Wireless Security Settings
Thread Starter
Join Date: Mar 2001
Location: Cardiff ex GLA
Posts: 216
Likes: 0
Received 0 Likes
on
0 Posts
Wireless Security Settings
After reading the 'wireless router question' thread I am now reaching new heights of paranoia regarding my wireless security. Im running a small home network of 2 PCs connected by a netgear dg834g router. After reading the thread I came home and attempted to open my netgear software and tweak the security settings, unfortunately a search for 'netgear' in windows explorer reveals nothing. Where are these files likely to be and what settings should I be looking at changing ? Netgear website has no info on security that I can find ... anyone help ?
Thanks in advance
Thanks in advance
I've also recently installed a NETGEAR DG834Gv2, and found another PPRuNe thread here very helpful, as I cautiously try to increase the wireless security.
The text and screenshots on THIS LINK provide some guidance on settings.
A note of caution that has been mentioned before; it's advisable to have at least one PC connected to the DG834 via a LAN cable, at least whilst you're setting up the security. If you only have a wireless connection during the procedure, and things go wrong, you could find yourself unable to communicate with your own router!
The text and screenshots on THIS LINK provide some guidance on settings.
A note of caution that has been mentioned before; it's advisable to have at least one PC connected to the DG834 via a LAN cable, at least whilst you're setting up the security. If you only have a wireless connection during the procedure, and things go wrong, you could find yourself unable to communicate with your own router!
Join Date: Jun 2003
Location: EuroGA.org
Posts: 13,787
Likes: 0
Received 0 Likes
on
0 Posts
Just an update:
There is a relatively new attack on WEP; an article about it is at
http://www.tomsnetworking.com/Sections-article111.php
Basically one tricks the access point into generating the traffic that's required to collect the large amount of data required to crack a WEP key.
The attacker used to have to wait until sufficient traffic was captured. With this attack, he can generate the traffic himself.
It's only a matter of time before a simple utility appears that cracks anybody's WEP access point; usually in minutes.
Suppressing SSID broadcast will be a first line of defence - assuming the network isn't in use at the time he is driving by, and he can't guess the SSID. So "linksys" won't hack it
WPA is a must.
There is a relatively new attack on WEP; an article about it is at
http://www.tomsnetworking.com/Sections-article111.php
Basically one tricks the access point into generating the traffic that's required to collect the large amount of data required to crack a WEP key.
The attacker used to have to wait until sufficient traffic was captured. With this attack, he can generate the traffic himself.
It's only a matter of time before a simple utility appears that cracks anybody's WEP access point; usually in minutes.
Suppressing SSID broadcast will be a first line of defence - assuming the network isn't in use at the time he is driving by, and he can't guess the SSID. So "linksys" won't hack it
WPA is a must.
Join Date: Sep 2002
Location: Chichester, UK
Posts: 1,650
Likes: 0
Received 0 Likes
on
0 Posts
It's only a matter of time before a simple utility appears that cracks anybody's WEP access point ... WPA is a must.
Join Date: Jul 2002
Location: CYYC
Posts: 410
Likes: 0
Received 0 Likes
on
0 Posts
I agree about using WPA, although even it has been hacked too. It takes far more work though and you don't have to worry as much about someone running a simple utility to do it for you. Setting up a D-Link router with WPA-SK was easier than the WEP setup as you don't need to use a hex key. Netgear may be different though.
goates
goates
Join Date: Jun 2003
Location: EuroGA.org
Posts: 13,787
Likes: 0
Received 0 Likes
on
0 Posts
I agree about using WPA, although even it has been hacked too.
Not counting a brute force / dictionary attack, of course.
The downside of WPA is that a lot of older wifi gear doesn't support it, or doesn't work for reasons unknown. I've got several devices. A laptop with a Cisco 350 card which is one of the best wifi adapters for compatibility and performance (very cheap on Ebay, too) which should support WPA via the config in XP, but doesn't. (It supports a number of "corporate" WPA protocols such as EAP but without something like a decent Cisco AP (again, Ebay...) one can't use them.) An HP laptop, c. 2004, which should but doesn't. A few others that don't support it at all. The one adapter which works really well is the Linksys WPC54G, going on Ebay for about £10-15. It even works on WPA/PSK/TKIP when the SSID broadcast is disabled; once you set up the profile it just finds the AP all by itself without any interaction. It works with every AP I've tried so far.
