Security

[Roy Amin]

I am a novice in security of wireless networks.

I would be grateful if someone could explain some principles to me.

If I have my router set up which is locked to specific MAC addresses, is it
possible for anyone else to tap into my wirepless signal to access my
broadband connection?

Am I correct in assuming that the security measures such as WEP WPA etc is
to prevent unauthorise people to make sense of the wireless traffic?

Is it possible to set up 128bit WEP for some clients and 64bit for others?

Thanks for your help

Rohit

[Alex Fraser]

Post by Roy Amin
I am a novice in security of wireless networks.
I would be grateful if someone could explain some principles to me.
If I have my router set up which is locked to specific MAC addresses, is
it possible for anyone else to tap into my wirepless signal to access my
broadband connection?

Yes, if they pretend they are one of the allowed MAC addresses while it's
not in use, and they have the encryption key (if there is one).

Post by Roy Amin
Am I correct in assuming that the security measures such as WEP WPA etc
is to prevent unauthorise people to make sense of the wireless traffic?

Yes.

Post by Roy Amin
Is it possible to set up 128bit WEP for some clients and 64bit for others?

Not AFAIK with a single AP, but you could connect a second AP on another
channel (creating two bridged networks) with different encryption settings.

Alex

[Bob W7AVK]

I have two six months old laptop computers both with the internal
wireless 802.11b/g option. One is a DELL INSPIRON 6000 and the other a
HP PAVILION ZV6000. In using them at various sites and locations I've
noticed the DELL Wireless is much more sensitive than the HP. It can
find and use sites the HP doesn't see or seem to determine exist from
the exact same location.

I took the HP back for repair and I was told it was working correctly
and no trouble was found. It does seem to work fine if the signal is
very strong within the same room or only a few feet distance.

Has anyone experienced poor sensitivity from the wireless card used in
the HP Pavilion series?

Thanks

Regards,

Bob

[John Navas]

[POSTED TO alt.internet.wireless - REPLY ON USENET PLEASE]

Post by Bob W7AVK
I have two six months old laptop computers both with the internal
wireless 802.11b/g option. One is a DELL INSPIRON 6000 and the other a
HP PAVILION ZV6000. In using them at various sites and locations I've
noticed the DELL Wireless is much more sensitive than the HP. It can
find and use sites the HP doesn't see or seem to determine exist from
the exact same location.
I took the HP back for repair and I was told it was working correctly
and no trouble was found. It does seem to work fine if the signal is
very strong within the same room or only a few feet distance.
Has anyone experienced poor sensitivity from the wireless card used in
the HP Pavilion series?

Perhaps the antenna isn't connected properly. I've seen that problem with
internal mini wireless PCI cards.

[Conor]

In article <***@teranews>, Roy
Amin says...

Post by Roy Amin
I am a novice in security of wireless networks.
I would be grateful if someone could explain some principles to me.
If I have my router set up which is locked to specific MAC addresses, is it
possible for anyone else to tap into my wirepless signal to access my
broadband connection?

Yes. If they're sad enough, they can sit there, listen in and grab the
data and analyse it.

Post by Roy Amin
Am I correct in assuming that the security measures such as WEP WPA etc is
to prevent unauthorise people to make sense of the wireless traffic?

Yup. But they still can. Basically, anyone can hack it if they're
willing to waste the time. The thing you're trying to achieve is to
dissuade all except those with behavioural issues.

Post by Roy Amin
Is it possible to set up 128bit WEP for some clients and 64bit for others?

No. Will only work with one or another. You could use an additional
access point and have one using 128bit and the other 64bit but you're
making it complicated and as ALL clients support 128bit, it;s pretty
pointless.

[John Navas]

[POSTED TO alt.internet.wireless - REPLY ON USENET PLEASE]

Post by Conor
Amin says...

Post by Roy Amin
Is it possible to set up 128bit WEP for some clients and 64bit for others?

No. Will only work with one or another. You could use an additional
access point and have one using 128bit and the other 64bit but you're
making it complicated and as ALL clients support 128bit, it;s pretty
pointless.

Not all clients support 128 bit, and even some that do take a performance hit.

