Home/Small Office Wireless Router Security
Systems Analysis
Andre S. Burton
April 9, 2003

Introduction

Cisco's buying out Linksys definitely signals a largely growing market for network tools for home and office here in the U.S. At home, I have a Linksys Wireless Router with a 4-port switch to keep my laptops 'connected' to the Internet. Going wireless definitely makes life simple and convenient as wires get in the way; with a couple of wireless cards, I can check email or write programs on the porch, at the dinner table, or in front of the television. Unfortunately, with great benefits and convenience usually comes a risk to security.

Without security features enabled, a person with a laptop in close proximity of the router can pick up a signal and get free Internet access. This may seem insignificant; without enabling security features such as WEP or client encryption applications using SSH or SSL, any computer with wireless capabilities driven with experience can grab passwords, email messages, credit card numbers, and other personal information. Here, bandwidth theft and data integrity and privacy are both equally important.

 

Bandwidth theft? So what? Aside from the fact that you pay $X a month for internet service and others aren't, a hacker could use your network as a point of attack and a form of identity. Since many wireless networks use DHCP as a way to dynamically handout temporary IP addresses, a hacker could almost anonymously logon a network with DHCP enabled use a different MAC address and appear as a regular user on that network. I would hate to come home and have government officials at my front door asking questions or holding me liable.

802.11b: A Means of Interoperability
"In 2000, 802.11b became the standard wireless ethernet networking technology for both business and home. The WiFI organization was created to ensure interoperability between 802.11b products. [1]" Without a standard in place and a standards organization in place to ensure standardization, buying wireless cards and routers could be a hassle if one had to worry about whether a particular card could communicate with a certain router.

Unfortunately, 802.11b has holes. Until 802.11i, the more secure Wi-Fi version, is fully integrated and accepted, networks will be inherently insecure. However, employing other means of security measures may provide enough security...some security is better than none at all.

Wireless Encryption Protocol
WEP has become a popular means of securing a wireless connection between server and client. WEP is as an option to 802.11 and operates at 40 and 128-bit. "40bit and 64bit encryption is the same thing, it’s just a matter of how the manufacturer decided to label the product. [1]" Intuitively, 128-bit encryption should mean more secure; although this may be the case, higher levels of encryption require more computing power. Similarly, 40 or 60-bit encryption is weaker and less secure but requires less computing. Computing power affects network speed. Using the any encryption level may reduce network speed to 20 to 50% less than it would be without WEP.

Figure 1: WEP Interface

If you have a wireless Linksys router, you can access the administrative controls via HTTP by typing in: http://192.168.1.1. After typing in the password, the browser should bring you to the main page where all your router's setting are accessible. On the main page, by clicking on the Mandatory WEP radio button will bring you to the WEP Key Setting page. There are two ways to generate the encryption key: using the passphrase-key generator or entering the key manually. Many systems will recommend using the generator; in some cases, this option is not available. If you choose the generator option, you have a 31 alphanumeric character limit; it is recommended to choose a passphrase that is difficult to crack. Once the keys have been generated, and you have chosen an encryption level, clicking apply will save these new settings.

MAC Address Filtering
Each computer has a physical address that uniquely identifies it from others. There have been cases where computers or more computers were assigned the same MAC address; however, you can use it to filter it out unauthorized users. I'm unsure of how the software addresses two computers on the network with identical MAC addresses, it's a pretty effective security measure. Some experienced users change a MAC address; this relinquishes the confidence of solely depending on MAC filters for keeping out unauthorized users.

Figure 2: MAC Filter Interface

Under Advanced -> Wireless, clicking on the Edit MAC Filter Setting button will bring up a new window (Figure 2). Under windows, you can see your MAC address in the DOS prompt by typing 'ipconfig -all'. It's listed as the Physical Address and uses hexadecimal number groups delimited by dashes. If you want your computer to have access put its MAC address under one of the available slots, without the dashes. Clicking on the Filter option is for unwanted users; like people that live in your apartment complex that get on your nerves. Click on done to apply the new addresses/settings.

SSH & SSL
On the client-side, be sure to use SSH instead of telnet as telnet sends raw data over the Internet. Submitting the email and or password information to a host will not be encrypted on the path from your computer to the host. WEP simply encrypts the signal from computer to router. Also, when submitting credit card and other personal information over the Internet, be sure the site is using SSL (as idenfitied by https://). Also, check for digital certificates to ensure you're submitting credit card numbers and authorization to the right people.

Password
The adminstrative controls require the user to login through htaccess controls. By default, the Linksys router's default password is Admin. I would strongly recommend changing this password. If you change it, avoid simple and easily cracked passwords as getting access to the router can be detrimental to your network's security.

Status Checking
It's always a good idea to check the status of your network for potential breaches or sources of problems. Setting up WEP & MAC filters, changing the admin password, etc. and leaving the network to successfully operate on its own is a fallacy. There's no such thing as a full-proof network; therefore, you must periodically check for signs of problems or break ins. Aside from checking the DHCP clients table and using other measures, you may need to install extra software to check processes that break through firewalls. Linksys offers a software package called ZoneAlarm Pro and PC-cillin that does internal monitoring of computers on the LAN; unfortunately, it costs $70 and you have to keep it updated.

Blocking Requests and Port Numbers
If you only have two computers and don't care if anybody else can access it, only allowing two computers on at a time may be a good idea. You may also use static IP addresses; however, if you have visitors that wish to use your router, you have to change the settings on both the router and your computer(s) making the process inconvenient. Sticking with DHCP, you have the option of filtering out other groups of IP addresses...just in case the intruder is looking for a specific IP address to use.

There are other security options available which are set for the default configuration. For example, it's important to make sure Block WAN request is enabled to block ping and other methods of network detection. This option not only blocks certain detection methods, but it also hides network ports from intruders.

Conclusion
Although there is no way to completely keep hackers out of home networks, some measures are better than none. It's the combination of measures that make up a more secure system.

Resources

  1. 802.11b tutorial - http://www.homenethelp.com/802.11b/index.asp
  2. Internet Tips: Lock Out Internet Pests, Lock in Network Security - http://www.pcworld.com/reviews/article/0,aid,103799,00.asp
  3. Linksys Router/4 Port Switch Manual - ftp://ftp.linksys.com/pub/manuals/befw11s4_ug.pdf
  4. Linksys Website - http://linksys.com
  5. Zone Alarm - http://linksys.zonelabs.com/linksys_tm_aboutproducts.html