Diff for "WirelessSecurity" - Personal Telco Project

-  ← Revision 4 as of 2004-09-13 07:12:19 →
  Size: 6453
  Editor: sub20-89
  Comment:
+  ← Revision 6 as of 2005-03-01 11:45:01 →
  Size: 10373
  Editor: 62
  Comment:
-Deletions are marked like this.
+Additions are marked like this.
 Line 1:
-=== Wireless Security Howto ===



Abstract: This aims to provide a detailed security howto for wireless networks..



 1. Why wireless is an insecure medium inherently (broadcast nature)

  a. "15-mile sniff" example of San Francisco to Berkeley (Peter Shipley example)

   * Peter Shipley conducted a proof of concept of associating with a standard desktop access point over 15 miles away across the SF bay, with a 24 dBi parabolic grid, and a powerful amplifier.

 * Why people should be using these security measures on their wired networks and on the wired internet, and not just the wireless networks.

 * Simple explanation of WEP problems (not the purpose of this text)

  a. Brute Force

   * ~200 days on a laptop for 40bit WEP, and 10^19 years for 104-bit WEP

  * Using vulnerabilities in the implementation of RC4 in WEP

   * you need to collect a lot of packets to complete this crack.  ~6 million to 10 million.  For a normal home user this is over 1 month of activity.  For a corporate wireless lan this is over a week (unless someone is doing some high traffic activity such as backups across the wireless lan).  Using ping flooding to artifically generate more traffic (1 data byte ping packets) you can generate enough traffic in over an hour.  This attack can be a completely passive attack. For tools search for AirSnort or WEPCrack on google or freshmeat.

  * 40-bit WEP becomes 21-bit wep when using generated pass phrases.

   * Tim Newsham's crack on passphrase generate WEP keys.  Capture 20 packets, analyze for a couple of minutes, and you have the WEP key.  The passphrase generated WEP keys are uses by vendors such as Linksys and DLink. Works on 128/104 and 64/40 bit WEP.  (2^21 vs 2^40 = 2097152 possible combinations vs 1099511627776 possible combinations)  http://www.lava.net/~newsham/wlan/

  * 40-bit WEP becomes less when using ASCII password (~62^5 vs 2^40 = 916132832 vs 1099511627776)

   * http://www.cranite.com/wireless_card_install.htm  for a list of the ASCII to hexadecimal conversion.

  * Why you wouldn't use WEP in a public network.  --Adam Shand

   * the security implications of 802.11b are basically not an issue for what we're doing.  i'm not sure how much detail you want on it but here's the real basics and feel free to ask for more detail.

   * 802.11b has a protocol called WEP (which stands for wired equivlent privacy).  wep was intended to give a wireless connection as much security as a normal wired (like traditial ethernet) connection.  so basically you can control who connects, at a physical level, to your network.

   * wep has been widely used by corporations to deploy access points in their corporate networks.  this way you could deploy an access point inside your firewall without fear of someone sitting in the parking lot using it. 

   * the problem is that wep is an awfully written protocol.  technically it has more holes in it then a seive and an hostile attacker can circumvent it on less then an hour with publically available tools.  this really sucks for corporations who have deployed access points in this way because now they have a glaring security problem in the soft insecure part of their network.

   * ... now, why don't i care?  because we were never using wep.  from a community networking  point of view wep is useless, it uses a shared password so anyone who you want to give access to has to know the password, if you now want to revoke access from someone (lets say cause they did something bad on the network) you can do that without changing the password, which means that you break everyone else ... and all your other customers can't connect until they update their software with the new key.  as you can imagine this could quickly become a major pain in the ass.

   * so we circumvented wep and wrote software called a captive portal (sometimes also referred to as an active portal).  this means that instead of using the security "features" built into the 802.11b protocol we use our own software to control access which gives us much more flexibility and security.

   * if you're curious you can read more about this stuff at: WhyCaptivePortal



 * Other security mechanisms -- AdamShand

  a. SSL & TLS (web, pop, imap, smtp)

   * Use SSL to encrypt your data end to end.  This SSL can be used for many applications, including web surfing (HTTPS), receiving email (POP over SSL, and IMAP over SSL), sending email (SMTP over SSL), and tunneling (stunnel).

  * SSH (replacement for telnet, tunneling, scp)

   * SSH is the secure replacement for telnet, rlogin, etc. It has largely held up to public crytological attacks.

