filtering is used to control access to your AP by allowing (or denying) access to a list ofwireless client MAC addresses you enter. It will prevent an unskilled intruder from connecting to yourWLAN,

but MAC addresses are easily captured by more skilled attackers and wireless adapter MAC addresses easilychanged to match a captured address.

Figure 3: MAC Address filtering on an older USR 8011 AP

(click image to enlarge)

Countermeasure 6: Lower the transmit power

While only a few consumer APs have this feature, lowering your transmit power can help limit intentional andaccidental unauthorized connections. But with the increased sensitivity of wireless cards that even unskilled
http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/


5/8

users can purchase, it may not be worth the bother - especially if you're trying to prevent unwanted connectionsin an apartment building or dorm.

Most skilled attackers typically use high-gain antennas, which allow them to detect very low signal levels andeffectively offset this countermeasure.

Skill Level 1: Anyone with commonly available wardriving tools

Now let's move up a notch on skill level to that of your common "wardriver", who actively cruises aroundlooking for wireless LANs. Some people wardrive for kicks to see how many wireless networks they can detectand never attempt to use the vulnerable networks they find. But others are not so benign in their intent and doconnect, use and sometimes abuse unsuspecting wireless LAN owners.

At Skill Level 1, I'll assume that all the countermeasures suggested for Skill Level 0 do not work and thepotential intruder can see yourwireless network. The only effective countermeasures at this point involveencryption and authentication. I'll save authentication for later and focus on encryption.

NOTE: While forcing all wireless traffic to use a VPN (Virtual Private Network) is one solution, VPN's are

notoriously difficult to set up and beyond the scope of this article.

Countermeasure 7: Encryption

Wireless LAN owners should run the strongest type of encryption available to them. Your choices will bedictated by the capabilities of your WLAN hardware and your options are WEP, WPA and WPA2.

WEP (Wireless Equivalent Privacy) is the weakest wireless security technology, but currently the most widelydeployed due to its availability on virtually all 802.11 wireless products. You may have to use it because manyconsumerwireless product manufacturers have opted to not provide upgrades from WEP to WPA for 802.11b

products. And others are still creating new products such as some VoIP wireless phones that support only WEP,forcing some WLAN owners to downgrade their security to accomodate the lowest common level of security.

EitherWPA (Wi-Fi Protected Access) orWPA2 provide adequate wireless security, due to their strongerencryption technology and improved key management. The main difference between the two is that WPA2supports strongerAES (Advanced Encryption Standard) encryption. But to further confuse users, there aresome WPA-labeled products that allow the selection of AES vs. the WPA-standard TKIP encryption.

Most 802.11g products support WPA (but there are exceptions), but upgrades to WPA2 for older products arestill in the process of being rolled out - even though the 802.11i standard that WPA2 is based on was ratified inJune 2004.

I recommend that you use WPA as a minimum . It is as effective as WPA2 and, at least as I write this, morewidely supported. Implementing this recommendation, however, may require purchasing new equipment,especially if you currently are using 802.11b in your WLAN. But standard 11g gear is relatively inexpensiveand could be the best security investment you make.

Most consumer APs support only the "Personal" version of WPA or WPA2, which is also referred to as WPA-PSK(Pre-Shared Key) (see Figure 4). WPA2 or WPA "Enterprise" (also known as WPA "RADIUS") is alsosupported by some consumer wireless gear, but is of little use without the additional RADIUS serverrequired toimplement it.
http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/


6/8

Figure 4: Encrypting traffic on a Netgear AP

For most personal WLANs, using WPA-PSK will provide adequate protection, but it is essential to use a keythat is sufficiently long and random. Do not use a number, or a word from the dictionary, since programssuch as cowpatty are already available to perform dictionary-based attacks against WPA-PSK.

Robert Moskowitz, Senior Technical Director ICSA Labs, recommended in this articleusing an 128 bit PSK.Fortunately, all WPA implementations accept alphanumeric PSKs, which would require only 16 characters toimplement Mr. Moskowitz' recommendation.

There are many password generators available on the Internet that can be found by aquick search.This onehas lots of bells and whistles and even provides an estimation of how long it would take to crack the passwordit generates.