[C Denver]

Post by Roy Amin
I am a novice in security of wireless networks.
I would be grateful if someone could explain some principles to me.
If I have my router set up which is locked to specific MAC addresses, is
it possible for anyone else to tap into my wirepless signal to access my
broadband connection?
Am I correct in assuming that the security measures such as WEP WPA etc is
to prevent unauthorise people to make sense of the wireless traffic?
Is it possible to set up 128bit WEP for some clients and 64bit for others?
Thanks for your help
Rohit

Wireless networks are the most insecure networks around. If I wanted I could
gain access to a 128bit encrypted wireless network within 2-3hours depending
on how many IVs are being transmitted. WEP is the most insecure encryption
available. I would strongly reccomend ethernet rather than wireless.

[TGTBT Media Web Design & Hosting Services]

Post by Roy Amin
I am a novice in security of wireless networks.
I would be grateful if someone could explain some principles to me.
If I have my router set up which is locked to specific MAC addresses,
is it possible for anyone else to tap into my wirepless signal to
access my broadband connection?
Am I correct in assuming that the security measures such as WEP WPA
etc is to prevent unauthorise people to make sense of the wireless
traffic?
Is it possible to set up 128bit WEP for some clients and 64bit for others?
Thanks for your help
Rohit

WEP is simply an encryption algothrim. Your network is effectively open
to abuse (however limiting the MAC address does help, just make sure
outsiders cannot query your computer for its MAC address)

For more protection set up a RADIUS server.

I would suggest buying a copy of Windows 2K server or 2003 server.
'Depends if you have the money' ;-)


The likelyness of anyone breaking into your HOME network and finding
anything good would be pointless, just use whatever is available to you,
but I would suggest the RADIUS server solution.

Saying that, MAC address' can be spoofed/snatched, so Anti-spoofing
features would be good.

[John Navas]

On Mon, 30 Oct 2006 19:04:31 GMT, "TGTBT Media Web Design & Hosting

Post by TGTBT Media Web Design & Hosting Services
WEP is simply an encryption algothrim. Your network is effectively open
to abuse (however limiting the MAC address does help, just make sure
outsiders cannot query your computer for its MAC address)

Sorry, but that's meaningless -- MAC spoofing is trivial, and thus MAC
filtering is essentially pointless.

Post by TGTBT Media Web Design & Hosting Services
For more protection set up a RADIUS server.

Overkill for most home users. WPA-PSK works quite well if you keep the
key secret.

Post by TGTBT Media Web Design & Hosting Services
I would suggest buying a copy of Windows 2K server or 2003 server.
'Depends if you have the money' ;-)

I would suggest something cheaper, easier to administer, and more
robust.

Post by TGTBT Media Web Design & Hosting Services
The likelyness of anyone breaking into your HOME network and finding
anything good would be pointless,

Sorry again, but it's quite possible for someone breaking in to steal
your identity, and use that to steal a considerable amount of assets.

Post by TGTBT Media Web Design & Hosting Services
just use whatever is available to you,
but I would suggest the RADIUS server solution.

For most users I would suggest WPA-PSK.

Post by TGTBT Media Web Design & Hosting Services
Saying that, MAC address' can be spoofed/snatched, so Anti-spoofing
features would be good.

Sorry again, but no practical way to do that.

[TGTBT Media Web Design & Hosting Services]

Post by John Navas
On Mon, 30 Oct 2006 19:04:31 GMT, "TGTBT Media Web Design & Hosting

Post by TGTBT Media Web Design & Hosting Services
WEP is simply an encryption algothrim. Your network is effectively
open to abuse (however limiting the MAC address does help, just make
sure outsiders cannot query your computer for its MAC address)

Sorry, but that's meaningless -- MAC spoofing is trivial, and thus MAC
filtering is essentially pointless.

Post by TGTBT Media Web Design & Hosting Services
For more protection set up a RADIUS server.

Overkill for most home users. WPA-PSK works quite well if you keep
the key secret.

Post by TGTBT Media Web Design & Hosting Services
I would suggest buying a copy of Windows 2K server or 2003 server.
'Depends if you have the money' ;-)

I would suggest something cheaper, easier to administer, and more
robust.