  * VPNs (PPTP [which has it's own holes], IPSec)

   * Replacing WEP with IPsec: http://rt.fm/~jcs/ipsec_wep.html --EliabHelon

  * PGP/GPG encryption

  * NoCatAuth

   * NoCatAuth does not encrypt your data, but provides you with a security mechanism to prevent who passes traffic on your wireless network to your wired network.  For more info see http://nocat.net

  * Which of these are vulnerable to Man in the Middle Attacks

  * Extrusion Detection Idea



 * Building a wireless network so that everything has to go through a VPN server, only VPN traffic is allowed through.  Most secure wireless network design.  -- MichaelCodanti



 Set your AP to bridged mode, and hook it to a computer that is double homed, and has a VPN server running on it.  Have a DHCP sever running that passes out non-routable IPs over the wireless network (you could even let an airport or rg-1000 do this) Then setup that computer to only accept your flavor of VPN/IPSec...  This can be either a Linux or Win2k box and is fairly easy to setup.. (Win2KServer automatically filters everything when you use the wizard to setup VPN on a computer..)  Once you have done that you just have to setup a VPN icon on the client machines and either make them log on each time, or you can set it up to automatically connect...  Once you've done that you should be as secure as you can get right now...  (As far as I know)



 * Considerations of a home network versus a corporate network

 * Where to wire your access points into your existing network

  a. Not behind your firewall

  * Not on your DMZ        ??--??

  * Possible before your firewall

  * Correctly as a separate network segment that is firewalled from the internet and firewalled from your internal network.

----

-- TerrySchmidt

----

[CategoryDocumentation]
+!'''[http://phentermine1.chat.ru/ Buy phentermine]!'''!



!'''[http://0nline-casin0.newmail.ru Online Casino] Win money fast!'''!



!'''[http://united-airline.boom.ru/ United Airlines tickets] !'''!



[http://online-degree.hotmail.ru/ Online degree]



[http://online1degree.chat.ru/ Online degree]





[http://chp-cigar.boom.ru/ cheap cigarettes]

[http://disc-cigar.boom.ru/ discount cigarettes]

[http://online-cigaret.hotmail.ru/ online cigarettes]

[http://marlb-cigar.boom.ru/ marlboro cigarettes]

[http://online-cigar.boom.ru/ online cigarettes]

[http://winst-cigar.boom.ru/ winston cigarettes]

[http://camel-cigar.boom.ru/ camel cigarettes]

[http://winst-cigaret.hotmail.ru/ Cheap winston cigarettes]



[http://tiffany-lamp.narod.ru/ | tiffany lamp] 

[http://floor-lamp.narod.ru/ | floor lamp] 

[http://lamp-shades.narod.ru/ | lamp shades] 

[http://lamp-plus.narod.ru/ | lamp plus] 

[http://projector-lamp2005.narod.ru/ | projector lamp] 

[http://desk-lamp2005.narod.ru/ | desk lamp] 

[http://desk-lamp1.narod.ru/ | desk lamp] 





Best links: '''laptop'''







[http://dell-laptop.newmail.ru/ | dell laptop] 

[http://dell1laptop.chat.ru/ | dell laptop] 





Best links: '''lift chair'''







[http://lift-chair.boom.ru/ | lift chair] 





Best links: '''loan'''







[http://homeequityloanr.chat.ru/ | home equity loan rate] 

[http://fastloan.chat.ru/ | fast loan] 

[http://carloan.chat.ru/ | car loan] 

[http://bcrloanmortgage.chat.ru/ | bad credit loan mortgage] 

[http://fastcashloan.chat.ru/ | fast cash loan] 

[http://debtconsloan.chat.ru/ | debt consolidation loan] 

[http://cashloan.chat.ru/ | cash loan] 

[http://bcreditautoloan.chat.ru/ | bad credit auto loan] 

[http://personalloan.chat.ru/ | personal loan] 

[http://vahomeloan.chat.ru/ | va home loan] 

[http://homeloanmortgage.chat.ru/ | a home loan mortgage] 

[http://cashadvanceloan.chat.ru/ | cash advance loan] 

[http://unsecuredploan.chat.ru/ | unsecured personal loan] 

[http://improvementloan.chat.ru/ | home improvement loan] 

[http://bcreditcarloan.chat.ru/ | bad credit car loan] 

[http://badcreditloan1.chat.ru/ | bad credit loan] 

[http://badcreditloan.chat.ru/ | bad credit loan] 

[http://pdloanonline.chat.ru/ | payday loan online] 

[http://fhaloan.chat.ru/ | fha loan] 

[http://mortgageloan.chat.ru/ | mortgage loan] 

[http://nfpaydayloan.chat.ru/ | no faxing payday loan] 

[http://floridahomeloan.chat.ru/ | florida home loan] 

[http://consolidloan.chat.ru/ | consolidation loan] 