Join Date: Sep 2002
Location: Chichester, UK
Posts: 1,650
Likes: 0
Received 0 Likes
on
0 Posts
I don't know of a serious non-dictionary attack on WPA - I read something about WPA hashing collisions that I didn't really understand, but I don't think it's a real attack, more a potential reduction in the brute-force workload (which would still be very high).
Join Date: Jul 2002
Location: CYYC
Posts: 410
Likes: 0
Received 0 Likes
on
0 Posts
It sounds more like a dictionary attack, but it still doesn't seem to be outside the realm of a bored kid with too much time on his hands. It also looks like if you use a 64 bit passphrase you are pretty safe.
http://wifinetnews.com/archives/004428.html
http://www.nwfusion.com/reviews/2004...relesswpa.html
goates
http://wifinetnews.com/archives/004428.html
http://www.nwfusion.com/reviews/2004...relesswpa.html
goates
There's a known issue on the DG834G whereby you can't turn off SSID broadcast AND have WPA-PSK on at the same time. If you do this, you won't be able to connect.
So, if you use WPA-PSK and MAC address control, you should be able to allow the SSID broadcast in relative peace.
So, if you use WPA-PSK and MAC address control, you should be able to allow the SSID broadcast in relative peace.
Join Date: Sep 2002
Location: Chichester, UK
Posts: 1,650
Likes: 0
Received 0 Likes
on
0 Posts
Does MAC address filtering buy you anything if you're using WPA-PSK (or even WEP)? If someone is going to try and break the encryption, then the MAC address ACL is trivial to bypass in comparison.
Join Date: Jun 2003
Location: EuroGA.org
Posts: 13,787
Likes: 0
Received 0 Likes
on
0 Posts
MAC address filtering and stopping SSID broadcast just keeps out the neighbour wishing to download his dirty movies from alt.binaries.warez.erotica.asian.multimedia when his wife isn't looking
WEP security depends entirely on the adversary. No ordinary "neighbour" will ever crack WEP. Presently it takes a clever person who needs to be in good reception range for longer than just parking in the lay-by outside, and it is likely to get a lot easier very soon once properly integrated tools appear. Across the road from me is a man whose business is bulk email generation
so no way I would use WEP. But why would anyone bother? If you have secrets then you must use WPA as a minimum. Otherwise, they will just get free internet access, but they can get it 50 yards further down the road with zero effort.
The issue with not using SSID and WPA at the same time applies to quite a few devices, I suspect. A lot of wifi clients can't find the AP if SSID is OFF and encryption (even WEP) is ON. Some will work OK but they need SSID ON for the initial config. One can waste a large chunk of one's life playing with this stuff. If I didn't know the Linksys WPC54G works well I would just head for Ebay and "Cisco" every time. Life's too short.
WEP security depends entirely on the adversary. No ordinary "neighbour" will ever crack WEP. Presently it takes a clever person who needs to be in good reception range for longer than just parking in the lay-by outside, and it is likely to get a lot easier very soon once properly integrated tools appear. Across the road from me is a man whose business is bulk email generation
so no way I would use WEP. But why would anyone bother? If you have secrets then you must use WPA as a minimum. Otherwise, they will just get free internet access, but they can get it 50 yards further down the road with zero effort.The issue with not using SSID and WPA at the same time applies to quite a few devices, I suspect. A lot of wifi clients can't find the AP if SSID is OFF and encryption (even WEP) is ON. Some will work OK but they need SSID ON for the initial config. One can waste a large chunk of one's life playing with this stuff. If I didn't know the Linksys WPC54G works well I would just head for Ebay and "Cisco" every time. Life's too short.
Join Date: Jul 2002
Location: CYYC
Posts: 410
Likes: 0
Received 0 Likes
on
0 Posts
If it helps, my girlfriend's D-Link DI-714+ (I think that's the model#) has been working well with WPA, SSID turned off and MAC address filtering.
Part of the problem with computers not seeing the router is Windows' wireless software. On just about every computer forum I have seen posts about the Windows XP wireless software not working, but some third party program working fine.
goates
Part of the problem with computers not seeing the router is Windows' wireless software. On just about every computer forum I have seen posts about the Windows XP wireless software not working, but some third party program working fine.
goates
