Free Internet Infrastructure

Ignoring the fact that Verizon are clearly evil (as shown by their service, and the amount of sneaky rubbish installed by their software), maybe they are contributing to a greater good, without even realising it.

I have moved to America now, and in the area that I live, there are only 2 ISPs, Verizon and Road Runner. Verizon's DSL service is cheaper, so a lot of people are going for that. Road Runner's Cable service is better, so I went for that. Either way, I tried out Verizon Online DSL, and part of their sales process is to attempt to upsell customers to buy a router so that they can have as many computers as they want online... a wireless router... which is always sold without WEP or MAC-based security configured, because it causes too many support calls! I talked with the technician who installed my Road Runner service and she said basically the same thing, that people are allowed to install a wireless router on their home connection, but that they certainly wouldn't assist with configuring any security measures, or provide them with security enabled by default.

At first, this just sounds like the usual cop-out of large corporations (HI TELSTRA!), but if you look again, you realise that if this upsell process is effective, and people get the wireless router and use it, then they are providing something to the public; free broadband wireless access to the Internet. There are no bandwidth restrictions (to speak of) on any of these accounts. They are always-on, and not charged by download, upload, connect-time, nothing. It's a flat charge per month no matter what you do with your account.

I'm not condoning that people should run around looking for open access points to use, but my point is this; if ISPs are providing these facilities (in particular un-metered, un-secured, wireless access to their connection), then there has to be some level of acceptance of the fact that people are going to be using the service without direct authorisation.

The reason that I thought of all of this, is that before I got my connection installed here, I turned on my iPAQ and checked for wireless networks - it immediately picked up 2, one of which was unsecured. Just for a laugh, I let it have a go at connecting, and bingo, I had a nice, fast connection to the Internet, care of a friendly (read: clueless) neighbour. If I thought that I was costing them anything, I would have gotten off immediately, but with everything here being flat-rate, and me only checking a few emails and doing some quick browsing, I didn't feel too bad.

What's the general vibe from other people out there about this sort of thing?

[Posted by wirelesspirate in /security. ]

Security Preference?

Here's a question for anyone out there who's 'wireless-security-minded'. If you have to choose between the 2, are you better off having WEP enabled on an access point, or only allowing trusted stations to connect (via MAC-address restrictions)? Obviously it's better to have both, but if you can only have one, which one is more secure?

I was thinking that if you couldn't get WEP to work for whatever reason, then it might be ok to just configure your WAP to only accept connections from certain MAC addresses. This would mean that the data wasn't encrypted in transmission, but wouldn't it also mean that people couldn't snoop your traffic, because they couldn't connect in the first place? Or am I missing something?

The down-side is that if (somehow), an outsider knew the MAC address of your machine/network adaptor, then they could use something like SMAC to spoof it and connect to your WAP.

WEP is supposed to be pretty insecure, and tools like AirSnort can be used to determine the encryption key given enough sample data, so is it really worth the effort? (unless you're regularly cycling your keys perhaps?)

Any thoughts out there?

[Posted by wirelesspirate in /security. ]

Article About Bluetooth Security

This is a pretty interesting (and rather serious) article about some vulnerabilities in bluetooth-enabled mobile phones. It talks about SNARF and BACKDOOR vulnerabilities and roughly how to exploit them. Also provides some links to related tools and what-not.

Read the article on bluetooth vulnerabilities...

[Posted by wirelesspirate in /security. ]

Securing My Netgear Network

On advice from someone who works in the DSD (pretty good advice on this sort of thing I'd say!), I went about securing my network as soon as I had it installed. This is basically all I had to do;

1. Get connection going normally (unencrypted) between my WAP and my wireless-card-equipped laptop.
2. Log into the admin interface on my WAP/switch
3. Under the 'Maintenance' section, go to 'Set Password' and change the admin password for the administration interface (default is 'password' on Netgear devices)
4. Under 'Setup' go to the 'Wireless Settings' and configure the WAP with the following details;
   1. Region: Australia (don't know why this is required, but set it anyway)
   2. SSID: ansible (see previous post about origin of this name)
   3. Click to 'Configure WEP'
      1. Leave 'Authentication Type' on 'Automatic'
      2. Set 'Encryption' to 128-bit
      3. Enter a passphrase (remember it, will need for the PC Card later, and if anyone else is going to access this network)
      4. Click 'Generate Keys' and 'Apply' when done to save it all to the WAP, this will reboot WAP to initiate settings (losing wireless connection in the process, because I am no longer authorised to connect!)
5. On the 'Security' tab of the config utility for my PC Card (on my laptop) adjust the following settings;
   1. 'Enable Encryption' (check this box to turn it on)
   2. Change 'Key Length' to '104/128 bit'
   3. Under 'Create with Passphrase' enter the same passphrase as was used on the WAP
   4. Click 'Apply' to save the settings, then go to the 'Status' tab and click 'Re-Scan' which connects back onto the WAP (using encryption this time)
6. Now that we are connected using WEP, we are little more secure, but we also want to restrict connections to only certain MAC addresses (the hardware signature of the PC card).
7. Get the MAC for you wireless card; I got mine by going back to the WAP admin, then selecting 'Attached Devices' under 'Maintenance'.
8. Again, under the 'Wireless Settings' under 'Setup' in the WAP admin interface, we now click the 'Trusted PCs' button under the 'Access Point' section (to specify trusted PCs)
9. Enter the MAC for your wireless card in the space provided and click 'Add' - mine came up with the name of my machine next to the MAC, so I assume it is either encoded in the MAC, or it contacted my machine and asked (?)
10. Click 'Back' when you're done so we can turn on the security access based on MAC.
11. Now select 'Trusted PCs only' under 'Allow access by:' so that only those machines on your trusted list can connect.
12. Click 'Apply' to save these changes and reboot the WAP. You should reconnect successfully once it's on again, since you are now on the trusted list. If you have another device, try connecting to confirm that it's secure. I haven't been able because I don't have anything else, but I assume it just won't be able to connect :)

More security info to come, including some experiments with things like AirSnort hopefully :)

[Posted by wirelesspirate in /security. ]