WEP And PPTP Password Crackers Released

Jacco de Leeuw writes "SecurityFocus published an article by Michael Ossmann that discusses the new generation of WEP cracking tools for 802.11 wireless networks. These are much faster as they perform passive statistical analysis. In many cases, a WEP key can be determined in minutes or even seconds. For those who have switched to PPTP for securing their wireless nets: Joshua Wright released a new version of his Cisco LEAP cracker called Asleap which can now also recover weak PPTP passwords. Both LEAP and PPTP employ MS-CHAPv2 authentication." Update: 12/22 00:14 GMT by T : Michael Ossmann wrote to point out his last name has two Ns, rather than one.

Comments

Now who can we blame for downloading GB of stuff?

[Anonymous Coward]

Its obvious that people now hav ethe ability to go around neibourhoods and gain access to these networks for any purpose!

Can we be blamed if the tenant runs a pot-growing facility in our basement? Is it the same?

Feasibility of dictionary attacks no protocol flaw

[Anonymous Coward]

Every communication which uses passwords for authentication is susceptible to dictionary attacks. That is not a protocol weakness. If you use a random and long enough password, you'll be fine. Public key based authentication has other risks, like insufficiently secured storage of the key.

End-to-End Security

[Renegade Lisp]

This just underlines that encryption at the wireless link level may not be the right way to go. Even if the algorithm wasn't so weak -- it strikes me as odd that a whole network should be protected by just a single key, which needs to be present on every individual machine of this network. How easily is this compromised!

It's far better not to rely on wireless link encryption and encrypt your application-level protocols instead. SSL for web browsing, PGP or S/MIME for e-mail, ssh for login. Far better algorithms, far better key management.

Re:End-to-End Security

[selderrr]

While I applaud your suggestions for SSL, PGP et al., one should realize that none of these protect against network intrusion, or more often : someone living of your bandwidth...

Re:End-to-End Security

[jaseuk]

-By the way, does anyone know how easy/difficult it is nowadays to get WiFi hardware that lets you choose your own MAC address?)

It's a standard feature in almost all any device with a MAC address including WiFi & Wired.

MAC address filtering is a useful additional layer of security but I wouldn't rely on it.

Jason

Re:End-to-End Security

[RAMMS EIN]

MAC address restriction is an especially weak form of protection on wireless networks. Contrary to wired networks, where the switch may only send data over the wire connecting to the right card, a wireless AP must broadcast the data to everyone in hearing range. This means that you only have to assume one of the MAC addresses that are allowed to connect to the AP, and you're on the network.

Re:End-to-End Security

[ayn0r]

By the way, does anyone know how easy/difficult it is nowadays to get WiFi hardware that lets you choose your own MAC address?

I haven't got around to buying wifi equipment for my apartment yet. Living in a flat with a bunch of neighbours though, I just checked to see if there was any wifi network nearby. Tried it, found one, set ethereal to sniff packets for perhaps 5 minutes. Most of these packets contained relevant MAC addresses for me to use.

After that, ifconfig ath0 hw ether [mac-addr] and voilà. I'm in. Really, restricting access to a certain mac address doesn't do squat. Most nics will support changing the mac address without any problems whatsoever.

Now if I can only find what neighbour's net I've been using. I took myself and my laptop for a walk today to see where the signal strength increased, but had to go back inside because people were staring at me. :)

Re:End-to-End Security

[Umrick]

What I'm looking at implementing (20 wireless tablet pcs used by physicians and their techs) is something more like this:

Bare open wireless with a dedicated DHCP/OpenVPN server. Server configured to only allow connections to/from known MAC addresses. Use OpenVPN (128 bit certificate keyed AES) to connect to the internal network.

Potentially an attacker could compromise one of the wireless devices, however the clients could be firewalled to permit only connections to/from the server to limit that exposure.

All clients are already setup with network/printer sharing disabled, so using the software firewall will be an acceptable risk.