As a final note, some manufacturers have started selling APs and wireless cards that promise "one touch" easysetup of secured wireless connections. Buffalo Technology had the first products based on theirAOSS(AirStation One-Touch Secure Station) technology. Linksys has recently starting selling products based onsimilar technology from Broadcom dubbed SecureEasySetup. You can read a comparative review of these twotechnolgies here.

Skill Level 2: Anyone with WEP / WPA-PSK Cracking Skills

While WPA and WPA2 eliminate many of the problems associated with WEP, they are still vulnerable to attack,particularly in their PSK form. Many people have already cracked WEP andParts 1 and 2of this seriesprovided a step-by-step procedure.

Breaking the pre-shared key of WPA and WPA2 "Personal" is much harder and time consuming - especially ifyou are using AES encryption - but it is possible.

Countermeasure 8: Add Authentication

To address this emerging threat, users should implement authentication. Authentication adds another layer ofsecurity by requiring a client computerto "sign-in" to the network. Traditionally this has been done with a mixof certificates, tokens, or hand-typed passwords (also called Pre-Shared-Keys) that are negotiated with anauthentication server.
http://www.securiteam.com/tools/6L00F0ABPC.htmlhttp://wifinetnews.com/archives/002452.htmlhttp://wifinetnews.com/archives/002452.htmlhttp://www.google.com/search?q=password%2Bgeneratorhttp://www.google.com/search?q=password%2Bgeneratorhttp://www.google.com/search?q=password%2Bgeneratorhttp://www.elfqrin.com/pwgen.htmlhttp://www.buffalotech.com/technology/our-technology/aoss/http://www.buffalotech.com/technology/our-technology/aoss/http://www.linksys.com/servlet/Satellite?c=L_Promotion_C2&childpagename=US%2FLayout&cid=1121874561907&pagename=Linksys%2FCommon%2FVisitorWrapperhttp://www.smallnetbuilder.com/content/view/24237/96/http://www.smallnetbuilder.com/content/view/24244/98/http://www.smallnetbuilder.com/content/view/24244/98/http://www.smallnetbuilder.com/content/view/24242/98/http://www.smallnetbuilder.com/content/view/24242/98/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.securiteam.com/tools/6L00F0ABPC.htmlhttp://wifinetnews.com/archives/002452.htmlhttp://www.google.com/search?q=password%2Bgeneratorhttp://www.elfqrin.com/pwgen.htmlhttp://www.buffalotech.com/technology/our-technology/aoss/http://www.linksys.com/servlet/Satellite?c=L_Promotion_C2&childpagename=US%2FLayout&cid=1121874561907&pagename=Linksys%2FCommon%2FVisitorWrapperhttp://www.smallnetbuilder.com/content/view/24237/96/http://www.smallnetbuilder.com/content/view/24244/98/http://www.smallnetbuilder.com/content/view/24242/98/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/


7/8

802.1X provides the access control framework used by WEP, WPA and WPA2 and supports severalEAP(Extensible Authentication Protocol) types that do the actual authentication. George Ou's excellent article onAuthentication Protocols contains probably more than you'd ever want to know about EAP, WPA and WPA2!

Configuring authentication can be a daunting and expensive task for networking professionals, let alone homenetworkers. At this year's RSA conference in San Francisco, for example, many attendees didn't bother to set uptheirwireless connection because of the full page of instructions they had to follow to do it!

Thankfully, things are getting better, and you don't need to buy a full-blown RADIUSserver, as there are anumber of easier-to-implement alternatives. McAfee's Wireless Security Suite is a subscription-based productstarting at $4.95 per user per month with discounts for volume purchases. A free 30 day trial download isavailable here.

Another free option worth investigating for more experienced networkers is TinyPEAP, which adds a smallRADIUS server supporting PEAP-based authentication intoLinksys WRT54G and GSwireless routers. Notethat since this firmware isn't officially supported by Linksys, you're on your own if you mess up yourrouterwhile installing TinyPEAP.

Skill Level 3: Expert Cracker

Up until this point, we have blocked an intruder from wirelessly doing the equivalent of plugging theirlaptopinto an Ethernet port on your LAN. But despite your best efforts, someone with expert cracking skills may

penetrate all of your wireless defenses. What do you do now?

