Slashdot Mirror
On The Current State of WiFi Security
An anonymous reader writes "A Flexbeta article covers the basics of WiF security. The article mentions mentions various ways of securing a WiFi network, how easy it is to crack WEP, and what the IEEE is doing about WiFi security. From the article: 'In order to address the security issues of WEP and the current Wi-Fi standards of 802.11a/b/g, the Institute of Electrical and Electronics Engineers (IEEE) is developing a new standard that is called 802.11i. This standard was developed with security in mind. The new standard implements new security entitled Wi-Fi Protected Access (WPA), which takes advantage of the Temporal Key Integrity Protocol (TKIP), is easier to setup using a pre-shared key, and can use RADIUS authentication.'"
I've been using WPA with TKIP over 802.11g for almost 2 years now. It works great.
(This is with Windows XP and a Microsoft MN-700.)
The real contender is WPA2, which employs the far stronger AES symmetric algorithm in place of RC4, and adds much-desired features such as fast roaming:
WPA2 overview.
If your hardware supports it, use WPA2. If not, settle for nothing less than WPA, as WEP is a joke and trivial to break into.
"The problem with our economy is that our budget is balanced by people who aren't" - A.E.N.
Wireless security is a huge issue these days. When I set up my wireless network, I made sure to get equipment capable of working with WPA encryption, and turned the SSID off, etc. From where I am sitting right now, however, I can access 2 of my neighbor's unsecured, unencrypted Wi-Fi networks. And that will always be the problem. We have the capability to secure wirless networks these days with a reasonable degree of security, but people just refuse to do it.
doesn't .11g have WPA TKIP
The 802.11g spec does not mandate WPA; however, most modern cards and APs support it. While WPA has no known serious weaknesses, choose WPA2-compatible hardware if you're yet to purchase wireless equipment.
"The problem with our economy is that our budget is balanced by people who aren't" - A.E.N.
It doesn't make it less likely that someone will go out of their way to use it, because those people have things like Kismet on hand. It only prevents the people who have naïve Windows XP boxen from accidentally connecting.
ttuttle is a rankmaniac
by telling you this, i may be saving you a lot of trouble by not being ignorant about your property. but then again, "why should i care?"
"Persistence is annoying success." - ghee22 11:28:1999 - 10:53:PM
Depends on who the people in your neighbourhood are. ;-)
Offhand, I can think of several reasons:
1) "Free" internet. Some people avoid paying $X per month for internet service when the guy next door has a wireless router and a 3 Mbit line he's barely using.
(Disclaimer: I don't do this; I pay for Bell Sympatico DSL in Ontario, Canada)
2) Proving Oneself. Somebody in range wants to consider himself a hacker so he or will try to break into your network just to prove he/she can.
3) Activities not so legal. Somebody could conceivably use the wireless network to do something illegal. If the Feds come looking for somebody based on IP they're coming to you and not to his home address. You know what I mean?
4) Identity theft. Somebody might want to pick up your credit card / financial information and use it to rip you off.
The list goes on, as you can imagine.
There's really no such thing as being 100% secure, but there's making yourself a poor target. IMHO with WPA and passwords changed etc. you are a much less likely target than all the unsecured / WEP / default password / etc. networks out there. Much like a car, no anti-theft system will make the car completely theft proof. But it can make you a less lucrative target. :-)
Join the Empire! http://www.empirereborn.net/
I bought a Speedtouch 580 DSL modem as I just moved to Speakeasy, and lo and behold
on the back of the modem is the MAC address of the eth0 port, and the default
WEP/WPA key.
Went in and changed it and everything is happy. But the thing shipped with WPA
enabled and the default (which looks random..) key next to the serial number.
Neko
Yes.
Have a look at this
and Some sensible advice on how really to secure it
Mind you I don't recommend that you turn on SSID broadcast, or turn off mac addr. filtering, but, these options will diter only novice users from stumbling accidently on your WLAN.
But security is not about stopping these novice users, who are less likely to cause any damage in the first place, It's more about stopping someone who is really determined to get in, in order to at best steal your bandwidth or at worst do some real damage like get sensetive data from your PCs.
for the last time people, I am "frodo from middle eaRTH", not "middle eaST".
I recently got my first laptop, and did some wifi hardware research. What I wound up buying are products from AirLink101(.com). I got a Super-G card for my laptop, and two Super-G access points. One is set up as an access point, and the other is set up as a bridge (receives the signal from the AP, goes out the cable into my switch, and into my desktop machines with NICs but no wireless cards; I didn't want to have to buy wireless cards for anything but the laptop). These products support WPA with AES, and work quite well through several walls between the AP and the NIC. Two antennas on the AP/bridge units, and they're removable, so one could add better antennas if needed. This is the only wireless AP I know of that can be configured as a bridge - you normally need to buy a more expensive bridge to get bridge functionality. Also note - these are Super-G units, not just G (108Mbps, not 54). They use the Atheros (sp?) chipset, so should be Super-G compatible with anything else using that chipset.
Prices? The AP/bridge units were $70 each at outpost.com. I can't remember how much the laptop card was - $30 or $40 as I recall, very reasonable.
You will be able to find cheaper wifi hardware, but it won't be Super-G, and it won't be this capable.
So why haven't I improved things?
Simple. Even though I'm a pretty technical Linux user, I've been unable to really feel confident going out and buying 802.11g stuff with WPA, because the existing documentation on the net is pretty bad.
I'm waiting for the mythical "someone else" to set up a nice, straight-forward site that says "here are the cards you can buy at store X which support Linux and don't require binary drivers, patched kernels, and other crap" Sure, there are lists of chipsets, but the actual stores don't list the chipset in particular products often, and the vendors often have multiple versions of the same card with different chipsets.
I think a lot of the problem is the actual hardware industry itself. 802.11b wasn't hard to get Linux support for, but because of the software controlled radio in 802.11g chipsets, it's a bit tricker legally.
And don't get me started on Bluetooth. I got a new phone which has it, and I'd love to buy a little USB Bluetooth dongle so I can play with it, but right now the main Linux Bluetooth page has been asked to take down their list of devices known to work under Linux, because someone in the Bluetooth SIG complained the devices weren't technically qualified. (link) What a load of crap! So instead of getting a dongle which might not work, I'm just not going to get one at all. Everyone loses.
PCMCIA Firewire card is marginally easier, but again, trying to track down and actual card for sale which matches the user-reported specs and models is pretty damn hard. I spent conservatively 3 hours online and in Fry's reading before I got a card which works great until you eject it and panic the kernel.
I guess where I'm going with this rant is that wireless security (in the non-Windows world) would probably be better if the "standards" followed went a bit deeper and were more open to allowing outsiders to confidently buy products. All I'm asking for is a label or a sticker on the box telling me what chipset and version the device uses. It's not hard, and it shouldn't be a secret. Anyone technically savvy to make a purchasing decision based on chipset is technically savvy to figure out what chipset is in a device once they've bought it and spread the word.
Wow... my first rant. Sorry about that....