Application level would be nice excepting for a few problems. Legacy apps that don't support it, and required services that can't be encrypted (printing/shared drives) without using a fairly brittle IPSEC solution. OpenVPN is a better solution. You end up with strong encryption, better key management, high resiliance (udp tunnelling, not tcp) to loss, higher throughput (lzo compression), and transparent protection.

Re:End-to-End Security

[JJahn]

Although it may seem that the switch will only send data to the computer that is connected to it, that is easily subverted by ARP poisoning. Don't feel safe from traffic sniffing just because you use a switch.

Re:End-to-End Security

[Geoff-with-a-G]

Encrypting the wireless link layer doesn't mean avoiding upper-layer security protocols like SSL or PGP, they solve two entirely different problems. You can still use SSL and PGP on top of your WEP/WPA layer.

Even if WEP was perfect, it wouldn't protect your traffic on the distribution system that your access-point connects to. The hubs, switches, and routers that your traffic flows through on the way to its destination are still carrying your traffic unencrypted, and it is subject to interception at those points. That's where upper-layer encryption comes in handy.

But those protocols still require secure connection or handshaking procedures between endpoints for all conversations. If you're on some corporate LAN where users are expected to be able to share their files via SMB, or IM each other, you don't require SSL and PGP authentication for every single network transaction. But that doesn't mean you want outsiders to be able to listen in on all your traffic by pointing an antenna at the building. The link between your workstation and the access-point is a wide-open vulnerability, and it's important that the hole be closed. WEP was an important attempt to close that hole, but a massively flawed one. The solution is to fix those flaws, not to require layer 7 authentication for all network traffic.

Easier for travelers

[ad454]

Great, I will be leaving for a business trip soon, and now I can freely *access* those commercial WEP enabled Wi/Fi access points in many airports without risking my credit card.

Seriously though, Wi/Fi has to be treated like an unsecure public network, and anyone wants to restrict access they should use a more secure protocol like IPSec in host-to-host mode. Do not count on Wi/Fi manufactures to protect you, for some reason they just simply refuse to provide secure products.

Re:Easier for travelers

[Lumpy]

this will not break an authenticated WAP. the ones I help support in my community have only port 80 open for low bandwidth for free, you join us and you get a password you access through nocatauth and then gain full speed open access at the wireless points.

these tools are useless against that scheme. you still need to perform old-skool cracking in order to get past nocatauth, no point and drool tools for getting past that yet, espically with the non-public modifications we made to it to make it different than what is freely available.

Re:Easier for travelers

[lxt]

"Do not count on Wi/Fi manufactures to protect you, for some reason they just simply refuse to provide secure products."

I wouldn't trust Wi-Fi as a fully secure medium even if the manufacturers built in more security measures. As a completely hypothetical and unrealistic example, say I had a completely closed network, with no outside net connections at all. Now, to gain access with physical connections, I've either got to get actual access to a terminal, or do a bit of cable snipping. Now, if I network with Wi-Fi, the job's a lot easier.

Compeltely hypothetical of course, but shows the difficulties of mainting secure access (as in personel able to use, rather than data) to a wi-fi network.

Re:Easier for travelers

[ThosLives]

You have astutely observed one of the true aspects of security: Security is always somehow inversely proportional to the amount of functionality you allow "remotely" - i.e., without physical verification. For instance, whenever you allow remote logins, there is no difference from the server's standpoint between the authorized person using a correct password and a malevolent person using a correct password; this is because the server verifies the password (you can substitute "encrypted key of any sort" for "password"), not the person itself. It's actually not even possible to ever verify a person - even biometrics could be spoofed (albeit with difficulty).

It's a radical assertion perhaps, but it's my belief that security attacks are merely a symptom of some other problem (not sure entirely what it is, but I could posit some of the characteristics); beefing up security is merely like treating a toothache with painkillers; the pain goes away, but the rot is still there.