Post by TGTBT Media Web Design & Hosting Services
The likelyness of anyone breaking into your HOME network and finding
anything good would be pointless,

Sorry again, but it's quite possible for someone breaking in to steal
your identity, and use that to steal a considerable amount of assets.

Post by TGTBT Media Web Design & Hosting Services
just use whatever is available to you,
but I would suggest the RADIUS server solution.

For most users I would suggest WPA-PSK.

Post by TGTBT Media Web Design & Hosting Services
Saying that, MAC address' can be spoofed/snatched, so Anti-spoofing
features would be good.

Sorry again, but no practical way to do that.

LOL Are you saying that these features are not available? .e.g MAC
Anti-spoof, MAC HIDEING, and that it is impossible to secure a network?

I work with computers all day long, we (Signature Networks) provide
Reading (Madejski) football stadium, Lincoln university and Harefield
hospital with their networks!

you would THINK THAT I KNOW WHAT I AM ON ABOUT! *SCREAMS*

Post by John Navas

Post by TGTBT Media Web Design & Hosting Services

Post by John Navas
I would suggest something cheaper, easier to administer, and more
robust.

So what do you suggest?

As you have failed to contruct a CONSTRUCTIVE CRITICISM, just managed to
criticise. Which I find rather derogatory.

However, your mention of identity theft is a valid point, but with these
features, how would initial intrusion be possible? It is denying at
LAYER 2 of the OSI model!

[John Navas]

On Tue, 31 Oct 2006 00:30:34 GMT, "TGTBT Media Web Design & Hosting

Post by TGTBT Media Web Design & Hosting Services

Post by John Navas

Post by TGTBT Media Web Design & Hosting Services
Saying that, MAC address' can be spoofed/snatched, so Anti-spoofing
features would be good.

Sorry again, but no practical way to do that.

LOL Are you saying that these features are not available? .e.g MAC
Anti-spoof, MAC HIDEING, and that it is impossible to secure a network?

What I'm actually saying is that MAC addresses are sent in the clear
(You know that, right?), so there's no practical way to "HIDE" them.
(Can you prove me wrong?) The best you can do is MAC spoof detection,
but that's impractical for typical home users.

Post by TGTBT Media Web Design & Hosting Services
I work with computers all day long, we (Signature Networks) provide
Reading (Madejski) football stadium, Lincoln university and Harefield
hospital with their networks!
you would THINK THAT I KNOW WHAT I AM ON ABOUT! *SCREAMS*

I would hope so, but apparently not (no offense intended).

Post by TGTBT Media Web Design & Hosting Services

Post by John Navas

Post by TGTBT Media Web Design & Hosting Services

Post by John Navas
I would suggest something cheaper, easier to administer, and more
robust.

So what do you suggest?

You really don't know? Or are you just trying to argue?

Post by TGTBT Media Web Design & Hosting Services
As you have failed to contruct a CONSTRUCTIVE CRITICISM, just managed to
criticise. Which I find rather derogatory.

I wrote: "For most users I would suggest WPA-PSK." You missed that?

Post by TGTBT Media Web Design & Hosting Services
However, your mention of identity theft is a valid point, but with these
features, how would initial intrusion be possible? It is denying at
LAYER 2 of the OSI model!

The only truly effective protections for typical home users are (a) WPA,
(b) personal firewalls, and (c) isolation (if in the router, but
unfortunately not available in most low-end products).

[TGTBT Media Web Design & Hosting Services]

Post by John Navas
On Tue, 31 Oct 2006 00:30:34 GMT, "TGTBT Media Web Design & Hosting
What I'm actually saying is that MAC addresses are sent in the clear
(You know that, right?), so there's no practical way to "HIDE" them.
(Can you prove me wrong?) The best you can do is MAC spoof detection,
but that's impractical for typical home users.

Why is it impractical ?


ONLY ANSWER: They are not informed of how it works and never get a
chance to understand it, it's why forums are a place to ask questions,
they expect good results, and if they want good results, they have to be
taught to understand it.

Do you see my concept ? of making computer users more informed?

Post by John Navas

Post by TGTBT Media Web Design & Hosting Services

Post by John Navas
I would suggest something cheaper, easier to administer, and more
robust.

So what do you suggest?

You really don't know? Or are you just trying to argue?

