|
Introduction
 |
Cisco's buying out Linksys definitely signals a largely growing
market for network tools for home and office here in the U.S.
At home, I have a Linksys Wireless Router with a 4-port switch
to keep my laptops 'connected' to the Internet. Going wireless
definitely makes life simple and convenient as wires get in the
way; with a couple of wireless cards, I can check email or write
programs on the porch, at the dinner table, or in front of the
television. Unfortunately, with great benefits and convenience
usually comes a risk to security.
Without security features enabled, a person with a laptop in
close proximity of the router can pick up a signal and get free
Internet access. This may seem insignificant; without enabling
security features such as WEP or client encryption applications
using SSH or SSL, any computer with wireless capabilities driven
with experience can grab passwords, email messages, credit card
numbers, and other personal information. Here, bandwidth theft
and data integrity and privacy are both equally important.
|
Bandwidth theft? So what? Aside from the fact that you pay $X
a month for internet service and others aren't, a hacker could use your
network as a point of attack and a form of identity. Since many wireless
networks use DHCP as a way to dynamically handout temporary IP addresses,
a hacker could almost anonymously logon a network with DHCP enabled
use a different MAC address and appear as a regular user on that network.
I would hate to come home and have government officials at my front
door asking questions or holding me liable.
802.11b: A Means of Interoperability
"In 2000, 802.11b became the standard wireless ethernet networking
technology for both business and home. The WiFI organization was created
to ensure interoperability between 802.11b products. [1]" Without
a standard in place and a standards organization in place to ensure
standardization, buying wireless cards and routers could be a hassle
if one had to worry about whether a particular card could communicate
with a certain router.
Unfortunately, 802.11b has holes. Until 802.11i, the more secure Wi-Fi
version, is fully integrated and accepted, networks will be inherently
insecure. However, employing other means of security measures may provide
enough security...some security is better than none at all.
Wireless Encryption Protocol
WEP has become a popular means of securing a wireless connection between
server and client. WEP is as an option to 802.11 and operates at 40
and 128-bit. "40bit and 64bit encryption is the same thing, it’s
just a matter of how the manufacturer decided to label the product.
[1]" Intuitively, 128-bit encryption should mean more secure; although
this may be the case, higher levels of encryption require more computing
power. Similarly, 40 or 60-bit encryption is weaker and less secure
but requires less computing. Computing power affects network speed.
Using the any encryption level may reduce network speed to 20 to 50%
less than it would be without WEP.
 |
| Figure 1: WEP Interface |
If you have a wireless Linksys router, you can access the administrative
controls via HTTP by typing in: http://192.168.1.1. After typing in
the password, the browser should bring you to the main page where all
your router's setting are accessible. On the main page, by clicking
on the Mandatory WEP radio button will bring you to the WEP Key Setting
page. There are two ways to generate the encryption key: using the passphrase-key
generator or entering the key manually. Many systems will recommend
using the generator; in some cases, this option is not available. If
you choose the generator option, you have a 31 alphanumeric character
limit; it is recommended to choose a passphrase that is difficult to
crack. Once the keys have been generated, and you have chosen an encryption
level, clicking apply will save these new settings.
MAC Address Filtering
Each computer has a physical address that uniquely identifies it from
others. There have been cases where computers or more computers were
assigned the same MAC address; however, you can use it to filter it
out unauthorized users. I'm unsure of how the software addresses two
computers on the network with identical MAC addresses, it's a pretty
effective security measure. Some experienced users change a MAC address;
this relinquishes the confidence of solely depending on MAC filters
for keeping out unauthorized users.
 |
| Figure 2: MAC Filter Interface |
Under Advanced -> Wireless, clicking on the Edit MAC Filter Setting
button will bring up a new window (Figure 2). Under windows, you can
see your MAC address in the DOS prompt by typing 'ipconfig -all'. It's
listed as the Physical Address and uses hexadecimal number groups delimited
by dashes. If you want your computer to have access put its MAC address
under one of the available slots, without the dashes. Clicking on the
Filter option is for unwanted users; like people that live in your apartment
complex that get on your nerves. Click on done to apply the new addresses/settings.
SSH & SSL
On the client-side, be sure to use SSH instead of telnet as telnet sends
raw data over the Internet. Submitting the email and or password information
to a host will not be encrypted on the path from your computer to the
host. WEP simply encrypts the signal from computer to router. Also,
when submitting credit card and other personal information over the
Internet, be sure the site is using SSL (as idenfitied by https://).
Also, check for digital certificates to ensure you're submitting credit
card numbers and authorization to the right people.
Password
The adminstrative controls require the user to login through htaccess
controls. By default, the Linksys router's default password is Admin.
I would strongly recommend changing this password. If you change it,
avoid simple and easily cracked passwords as getting access to the router
can be detrimental to your network's security.
Status Checking
It's always a good idea to check the status of your network for potential
breaches or sources of problems. Setting up WEP & MAC filters, changing
the admin password, etc. and leaving the network to successfully operate
on its own is a fallacy. There's no such thing as a full-proof network;
therefore, you must periodically check for signs of problems or break
ins. Aside from checking the DHCP clients table and using other measures,
you may need to install extra software to check processes that break
through firewalls. Linksys offers a software package called ZoneAlarm
Pro and PC-cillin that does internal monitoring of computers on the
LAN; unfortunately, it costs $70 and you have to keep it updated.
Blocking Requests and Port Numbers
If you only have two computers and don't care if anybody else can access
it, only allowing two computers on at a time may be a good idea. You
may also use static IP addresses; however, if you have visitors that
wish to use your router, you have to change the settings on both the
router and your computer(s) making the process inconvenient. Sticking
with DHCP, you have the option of filtering out other groups of IP addresses...just
in case the intruder is looking for a specific IP address to use.
There are other security options available which are set for the default
configuration. For example, it's important to make sure Block WAN request
is enabled to block ping and other methods of network detection. This
option not only blocks certain detection methods, but it also hides
network ports from intruders.
Conclusion
Although there is no way to completely keep hackers out of home networks,
some measures are better than none. It's the combination of measures
that make up a more secure system.
Resources
- 802.11b tutorial - http://www.homenethelp.com/802.11b/index.asp
- Internet Tips: Lock Out Internet Pests, Lock in Network Security
- http://www.pcworld.com/reviews/article/0,aid,103799,00.asp
- Linksys Router/4 Port Switch Manual - ftp://ftp.linksys.com/pub/manuals/befw11s4_ug.pdf
- Linksys Website - http://linksys.com
- Zone Alarm - http://linksys.zonelabs.com/linksys_tm_aboutproducts.html
|