So, how do you get rid of the rot? There are only two options: you have to first remove the rot from the system, then implement preventive measures so more rot doesn't develop. Strangely enough, nobody in the security industry (computer, homeland, or any other variety) seems to be looking at that aspect - they seem to be focused on creating and using better pain killers.

Re:Easier for travelers

[b33t13]

Really? You've obviously never seen a demonstration of a rogue AP w/ portal just for snarfing your usernames and passwords. It can be done from a Zaurus, even.

You and Starbucks are pwned.

http://airsnarf.shmoo.com

Have a nice network.

Sincerely,

Beetle
The Shmoo Group

Some thoughts on Wireless and Security

[Raindeer]

Well, I wrote some thoughts on Wireless and Security in my blog which I now copy here.

# setting up secure connections is too difficult for the lay person. We need standard Diffie-Helman key exchanges. I saw on the internet that it is available on some access points, but it just should be the standard of the IEEE. As far as I could find with Google it isn't yet. I can't understand why.

# Securing accesspoints should be mandatory. There are too many open access points available. There is no use for anonymous connections over a random family's access point, it only endangers them into being seen as cybercriminals.

# If people want to make it possible for neighbours and strangers to make use of their access point it should be done in the same way hotspots are now available at airports and Starbucks. Make it possible to extend the official network of the ISP to a users access point. This way if I open up my laptop and there is an access point available of Joe User, I can only hook up to it by propperly logging in to the ISP's network or use the airport/credit card system. This will require many roaming agreements etc, but it would bring security and convenience at the same time. It should be done in such a way that the person opening up his network in this way can throttle the speed of the guest users and/or the times they can access. So I would like to see a rule like "Guests can only connect when I am not connecting" or "Guests only get 1mbit/sec".

Re:Some thoughts on Wireless and Security

[Anonymous Coward]

ad 1: DH is a key exchange algorithm, not a complete crypto system. As an algorithm it is used in quite a few standards (IPSec for example).

ad 2: Depends on your understanding of what the net is. If you think that WLANs are insecure means of accessing a safe network, then yes, AP security should be mandatory. If you think that WLANs are just another insecure link in a dangerous network, then what difference would it make?

ad 3: There are so many ways to abuse this system, it isn't even funny.

Re:Some thoughts on Wireless and Security

[DikSeaCup]

Of course, all that aluminum foil you're using to coat your walls and windows must have set you back a bit.

Re:Some thoughts on Wireless and Security

[crowemojo]

There are two fundamental concerns when considering the placement of wireless access points on any network.

1) Someone can access my network.
2) Someone can see my traffic.

Any wireless network implementation should take both of these into account. Wireless access points, until other encryption and access control mechanisms mature, should be treated as if they were compromised to begin with. If you treat an access point like a live jack into your network that's located outside your building some where, then you are off to a good start.

To address the first issue, we need network segmentation. Locate the access point in a DMZ, only allowing communication with other network resources over controlled means, such as ssh. By located it in a DMZ, you limit the exposure of the rest of your network and have the means to properly control what it can and can't see. Ideally, it can't see anything without some form of authentication beyond what is provided by the AP. This is possible to accomplish regardless of what you want your legitimate users to be capable of through the use of properly configured proxy servers, etc.

To address the second issue, as several others have mentions, make sure that anything that is sensitive is encrypted. Don't allow people to check their email through the wireless connection using imap or pop3, require that they use a web interface with SSL encryption. Don't use telnet for your custom applications, whatever they may be, use SSH. Of course, all that being said, it's much easier to tell someone to never use telnet then it is to actually do it. Anyone care to take a guess at how a typical software vendor supporting legacy applications will respond to the request to make their programs function over SSH?

My $0.02

Security is an illusion ...

[Gopal.V]

To be truthful, nothing is secure ... It can only be "Secure Enough". If the cost of breaking something is more than the benifit - that is security in one sense.

Any encryption can be broken - given enough resources ... The trick is to make it so difficult that nobody finds out unless they are prepared to invest more than what you did (time, computing power, money, technology).

Interestingly in India, according to Department of Telecom website - security means something different :).