I was trying to invoke what your suggestion was.

Post by John Navas

Post by TGTBT Media Web Design & Hosting Services
As you have failed to contruct a CONSTRUCTIVE CRITICISM, just managed
to criticise. Which I find rather derogatory.

I wrote: "For most users I would suggest WPA-PSK." You missed that?

No I read it, but as you stated 'I can break into them' so how is it
secure if it doesnt work for security! lol

My general security concept is: 'Prevention a.k.a isolation is the best
way'


We are talking about making it as secure as possible.

The reason why home networking is generally so bad, is because people
just dont know or understand how to do things, thats why I was
introducing rather cheap industrial ways of implementing network
security.

Post by John Navas

Post by TGTBT Media Web Design & Hosting Services
However, your mention of identity theft is a valid point, but with
these features, how would initial intrusion be possible? It is
denying at LAYER 2 of the OSI model!

The only truly effective protections for typical home users are (a)
WPA, (b) personal firewalls, and (c) isolation (if in the router, but
unfortunately not available in most low-end products).

Well I essentially started out as a home user, just as we all did!

Again, Concept: Without information, they would never know how it's
possible!

[John Navas]

On Tue, 31 Oct 2006 23:57:38 GMT, "TGTBT Media Web Design & Hosting

Post by TGTBT Media Web Design & Hosting Services

Post by John Navas
On Tue, 31 Oct 2006 00:30:34 GMT, "TGTBT Media Web Design & Hosting
What I'm actually saying is that MAC addresses are sent in the clear
(You know that, right?), so there's no practical way to "HIDE" them.
(Can you prove me wrong?) The best you can do is MAC spoof detection,
but that's impractical for typical home users.

Why is it impractical ?
ONLY ANSWER: They are not informed of how it works and never get a
chance to understand it, it's why forums are a place to ask questions,
they expect good results, and if they want good results, they have to be
taught to understand it.

REAL ANSWER: Because it's way too hard for them to do. They shouldn't
have to learn much of anything, any more than they should have to learn
much of anything to (say) drive a car -- the anti-lock brakes and
airbags just work, without having to be taught.

Post by TGTBT Media Web Design & Hosting Services
Do you see my concept ? of making computer users more informed?

Nope. I think that's wildly unrealistic.

Post by TGTBT Media Web Design & Hosting Services

Post by John Navas

Post by TGTBT Media Web Design & Hosting Services
As you have failed to contruct a CONSTRUCTIVE CRITICISM, just managed
to criticise. Which I find rather derogatory.

I wrote: "For most users I would suggest WPA-PSK." You missed that?

No I read it, but as you stated 'I can break into them' so how is it
secure if it doesnt work for security! lol

I said nothing of the kind. WPA-PSK (with a strong passphrase) is quite
secure.

Post by TGTBT Media Web Design & Hosting Services
My general security concept is: 'Prevention a.k.a isolation is the best
way'

My general security concept (for typical users) is: 'Make it easy and
practical enough that they will actually do it'

Post by TGTBT Media Web Design & Hosting Services
We are talking about making it as secure as possible.

I'm talking about making it workable.

Post by TGTBT Media Web Design & Hosting Services
The reason why home networking is generally so bad, is because people
just dont know or understand how to do things, thats why I was
introducing rather cheap industrial ways of implementing network
security.

Those ways are neither cheap nor practical for typical home users.

[TGTBT Media Web Design & Hosting Services]

Post by John Navas
On Tue, 31 Oct 2006 23:57:38 GMT, "TGTBT Media Web Design & Hosting

Post by John Navas
On Tue, 31 Oct 2006 00:30:34 GMT, "TGTBT Media Web Design & Hosting

REAL ANSWER: Because it's way too hard for them to do. They shouldn't
have to learn much of anything, any more than they should have to
learn much of anything to (say) drive a car -- the anti-lock brakes
and airbags just work, without having to be taught.
Nope. I think that's wildly unrealistic.
I said nothing of the kind. WPA-PSK (with a strong passphrase) is
quite secure.
I'm talking about making it workable.
Those ways are neither cheap nor practical for typical home users.

