According to a December 2004 study, 60 to 70 percent of all wireless networks are insecure. Although there is lots of information on securing wireless networks, most of this information focuses on corporate networks. In this article, I will attempt to help people secure their home wireless networks.
If you were to do a Google search on the phrase “Wireless Network Security”, you would get thousands of links to articles explaining all sorts of elaborate ways to secure your wireless network. One thing that always bothered me about these articles though is that the vast majority of them focus their attention on corporations. The reason why this bothers me is because Wi-Fi is primarily a consumer technology. I’ll admit that I have been as guilty as anyone of writing wireless security articles that focus on corporations. However, in this article, I want to fill a badly neglected void and talk about wireless security for the home.
Why is Wireless Security Important in the Home?
Wireless security is important in the home for the same reasons why it is important in corporations. If you have an unsecured wireless network in your home, anyone in close proximity can spy on your online activities. Depending on how your home network is configured, someone could even gain full access to your computer’s hard drive over an unsecured wireless network.
Even if no one is around that wants to spy on you or perform some malicious action against you, your neighbors could sponge off of your Internet connection. This would not only deprive you of bandwidth that you are paying for, but if your neighbor conducted some illegal activity while online, it could be traced back to your network.
Right now you might be wondering what the odds are of any of these things ever happening. If you have an unsecured wireless connection, the odds of it being exploited are pretty good.
About four years ago, I was asked by one of the companies that I was writing for at the time to do an experiment to see how many wireless networks I could detect and how many of those networks were insecure. To perform the experiment, I loaded a copy of Net Stumbler onto my laptop and had my wife drive me around while I tried to detect wireless networks. During my experiment I managed to detect seven networks and none of them were secure.
Seven wireless networks certainly aren’t many, but there are several things to keep in mind. First, I live in the middle of nowhere in a rural part of South Carolina, not in a densely populated place like New York City. Second, I was using a stock Wi-Fi card without any type of external antenna. Third, I was attempting to detect wireless networks from a moving vehicle, using a Wi-Fi card that had a relatively short range. Fourth, this was four years ago.
If I detected that many wireless networks, four years ago, in the middle of nowhere, under conditions that would give me poor reception, can you imagine how many wireless networks are in use today? Wireless networks are everywhere, and the vast majority of them are insecure. In fact, as of December 2004, an estimated 60 to 70 percent of all wireless networks did not use any type of encryption. My point is that wireless networks are everywhere and the majority of them are insecure, and the bad guys know this.
Hackers routinely engage in a practice called war walking. War walking is similar to my little experiment. It’s basically a trip on foot, by car, by airplane, or what ever to try to locate wireless networks.
At first it might not seem like a big deal if a hacker knows that you have a wireless network. After all, most of your neighbors probably have wireless networks too. Besides, wireless networks have a relatively short range and it would be easy to spot someone sitting in front of your house with a laptop. The problem is that although your wireless access point may have a short range, it is possible to make a homemade antenna that can receive your network’s signal from many miles away. In fact, if a direct line of sight is available, it is possible to make a Wi-Fi antenna out of a Pringles can that can intercept a Wi-Fi signal from up to ten miles away. Hackers no longer need to sit in a car in front of your house to hack your wireless network.
Securing Your Wireless Network
Now that I have explained why it is so important to secure your wireless network, I want to spend the rest of this article explaining the steps that you should take in doing so. Unfortunately, I can’t give you the exact step-by-step procedure because every manufacturer of wireless hardware uses a different interface for configuring the device. Even so, the things that I will be discussing are nearly universal and will be valid for almost all Wi-Fi networks.
Use Encryption
By far the most important thing that you can do to secure your wireless network is to use encryption. Almost every wireless access point has some type of encryption mechanism built in. Most older access points offer WEP encryption, and newer access points offer a choice between WEP and WPA.
You are much better off using WPA than WEP. The WEP encryption method is flawed because if someone is able to capture enough data, it is possible to decipher WEP. Even so, it takes most home users weeks to do enough Web surfing to produce enough traffic for WEP to be compromised.
My advice would be that if your wireless hardware doesn’t support WPA, then you should upgrade to hardware that does offer WPA support. If an upgrade just isn’t in the budget, then you should go ahead and turn on WEP encryption. Sure, WEP is flawed, but flawed encryption is better than no encryption. Besides, there are enough people with insecure wireless networks that most of the time if a hacker sees that your network is encrypted with WEP, they will move on to an easier target than spending weeks trying to capture enough data to decrypt WEP.
The only other drawback to using encryption on your access point is that it can be a little complicated to set up if you aren’t the technical type. If you can’t figure out how to set up wireless encryption, then invite the neighborhood nerd over for dinner and have them enable encryption. Do what ever you have to do, but get encryption enabled.
Don’t Announce Yourself
Wi-Fi access points use a mechanism called identifier broadcasting to announce themselves. The problem with identifier broadcasting is that you already know that you have a wireless network, so there is no need in announcing it to you. The only people that the broadcast really benefits is hackers. Not all wireless access points allow you to disable identifier broadcasting, but if yours does allow you to disable it, then you should.
While you are at it, you should also change your SSID or ESSID. The SSID or ESSID is basically just a name that’s assigned to the wireless access point. The reason why it is important to change the SSID or ESSID is because you don’t want your access point to have an out of the box name. Think about it for a minute. Wireless hardware manufacturers assign the same SSID or ESSID to every access point that rolls off of the assembly line. Even if you aren’t broadcasting your access point’s identification to the world, it isn’t that hard to figure out that you have an access point in your house. If the access point isn’t broadcasting an SSID or an ESSID then the first thing that a hacker will usually try is to attach to the access point by using common default SSID or ESSID names.
It is also important that you change your access point’s default password for the same reason. You don’t want a hacker to be able to take control of your access point just because it still has the default password assigned to it. If a hacker were to take control of the access point, they could actually lock you out of your own network.
Limit Access To Your Access Point
Another thing that you can do to help secure your wireless access point is to limit which computers are allowed to use it. Every network interface card (including wireless cards) has what’s known as a Media Access Control (MAC) address associated with it. Most wireless access points contain a mechanism that you can use to tell the access point that only network cards with these specific MAC addresses are allowed to use the network.
You can determine a machine’s MAC address by opening a command prompt window on the workstation and entering the command IPCONFIG /ALL. This command is designed to display the machine’s TCP/IP configuration. However, it will list the machine’s MAC address under the Physical Address heading.
Limiting access to the access point by MAC address isn’t a perfect security mechanism. A hacker can use a protocol analyzer to determine which MAC addresses are in use on your network. They can then spoof a valid address and bypass your address filter. Even so, it is important to use address filtering. The reason is because none of the wireless security mechanisms that I’ve shown you are perfect, but all of the mechanisms that I’ve shown you provide relatively good security.