23. Individuals/Groups/Organisations are permitted to use encryption upto 40 bit key length in the RSA algorithms or its equivalent in other algorithms without having to obtain permission from the Telecom Authority. However, if encryption equipments higher than this limit are to be deployed, individuals/groups/organisations shall do so with the prior written permission of the Telecom Authority and deposit the decryption key, split into two parts, with the Telecom Authority.

We have to keep our private keys in ESCROW to use >40 bit encryption ... Talk about stupid laws (of course which no-one enforces or obeys).

Re:Security is an illusion ...

[amorsen]

Heh, I love the fact that they mention 40-bit RSA. 40-bit symmetric could be sort of used back in the 80's. With 40-bit RSA it's faster to break the encryption than to type in the key.

Misread the headline...

[Timo_UK]

And I thought they had released some crackers from prison...

Re:Feasibility of dictionary attacks no protocol f

[amorsen]

Every communication which uses passwords for authentication is susceptible to dictionary attacks

But the good ones only allow online dictionary attacts. LEAP, PPTP, WEP, and unfortunately WPA all allow offline attacks.

Re:Feasibility of dictionary attacks no protocol f

[wirelessbuzzers]

Every communication which uses passwords for authentication is susceptible to dictionary attacks. That is not a protocol weakness. If you use a random and long enough password, you'll be fine. Public key based authentication has other risks, like insufficiently secured storage of the key.

First, you will note that the attack on WEP (but not on PPTP) is not a dictionary attack and works with a computer-generated random 64- or 128-bit key. This is a protocol weakness.

Second, a good protocol does protect passwords. Either it establishes an encrypted session with the server, like SSH or SSL does, or it uses a secure password protocol like SRP. SRP in particular has the following properties:

1) The protocol is entirely public, and open-source implementations are available.
2) An eavesdropper on the wire does not get a dictionary attack on the password; without breaking the crypto behind the protocol, which nobody has been able to do yet, he gets no information. Of course, he can still do an online attack, but the server should prevent that.
3) Someone impersonating the server also does not get a dictionary attack on the password, even though the client does not need to memorize a key hash.
4) Someone who compromises the server database does get a dictionary attack on the password (this is inevitable), but they don't get the password for free. Furthermore, the password is salted, so they have some work to do.

Old news

[IO ERROR]

This story is old news, as I posted the following way back in April:

If you bought one of those shiny new 802.11{abg} access points so you could be lazy and use your laptop in bed without a bunch of cords dangling all over the place, you have a decision to make. Do you want your neighbors and random strangers using your Internet connection?

If you decide you don't want other people using your connection, then don't do these things:

• Hide your SSID. Your access point will broadcast it anyway whenever your computer associates, and if you're using Windows XP then it associates every few seconds.
• Use MAC filtering. Your access point will broadcast valid MAC addresses whenever those stations are in use, and anybody can pick those up and change their MAC address to match yours.
• Use WEP. It's easy enough to crack that anybody listening can recover your WEP key in a fairly short time if you actually use your wireless connection for anything.
• Use a Microsoft access point. Microsoft access points will gladly send their WEP key to anybody who asks, making WEP completely useless.
• Use LEAP. It is based on Microsoft CHAP and a poor implementation at that. It's easy to crack.

Hm, what's the point of enabling all that security if it's so easy to get around? Here are some other things you might try:

• Turn off the access point's DHCP server. Won't do you much good, since somebody can just "borrow" your IP address when you aren't using it or use an unused IP address in your subnet.
• Reorient the access point's antenna. Then you'll just have the people on the other side of your apartment using it.

Hm, you may as well just take the damn thing back and get a refund, and suffer the Ethernet cord.

Re:Old news

[beeblebrox87]

Whats wrong with letting the world access your network? Use SSH/SSL etc to keep your connections secure. If somebody wants internet access, why not provide a public service to them? Wouldn't you like it if someone else did the same for you? If they start using too much bandwidth you can always you can politely ask them to stop, and if that fails, blackmail them with all the pr0n they've been downloading.

