NetStumbler.org Forums - View Single Post

g0tr00t · 07-08-2002

Question: How do I lock down my AP to keep wardrivers out?

Answer:
Basics for secure wireless computing.

1. Disable SSID broadcasts.
2. Enable WEP encryption.
3. Use Mac filtering if possible.
4. Know your wireless footprint.
5. Limit IP's from AP DHCP.

Explanations:
1. By disabling SSID broadcasts, you effectively make your wireless network disappear. Only authorized clients that have he correct SSID can connect to your network. Even Netstumbler can't see the network.

2. Use WEP even though it can be cracked, it's better that no
encryption. Also cracking the WEP key would require a steady network flow to capture enough packets the begin working on the key. Most Wardrivers, aren't going to have access to your system long enough to worry about it, they see WEP enabled and move on. There are too many unencrypted networks out there already, why waste time working on one that has encryption turned on.

3. By setting Mac filters on your AP's you can effectivly control who's able to connect to them for use. Granted, it's not going to be an easy solution to implement if you had hundreds of users that could possibly connect to a given AP. But if you maintained strict control of AP access to those who really need it you limit the exposure for abuse to your network.

4. Do a walk through with a wireless laptop to see where your hotspots for your network are. It's always a good thing to know that if you have a big hotspot with access available to video store parking lot next door to your office. That's a good place for wardrivers to stop and park to leech off your network. By knowing your footprint, you can reposition your AP's to minimize the amount of bleed through that you have available.

Posted with written permission from Christopher Rector

Another idea I read somewhere else

5. Enable AP DHCP to release only 1 or 2 IP addresses. This way if both are taken up, it will not assign another IP.

If anyone can add to this or wants me to add more steps, shoot me a PM.

07-08-2002	#37 (permalink)
g0tr00t Welcome to my nightmare Join Date: May 2002 Location: r00ting y0ur b0x. Posts: 352	Lock down my AP Question: How do I lock down my AP to keep wardrivers out? Answer: Basics for secure wireless computing. 1. Disable SSID broadcasts. 2. Enable WEP encryption. 3. Use Mac filtering if possible. 4. Know your wireless footprint. 5. Limit IP's from AP DHCP. Explanations: 1. By disabling SSID broadcasts, you effectively make your wireless network disappear. Only authorized clients that have he correct SSID can connect to your network. Even Netstumbler can't see the network. 2. Use WEP even though it can be cracked, it's better that no encryption. Also cracking the WEP key would require a steady network flow to capture enough packets the begin working on the key. Most Wardrivers, aren't going to have access to your system long enough to worry about it, they see WEP enabled and move on. There are too many unencrypted networks out there already, why waste time working on one that has encryption turned on. 3. By setting Mac filters on your AP's you can effectivly control who's able to connect to them for use. Granted, it's not going to be an easy solution to implement if you had hundreds of users that could possibly connect to a given AP. But if you maintained strict control of AP access to those who really need it you limit the exposure for abuse to your network. 4. Do a walk through with a wireless laptop to see where your hotspots for your network are. It's always a good thing to know that if you have a big hotspot with access available to video store parking lot next door to your office. That's a good place for wardrivers to stop and park to leech off your network. By knowing your footprint, you can reposition your AP's to minimize the amount of bleed through that you have available. Posted with written permission from Christopher Rector Another idea I read somewhere else 5. Enable AP DHCP to release only 1 or 2 IP addresses. This way if both are taken up, it will not assign another IP. If anyone can add to this or wants me to add more steps, shoot me a PM. __________________ g0tr00t "Its all fun and games until someone gets killed."