[http://countryhomeloan.chat.ru/ | countrywide home loan] 

[http://refinanceloan.chat.ru/ | refinance loan] 

[http://valoan.chat.ru/ | va loan] 

[http://chomeloan.chat.ru/ | california home loan] 

[http://homeequityloan.chat.ru/ | home equity loan] 

[http://eloancom.chat.ru/ | e loan] 





Best links: '''massage chair'''







[http://massage-chair.hotmail.ru/ | massage chair] 

[http://chair4massage.chat.ru/ | massage chair] 





Best links: '''mat'''







[http://floor-mat.nm.ru/ | floor mat] 

[http://floor1mat.chat.ru/ | floor mat] 

[http://yoga-mat.newmail.ru/ | yoga mat] 

[http://mat4yoga.chat.ru/ | yoga mat] 





Best links: '''mediterranean cruise'''







[http://mediterr-cruise.boom.ru/ | mediterranean cruise] 

[http://mediter1cruise.chat.ru/ | mediterranean cruise] 

[http://mediterranean-cruise.hotmail.ru/ | mediterranean cruise] 





Best links: '''mortgage'''







[http://lowmortgagerate.chat.ru/ | lowest mortgage rate] 

[http://calif1mortgage.chat.ru/ | california mortgage] 

[http://ameriqmortgage.chat.ru/ | ameriquest mortgage] 

[http://mortgage1lead.chat.ru/ | mortgage lead] 

[http://wmutualmortgage.chat.ru/ | washington mutual mortgage] 





Best links: '''motor scooter'''







[http://motor2scooter.chat.ru/ | motor scooter] 





Best links: '''network monitoring software'''







[http://network-software.hotmail.ru/ | network monitoring software] 

[http://network-software.boom.ru/ | network monitoring software] 

[http://software2network.chat.ru/ | network monitoring software] 

[http://network-monitor.boom.ru/ | network monitoring software] 





Best links: '''nissan'''







[http://nissan-altima.newmail.ru/ | nissan altima] 

[http://nissan1altima.chat.ru/ | nissan altima] 

[http://nissan-altima.narod.ru/ | nissan altima] 

[http://nissan-maxima.nm.ru/ | nissan maxima] 

[http://nissan1maxima.chat.ru/ | nissan maxima] 

[http://nissan-maxima.narod.ru/ | nissan maxima] 

[http://nissan-350z.hotmail.ru/ | nissan 350z] 

[http://nissan350z.chat.ru/ | nissan 350z] 





Best links: '''nursing'''







[http://nursing-degree.hotmail.ru/ | nursing degree] 

[http://nursing1degree.chat.ru/ | nursing degree] 

[http://nursing-home.hotmail.ru/ | nursing home] 

[http://nursing-home.boom.ru/ | nursing home] 

[http://nursing-school.hotmail.ru/ | nursing school] 

[http://nursing2-school.boom.ru/ | nursing school] 

[http://nursing2school.chat.ru/ | nursing school] 

[http://nursing-job.boom.ru/ | nursing job] 

[http://nursing4job.chat.ru/ | nursing job] 

[http://travel4-nursing.boom.ru/ | travel nursing] 

[http://travel2nursing.chat.ru/ | travel nursing] 

[http://nursing-college.hotmail.ru/ | nursing college] 

[http://nursing-college.boom.ru/ | nursing college] 

[http://nursing2college.chat.ru/ | nursing college] 

[http://nursing-career.boom.ru/ | nursing career] 

[http://nursing4career.chat.ru/ | nursing career] 

[http://nursing-uniform.boom.ru/ | nursing uniform] 

[http://uniform2nursing.chat.ru/ | nursing uniform] 

[http://onlin-nurs-degre.boom.ru/ | online nursing degree] 

[http://nursin-education.boom.ru/ | nursing education] 

[http://nursingeducation.chat.ru/ | nursing education] 

[http://nursing-scrubs.boom.ru/ | nursing scrubs] 

[http://nursing2scrubs.chat.ru/ | nursing scrubs] 

[http://nurs-employment.boom.ru/ | nursing employment] 

[http://nurs2employment.chat.ru/ | nursing employment] 

[http://nursi2-education.boom.ru/ | nursing education] 

[http://nursin2education.chat.ru/ | nursing education] 

[http://forensic1nursing.chat.ru/ | forensic nursing] 





Best links: '''online course'''







[http://online3course.chat.ru/ | online course] 

[http://online-course.narod.ru/ | online course] 

[http://online1course.chat.ru/ | online course] 





Best links: '''online degree'''