Re:Old news

[DarkMantle]

The problem isn't about someone using another persons access point. The problem is what they use it to access. They are usually used to access things that the war driver doesn't want tracked to his home. So the problem isn't all the pr0n theve' been downloading, it's the age of the people in the pr0n. This then gets traced back to the IP address your router had at that date/time, and then you're charged for it.

Re:Old news

[LiquidCoooled]

Whats wrong with it is your not an ISP, and your not protected by the same rules, regulations and laws as them.

So if someone did illegal things through your connection, YOU will still be responsible.

Re:Old news

[nickname225]

I think there is a high level of hysteria about this issue of you being responsible for someone using your link to download child porn. Remember - the criminal standard is "proof beyond a reasonable doubt". I am an attorney and I work for a District Attorney (although criminal law is not my area) and we would be extremely unlikely to prosecute anyone for child porn without finding actual images in the defendant's possession.

Re:Feasibility of dictionary attacks no protocol f

[amorsen]

If you have automatic server authentication (which is often fairly easy to do with certificates or simply stored keys a la ssh) then you can avoid man-in-the-middle.

Re:So how can I secure my connection?

[PatrickThomson]

I use openvpn for securing my home network (the access point is open and nonrouting), and although it's a bit of a shit to get set up, I've never had any problems, and I've got 1.5 meg/sec using blowfish from a K6-400 at the other end.

We've known WEP was broken for a long time

[Anonymous Coward]

This article shows that the time needed to break WEP is smaller than previously demonstrated, not that WEP is any less safe than before. Really, we've known WEP was no good for a _long_ time. The reasons are well known. Both WPA and the recently ratified 802.11i RSN provide good solid fixes to link layer wireless security.

So, this isn't really "new" news, although it should reinforce the message that WEP is worse than useless.

Re:We've known WEP was broken for a long time

[ifoxtrot]

Actually I disagree with you. Not on the fact that WEP wasn't "broken" before, but on the fact that you say WEP is worse than useless.

Security is not an absolute, it is relative. Yes WEP is broken, worse than previously thought.
WEP, however bad it is (and however many better solutions exist) still stops most people from using your bandwidth. Retail studies have shown that most staff theft is opportunistic - while most people are basically honest, if they see money lying around, most of them will pick it up. Same goes for unprotected bandwidth. Many people would not have a problem if it's completely open, but put even the semblance of a lock and they won't try to break in - that's because they have to actively be dishonest in order to steal your bandwidth/money, as opposed to ignorant.

So while it wasn't a perfect solution TM, it was actually better than nothing.

I'm not arguing that better solutions aren't available, but I am saying that WEP isn't as completely useless as you make it out to be.

What would you prefer no security or bad security? That's actually a trickier question than it sounds!

Securing wireless connections

[da.phreak]

I did not trust WEP even before this tools were released. I read a bit about securing the connection independent of the wireless equipment. Treating the wireless connection like a public network, I set up a Virtual Private Network (VPN). I'd like to share my experiences:

First I tried to setup IPSec. It was a nightmare. Although I know a lot about computers and networks I did not manage to setup IPSec. It's configuration is so complicated, I have no clue. Although, it must be possible to get IPSec running, maybe it's just me who is too stupid :). IPSec would have been the most secure solution, but despite public belief it's not that secure:

http://www.schneier.com/paper-ipsec.html

Then I tried Cipe. It was very easy to get it running, but it's horribly insecure. Peter Gutmann wrote a nice article, which was in the news on slashdot some time ago:

http://lists.virus.org/cryptography-0309/msg00257. html

In that article I read about tinc, which I now use. It's almost as easy to setup as cipe, but more secure (although not perfect and not as good as IPSec). Here is the answer of the developers of tinc to Peter Gutmann's article:

http://www.tinc-vpn.org/security

So, maybe if you believe them it's not that bad, I'm not sure about this.

