Dave Ihnat wrote:
Well, the connection management for XP that came with my Toshiba laptop do show access points that do not broadcast their SSID. I would have to check, but I think the connection management software supplied by AT&T if you have their WiFi service will also do this. (I have to connect to an AT&T access point to re-activate the software.)Similarly, leaving SSID on doesn't stop the determined hacker with tools. But none of the common WiFi connection agents on laptops will show a non- broadcast SSID; you have to go out, get the tools, and work on it.
Getting around the blocking of a specific MAC address is easy with the standard tools on both Linux and Windows. To discover the MAC addresses in use does require a bit of work, but the software is so easy to find. So that is about like closing your door - it keeps people from wandering in, but not much else. So it may or may not be worth the effort. If you have visitors that you want to give access, it is a lot more complicated then just giving then a USB key with the network configuration, or a pass phrase so that they can hook up. You also have to copy their MAC address to the router.Restricting MAC addresses can easily be overcome--but you have to have gotten the tools to do so.
What I am trying to say is that things like this can be handy in keeping honest people honest, but they may not be worth the trouble. Things like disabling the SSID can cause you trouble without adding any benefit. Changing the default SSID will stop accidental connections, and allow auto-connection by authorized computers. But you are not talking about something that will slow down someone trying to crack your network. The danger is in someone thinking that it will, and not taking real security precautions.
It can also backfire on you, in that it can make you a more tempting target for someone that is learning to crack wireless networks, because it is more of a challenge then an open network, but is not as intimidating as a WPA protected network. (Or I got this neat script that is supposed to grab the SSID and MAC address of the wireless connection. Here is one that is not broadcasting its SSID, lets try it out.)
The trick is to secure your wireless network without making it too inconvenient for you to use. After all, if you wanted it totally secure, you would turn off the wireless part of the router completely, or only turn it on when you need it. You can also take some of the more complicated measures, like only allowing VPN connections between computers on your network, or putting a firewall between the wireless router and the rest of hte local network.DHCP--eh, it's too convenient to get rid of. Logging--preferably with forwarding to an internal system--is useful. But after all of these, let the cracker find the WPA encryption behind all the lightweight stuff. You've got to have someone who really wants into your network at that point.
Mikkel -- Do not meddle in the affairs of dragons, for thou art crunchy and taste good with Ketchup!
Attachment:
signature.asc
Description: OpenPGP digital signature