[http://online1degree.chat.ru/ | online degree] 

[http://college1degree.chat.ru/ | college degree] 

[http://bachelor1degree.chat.ru/ | bachelor degree] 

[http://university-degre.boom.ru/ | university degree] 

[http://university1degre.chat.ru/ | university degree] 

[http://degree-program.hotmail.ru/ | degree program] 

[http://degree2program.chat.ru/ | degree program] 

[http://business1degree.chat.ru/ | business degree] 

[http://mba1degree.chat.ru/ | mba degree] 

[http://nursing4degree.chat.ru/ | nursing degree] 

[http://education1degree.chat.ru/ | education degree] 

[http://master1degree.chat.ru/ | master degree] 

[http://accredited-degre.hotmail.ru/ | accredited degree] 

[http://accredited1degre.chat.ru/ | accredited degree] 

[http://graduate1degree.chat.ru/ | graduate degree] 

[http://criminal-j-degre.boom.ru/ | criminal j degree] 

[http://associate1degree.chat.ru/ | associate degree] 

[http://socialsciencedeg.chat.ru/ | social science degree] 

[http://law1degree.chat.ru/ | law degree] 

[http://college1degree1p.chat.ru/ | college degree p] 

[http://accounting-degree.hotmail.ru/ | accounting degree] 

[http://accounting1degre.chat.ru/ | accounting degree] 

[http://teaching1degree.chat.ru/ | teaching degree] 

[http://psychology-degre.boom.ru/ | psychology degree] 

[http://psychology1degre.chat.ru/ | psychology degree] 

[http://engineerin2degre.chat.ru/ | engineering degree] 

[http://paralegal1degree.chat.ru/ | paralegal degree] 

[http://accredited2degre.chat.ru/ | accredited degree] 

[http://marketing1degree.chat.ru/ | marketing degree] 

[http://computer1degree.chat.ru/ | computer degree] 

[http://master2005degree.chat.ru/ | master degree] 





Best links: '''online nursing degree'''







[http://online4nursing.chat.ru/ | online nursing degree] 





Best links: '''online schools'''







[http://www.online-schools.tutbablo.com/ | online schools] 





Best links: '''panama cruise'''







[http://panama-cruise1.hotmail.ru/ | panama cruise] 

[http://panamacruise1.boom.ru/ | panama cruise] 

[http://panamacruise1.chat.ru/ | panama cruise] 

[http://panama2cruise.hotmail.ru/ | panama cruise] 

[http://panama2cruise.chat.ru/ | panama cruise] 

[http://panama2cruise.boom.ru/ | panama cruise] 





Best links: '''paper shredder'''







[http://shredder.boom.ru/ | paper shredder] 

[http://paper1-shredder.boom.ru/ | paper shredder] 

[http://pp-shredd.boom.ru/ | paper shredder] 

[http://paper-s.boom.ru/ | paper shredder] 

[http://paper-shredder.hotmail.ru/ | paper shredder] 

[http://paper--shredder.boom.ru/ | paper shredder] 

[http://paper1shredder.chat.ru/ | paper shredder] 

[http://shredder-4-paper.hotmail.ru/ | paper shredder] 

[http://shredder-4paper.boom.ru/ | paper shredder] 

[http://shredder4paper.chat.ru/ | paper shredder] 

[http://paper-best-shredder.hotmail.ru/ | paper shredder] 

[http://papr-shredder.boom.ru/ | paper shredder] 

[http://paper5shredder.chat.ru/ | paper shredder] 

[http://shredder-for-paper.hotmail.ru/ | paper shredder] 

[http://shredder-paper.boom.ru/ | paper shredder] 

[http://paper-cut-shredder.hotmail.ru/ | paper shredder] 





Best links: '''poker table'''







[http://poker-table.nm.ru/ | poker table] 

[http://poker1table.chat.ru/ | poker table] 





Best links: '''princess cruises'''







[http://princesscruises.chat.ru/ | princess cruises] 

[http://princess-cruises.hotmail.ru/ | princess cruises] 





Best links: '''prozac'''







[http://online-prozac.boom.ru/ | prozac] 





Best links: '''razor scooter'''







[http://razor-scooter.hotmail.ru/ | razor scooter] 

[http://razor2scooter.chat.ru/ | razor scooter] 

[http://razor-scooter.narod.ru/ | razor scooter] 





Best links: '''real estate advertising'''







[http://re-advertising.boom.ru/ | real estate advertising] 





Best links: '''retirement community'''







[http://retirement1comm.chat.ru/ | retirement community] 





Best links: '''ring'''







[http://titanium-ring.hotmail.ru/ | titanium ring]