I think one great advantage of the VPN-solutions is that AFAIK there are no tools available that make cracking them as easy as cracking WEP. So the "common War Driver" or Script Kiddie has no clue what to do, you'd need some kind of expert to crack your connection. And, if such an expert is trying to break your security, you maybe have a bigger problem anyway.

I just wanted to have an acceptable level of security and lock War Drivers out.

Re:Securing wireless connections

[ksp]

I have had similar problems, I find that wireless is getting so common that laptops and desktops ship with preinstalled cards and I got a router from work as part of the home broadband deal.

I haven't started to use it yet, due to paranoia. I have several Linux boxen that are on my inside net and I don't want to compromise them.

Fortunately, one box has an unused NIC that I can use for the 802.x router. I plan to use L2TP and IPSec on this, but the instructions are rather intimidating and the protocol compatibility across platforms may cause issues. I have to use Win XP for work, I use Win2K and Linux myself.

Check out this set of detailed instructions: Using a Linux L2TP/IPsec VPN server. I am hoping that this is sufficient to keep everything up and running for a few years without my neighbours cracking it. That is probably the main obstacle with these home networks, the smartest users just enable WEP and leave it running forever.

honeypot WAP time!

[EvilStein]

I have like 5 WAPs plugged in - but only one of them is actually plugged into the network. Go ahead, waste some time cracking the WEP keys on the 4 other ones that don't even have ethernet cables plugged into them. muhahahahaa..

The 5th one is a flaky piece of crap anyway and will likely just fry your WiFi card when my roommate fires up the microwave.

Re:MAC Control tables useless?

[MarcQuadra]

Er, MAC filtering is the LEAST safe way to lock-out wireless. MAC addresses are EASILY picked-out of the air, and all you have to do is push the address you want to your wifi card to 'steal' one.

MAC filtering is not encryption, even if you MAC filter, I can come by with any number of 'tools' and leech all your traffic without having to do any work. Perhaps the only thing MAC filtering does is keep the non-technical neighbor upstairs off your signal.

This article refers to another way to crack networks that are actually encrypted, which was generally enough of a hassle that someone would want to specifically target YOU before going through the trouble. As with all encryption though, cracking what's out there gets easier every day, time to move up to something else!

People still use WEP?

[AusG4]

Who still uses WEP? The weeknesses in WEP have been known for some time, and there have been more than a few working crackers in the wild for quite a while now.

WPA is the money. It's far more secure than WEP in that it has key rotation, and some of the snazzier base stations already support AES as the cryptographic algorithm. Most older stations with dilligent vendors will at least support WPA with TKIP (RC4 with rotating keys), since it's a trivial addition from a compute-intensiveness point of view.

That said, if you do insist on sticking with WEP (some people prefer classic cars to modern ones as well, I guess), or even less (ie, run an open base station) at least ensure that your access point is configured to only allow your specific MAC (as well as those you trust) to peer with it. This will at least keep the bandwidth sucklers off your back.

Unless, of course, being suckled upon is what you like. At that point, do what you want. I'm Canadian, so my personal bandwidth is everyones bandwidth.

Ahhh... socialism. :)

As for PPTP, switch to using KAME, FreeS/WAN or your IPSec implementation of choice. You can, of course, even use IPSec to do transport level encryption for your wireless connection if your base station doesn't support WPA, though you would need additional boxen to do this, of course.

Both of these (WPA and IPSec) provide the same functionality as what they replace (WEP and PPTP) with additional security benefits. We moved to WPA for our corporate access points over a year ago and have been running a 100% IPSec (SonicWall, specifically) VPN for just as long. They're functional, production tested and very secure.

Don't wait. Do it now.

Can something be done sort of like freenet?

[Epistax]

You're given a key for your computer. This key is entered into a list of keys on the server. The server decrypts each incoming transmission with all valid keys to determine the source, and encrypts all outputted signals with their own keys for each client, and the encrypting and decrypting keys are different.

