Slashdot Mirror
Detecting Wireless LAN Users
technosavvy writes "With wireless home networks and applications like NetStumbler becoming so popular, it's surprising that there are so few consumer-oriented applications that help monitor who is connecting to your wireless network. Bob Brewin of ComputerWorld lists three tools with this purpose in mind in his article "Tools for detecting rogue wireless LAN users"." I just like running etherape.
So what if you can detect when a rogue has connected to your wireless network. A passive data gatherer connected to your wireless network can often times gain enough information to connect to your network externally (Internet, VPN, etc). So just knowing that noone is actively using your wireless network doesn't mean that noone is hacking your network because of your wireless network.
Check out Kismet over here. It can run on Linux PDA's like the Zaurus and iPaq as well as your laptop. It also has GPS support and speach output (through festival).
I know this is not a radical idea, but I'm going to say it again. I think broadband Internet access should become part of a city's infrastructure, like roads and garbage service. I'd even pay for it like a utility (like water treatment or gas). God knows it'd get rid of silly little disputes over 'stealing' or redistributing bandwidth and cable companies penalizing users for doing what they signed on to do...use lots of bandwidth.
Can I bum a sig?
In most places in the country, people pay individually for their garbage service, water and gas. If I'm paying by the bag, you better damn well not put your trash in my can.
The only service that can't be stolen is free service, and there simply isn't such a beast. Hell, even roads aren't free. If you have an unregistered car (and thus, have paid no taxes), you can't legally use the road.
This is all good for network security assurance and auditing, but doesn't fix the basic security problems with using WLAN 802.11 technology. I suggest that we use a new security model for WLAN security:
1) Obscure SSID names and WEP should not be used on your WLAN just to provide management/users with a false sense of security;
2) Put the WLAN access point outside your firewall (layer 1 security);
3) Use firewall VPN technology for layer 2 security;
4) Use IPSec protocol for network layer 3 encryption;
5) Use digital certificates for layers 4-6 strong authentication;
6) Enforce Corporate security policy on WLAN deployment & use;
7) Regular audit and security assurance work to detect the addition of new WLAN points to your network.
There are good reasons for using WLANs, and you probably can't stop the keeners from adding access points, but you can try to mandate how they will be added in a secure and managable fashion.
Cheers,
-wjc.
"I figure you're here 'cause you need some whacko who's willing to stick his finger in the fan. So who are we helping?
Wait a sec -
You know you're running an unsecured wireless network and you want tools to find the 'rogue' people using it?
You're going to *buy* this tool?
Why don't you just secure the network?
Even WEP, with all its faults, will keep out casual stumblers. Use a VPN if you need real security.
When I see a wireless network with no WEP and a DHCP server, I see a 'welcome Mat'. I assume it's OK for me to check my mail or browse the web a bit.
In fact, I no longer have to do anything to set up my laptop - Os X Jaguar sets up the connection for me.
There's an old saying that good fences make good neighbors - I think that applies to wireless networks as well...
Cheers,
Jim
(PS - Go ahead, be a dork - mod me overrated instead of replying. I no longer care.)
-- My Weblog.