There are wired and wireless LAN intrusion detection and prevention product available, but they are targeted atenterprise applications and come priced accordingly. There are alsoopen source solutions that are unfortunatelynot user-friendly for networking novices. The most widely-used of these is Snort, which I hope to explore in afuture article.

But general network security practices have long dealt with traditional wired LAN intrusions, and can be usedto combat an expert wireless intruder.

Countermeasure 9: Implement general LAN security

Implement the following countermeasures to improve general LAN security:

1) Require authentication to access any network resource

Any server, network share, router, etc. should preferably require user-level authentication for access. Althoughyou won't be able to implement real user-level authentication without some sort ofauthentication server, you can

at least password-protect all shared folders and disable Guest logins if you're running Windows XP. And nevershare the contents of entire hard drives!

2) Segment your network

In the extreme case, acomputer not attached to a network is safe from network-based intrusion. But there areother ways to keep network users away from where they shouldn't be. A few properly-connected Inexpensive

NAT-based routers can be used to establish firewalled LAN segments while still allowing Internet access. Seethis How To for the details.

Switches or routers with VLAN capabilities can also be used to separate LAN users. VLAN features can be

found on most any "smart" or managed switch, but are harder to come by in consumer-priced routers andunmanaged switches.

3) Bulk up your software-based protection
http://en.wikipedia.org/wiki/802.1Xhttp://en.wikipedia.org/wiki/Extensible_Authentication_Protocolhttp://en.wikipedia.org/wiki/Extensible_Authentication_Protocolhttp://blogs.zdnet.com/Ou/?p=67http://blogs.zdnet.com/Ou/?p=67http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://en.wikipedia.org/wiki/RADIUShttp://www.smallnetbuilder.com/http://www.wirelesssecuritycorp.com/wsc/public/WirelessGuard.dohttp://www.tinypeap.org/index.htmlhttp://www.smallnetbuilder.com/http://www.smallnetbuilder.com/content/view/24609/96/http://www.smallnetbuilder.com/content/view/24609/96/http://www.smallnetbuilder.com/content/view/24649/96/http://www.smallnetbuilder.com/content/view/24649/96/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.snort.org/about_snort/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/content/view/24428/53/http://en.wikipedia.org/wiki/802.1Xhttp://en.wikipedia.org/wiki/Extensible_Authentication_Protocolhttp://blogs.zdnet.com/Ou/?p=67http://blogs.zdnet.com/Ou/?p=67http://www.smallnetbuilder.com/http://en.wikipedia.org/wiki/RADIUShttp://www.smallnetbuilder.com/http://www.wirelesssecuritycorp.com/wsc/public/WirelessGuard.dohttp://www.tinypeap.org/index.htmlhttp://www.smallnetbuilder.com/http://www.smallnetbuilder.com/content/view/24609/96/http://www.smallnetbuilder.com/content/view/24649/96/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.snort.org/about_snort/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/content/view/24428/53/


8/8

At minimum, you need to run current versions of good anti-virus applications that automatically update theirvirus definition files. Personal firewalls such as ZoneAlarm, BlackICE, etc. can alert you to suspicious use ofyour network. And, unfortunately, the latest generaton of malware and spyware threats make adding an anti-spyware application also necessary. Webroot Software's Spy Sweeper seems to be getting good marks lately,along with Sunbelt Software's CounterSpy.

Note that you must install protection on every machine on your LAN in order to have effective protection!

4) Encrypt your files

Encrypting your files with strong encryption should provide effective protection in the event unauthorized usersdo gain access to them. Windows XP users can use Windows Encrypted File System (EFS). Mac OS X Tigerusers can use FileVault. The downside to encryption is that it takes time and computing power to encrypt andde-crypt files, which could slow things down more than you'd like.

Conclusion

Wireless networking provides us with convenience, but we must take a common sense approach in securing it.There is no single thing that will shield you from attack and complete protection is very difficult to achieveagainst a determined intruder.

But if you take the time to understand the possible risks your wireless LAN is likely to encouter, you canimplement effective protection.
http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.apple.com/macosx/features/filevault/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.smallnetbuilder.com/http://www.apple.com/macosx/features/filevault/http://www.smallnetbuilder.com/

Documents

How to Crack WEP - Part 3 Securing Your WLAN