So, for each client there are four keys. One to encrypt information sent from client to server (residing only on client), one to decrypt this information (residing only on server), one to encrypt information sent from server to client (only on server), one to decrypt information sent from client to server (only on client). Plus the server has its own internal key so that even if the encryption for two clients between two computers is identical, the decryption is different. Same for the client. Ok ok- 6 keys. ;)

Ignoring the complication, overhead, and excess noise produced by this, wouldn't it be better than say... WEP? :P This would be something such as an office setting where the area is not very open. Your competitor has the office across the street and you're not allowed to throw rocks at them when they sniff the wireless anymore.

Correction to submission

[paranode]

Just to clarify, it can crack the code in minutes or even seconds after you've already captured at least about a quarter of a million encrypted packets, maybe more. That will take longer than just a few minutes or seconds, most likely.

Re:Correction to submission

[mossmann]

By using reinjection techniques such as aireplay (part of the aircrack distribution), the time to collect a quarter of a million packets can be as little as a few minutes. I'll be discussing this in part two of the article.

This tool does

[anti-NAT]

I haven't looked at it for a while, I provided a few suggestions a while back. I thought it was a good idea. For non-authorised subnets, it sends bogus ARP replies, with bogus MAC addresses.

ipsentinel

Interesting

[paranode]

Actually this is an interesting point because you would almost certainly get pinned for not taking reasonable steps to prevent the person from growing pot in your basement. However, it's highly unlikely that anyone would expect you to take reasonable steps to prevent unauthorized access to your network if only for the simple fact that practically everyone is clueless when it comes to this stuff. It's a bit of a shame how that works, as far as liability goes.

IPsec is great

[prisoner]

it's the client software that's a pain. I use wolverine (linux based firewall) that has pptp and ipsec built in. The pptp connections are easy as windows has a client built in. I cannot, however, find a free client for windows on the ipsec side. Anyone know of one? Yeah, I'm cheap but it's for my home network.

Re:IPsec is great

[loyukfai]

Win 2K/XP has IPSec support built-in, but it was a nightmare to configure (I persume it will be easier if you use L2TP/IPSec...?).

But you can use the following utility, it's not as polished as those $80 clients but it does the job, it's basically a front-end to configure the IPSec for you based on a simpler config file:

http://vpn.ebootis.de/

Re:Now who can we blame for downloading GB of stuf

[bhima]

I was speaking to an American friend, who lives in Atlanta, recently. He was complaining about this very thing. He owns & manages a variety of types of property which he leases out to people who run bars, restaurants, small businesses, warehouses, and even churches. Occasionally, he has tenants 'disappear' and when he goes down to inspect the property he finds evidence of drug related activities (i.e. rows of HPS lighting, hydroponic setups, and my favorite: money counters). So generally to keep it of his back he reports it and has the police come in and take it all in as evidence. Recently, during one of these events the investigating officer arrested him using a little known local law (either Fulton or DeKalb county) which required the owner of the property to report any illegal activities taking place on their properties. The law is so grey that they make no attempt to deal with whether or not the property owner is knowledgeable or a participant. In effect they demand that all property owners become investigators / informants.

Welcome to post 911 America

Best way to secure WiFi lans?

[emil]

I was thinking of using Poptop over a Netgear WiFi router. This gives me pause.

I am thinking that it may be better to simply leave the router wide open, then put only an OpenBSD system with routing disabled on the other side of the router.

I'll allow only SSH into the OpenBSD system, then set up an HTTP proxy that only accepts connections from localhost. I'll then use PUTTY port forwarding on the clients, then proxy off localhost port 80.

IPSEC looks like the only other option, and it looks a lot harder.

You're all forgetting...

[frank_adrian314159]

In the land of the unsecured, the WEP-ecured man is king.

The point is that I don't have to be totally secure, just more secure than my neighbors. Unless I am specifically targeted by some scoflaw, there are a lot easier access points to get to in my neighborhood for general malfeasance.