Oops sorry John, I was getting confused with another post:



"Wireless networks are the most insecure networks around. If I wanted I
could gain access to a 128bit encrypted wireless network within 2-3hours
depending on how many IVs are being transmitted. WEP is the most
insecure encryption available. I would strongly reccomend ethernet
rather than wireless. " By C DENVER


I am aware and agree with making it user friendly, however, what about
the users who do actually know a bit and want to learn more ?

If they don't they would ignore this post anyway!


I mean the 'average person' of the world dont know how to use
NEWSGROUPS.

They hear about 'this person doing this, and they want to have that, so
this is how'

Its the rarely documented stuff for users, I am simply answering the
questions put forward, with a solution that would work provided the
person knew / could figure out how to configure it.

Its a little like web design, im sick of seeing really easy to use
websites that all look the same, graphically stunning but of no actual
use.

Then we have the opposite, really awful design but full of useful
things, which is hard to use because of the design.


I would say what i suggested was 'happy medium / intermediate computer
user advice'

If they can set up a wireless AP, setting up RADIUS isnt MUCH harder.


I would agree with you, WPA should be sufficient for most novice users,
however if you wish to go a 'step further', learn and PROTECT your
network with more than just encryption, get a RADIUS setup!


Did you know: driving a car, you have to know/do much much more than
what you obviously think, in order to pass your driving test these days!

Basic troubleshooting is common, Basic concepts are what I work and
develop with.

Most things I know are either from corporate training or hands on
experience(self taught)

[John Navas]

On Wed, 01 Nov 2006 20:02:41 GMT, "TGTBT Media Web Design & Hosting

Post by TGTBT Media Web Design & Hosting Services

... WPA-PSK (with a strong passphrase) is
quite secure.
I'm talking about making it workable.
Those ways are neither cheap nor practical for typical home users.

"Wireless networks are the most insecure networks around. If I wanted I
could gain access to a 128bit encrypted wireless network within 2-3hours
depending on how many IVs are being transmitted. WEP is the most
insecure encryption available. I would strongly reccomend ethernet
rather than wireless. " By C DENVER

Apples and oranges:
* WEP (no matter what the key) ISN'T secure.
* WPA (with a strong passphrase) IS secure.

Post by TGTBT Media Web Design & Hosting Services
If they can set up a wireless AP, setting up RADIUS isnt MUCH harder.

I think setting up a RADIUS server is much harder than deploying an AP.
For those that need RADIUS, I recommend a wireless router with RADIUS
(PEAP) built in (e.g., ZyXEL ZyAIR G-2000). As usual, you tend to get
what you pay for, although still far less expensive than setting up a
"Windows 2K server or 2003 server".

Post by TGTBT Media Web Design & Hosting Services
I would agree with you, WPA should be sufficient for most novice users,
however if you wish to go a 'step further', learn and PROTECT your
network with more than just encryption, get a RADIUS setup!

RADIUS doesn't make WPA more secure. It's just more flexible and robust
than PSK. Different issues.

[Dave J.]

Post by John Navas
The best you can do is MAC spoof detection,
but that's impractical for typical home users.

I'm sorry to jump in on an old thread but this caught my eye as I was
updating on this group. How could I (as a fairly untypical home
experimenter) implement 'MAC spoof detection' It's an IDS I've not heard
of. Thanks if you can be bothered :)

Perhaps it's no more than detecting two simultaneous uses of the same MAC
and a difference in latency between the two?? Surely not possible unless
the genuine MAC is also active at the time of the spoofing?

Quite a deep interest, a response would be greatly appreciated though I do
know the fastish turnaround here.

Dave J.

[John Navas]

Post by Dave J.

Post by John Navas
The best you can do is MAC spoof detection,
but that's impractical for typical home users.

I'm sorry to jump in on an old thread but this caught my eye as I was
updating on this group. How could I (as a fairly untypical home
experimenter) implement 'MAC spoof detection' It's an IDS I've not heard
of. Thanks if you can be bothered :)
Perhaps it's no more than detecting two simultaneous uses of the same MAC
and a difference in latency between the two?? Surely not possible unless
the genuine MAC is also active at the time of the spoofing?
Quite a deep interest, a response would be greatly appreciated though I do
know the fastish turnaround here.

Google "mac spoofing detection".