You only have to outrun the other guy...

[tc]

Two guys are out camping, when one night an angry bear starts trying to get into their tent. The first man quickly grabs his sneakers and starts lacing them up. The second man says "what the hell are you doing? You'll never outrun the bear!", to which the first replies "I don't have to outrun the bear, I just have to outrun you".

The moral of this story is that your security doesn't need to be perfect, it just needs to be 'good enough', and in this case 'good enough' is probably merely 'better than the muppet next door who hasn't secured their network at all'.

I use WEP to secure my wireless LAN. Does it bother me that it's possible to crack? Not really, because there are at least 2 other networks in my apartment building (with SSIDs of 'linksys' and 'default') which don't appear to have any kind of security at all. Which means that someone casually looking for a free connection is going to use them, not me. If someone really wants to compromise my network specifically, and has the time and skill to do so, well, then I have bigger problems...

OpenVPN

[halfelven]

By far the best way to accomplish that is by using OpenVPN.
I tried everything, IPSec, SSH tunneling, you name it. They all suck. SSH is, let's face it, limited. IPSec is cumbersome, not exactly friendly to all operating systems, doesn't play well with NAT (unless you use UDP encapsulation), etc. It is glaringly obvious that it's a severely overdesigned protocol.

Enter OpenVPN. It uses SSL for encryption, but it's not a SSL-based pseudo-VPN, but a true VPN - it can forward any IP protocol. Think of it as having the functionality of IPSec, but using a simpler and more sensible implementation.
It's cross-platform (Linux, Windows, Solaris... you name it). It's simple to install and configure (same software can be either server or client and the config file semantics are similar). It's secure (it can use signed certificates, passwords, any authentication mechanism you like). It can compress the traffic on the fly (using LZO which is pretty damn fast and low-overhead). If you use TCP transport instead of UDP, it can tunnel through ordinary HTTP proxies. It has dummy-friendly GUI for Windows. It slices, it dices and it makes coffee... oh, well, maybe not that.

Anyway, i'm running an OpenVPN server on my home firewall, and i put OpenVPN on all my computers (my workstation at the office, my laptop, etc.). Wherever i go, i just fire up OpenVPN and "i'm home".
I run IMAP through it, so my IMAP clients (Evolution), no matter where they are, they "see" the same IMAP servers and folders. That is awesome - different systems, yet my mail looks the same. And it's also secure. ;-)

My wireless access point has no security whatsoever: no encryption, no MAC filtering, no SSID cloaking... it even gives you a DHCP address. :-) However, it's behind a totally restrictive firewall. The only way to work around that is to open an OpenVPN tunnel. Then you can do pretty much anything, through the tunnel, of course.

It rocks!

Re:Is PPTP considered safe?

[halfelven]

According to this very article we're commenting now :-) it's not secure.
Have a look at OpenVPN instead.

Re:OpenVPN

[the_maddman]

I will second the recommendation to OpenVPN.

Me and a friend setup an IPSec tunnel between our linux boxes and started playing with it. The routing setup was a nightmare, and to get server to server, server to client and client to client traffic flowing you need multiple traffic filters installed. And the latency of the connection sucked, no playing Diablo 2 over that.

OpenVPN is a breeze compared to all that, you get a tunX device on each box, and as long as you setup your routes using "ip route add (remote net) gw (remote tun) src (your servers eth IP)" even server to server traffic comes from the right netblock so your firewall rules stay sane. And best of all, we dropped from 160ms ping times to 60ms, just by switching from FreeSWAN to OpenVPN.

Treat it like any other vulnerability

[Sierpinski]

Just like you shouldn't say (or even dial) credit card numbers, bank account numbers, etc. over a cordless phone (My baby monitor has picked up dozens of conversations over the last couple years), users just should probably refrain from doing any big time financial or otherwise confidential "conversing" with a computer and WiFi.

Get an "open" hotspot, check the weather, check the game scores, but maybe you should leave the stock selling and the 401k reorganization until you get home.