NWA-PCUG Newsletter Article, May 2011
Secure Your Wireless Network - OR ELSE!
By Ira Wilsker, Radio Show Host,
Columnist, College Professor and deputy sheriff
(click to email author)

http://www.wi-fi.org/files/kc_25_Five Steps to Creating a Wireless Network.pdf

Many times in this column I have warned readers about the risks of having an unsecured wireless or "Wi-Fi" network. Similar warning have been written here about the risks of using Wi-Fi in hotels, airports, restaurants, and other quasi-public places where miscreants can intercept your wireless signal and gain access to what is on your computer. Some time ago I mentioned how a neighbor whose own broadband connection was out, surreptitiously used another neighbor's Wi-Fi without his consent or knowledge while waiting for repair.

The news media has been rife with stories about how bad guys and other crooks have broken into inadequately protected wireless networks and stolen information, committed identity theft, downloaded child pornography, planted malware and spyware on the computer, and committed other heinous acts, all made possible because the owner of the wireless network did not take proper precautions to harden his system from attack and intrusion. In a recent AP news story, "NY case underscores Wi-Fi privacy dangers" (April 24, 2011, by Carolyn Thompson), one Buffalo, NY resident learned the hard way. " Lying on his family room floor with assault weapons trained on him, shouts of "pedophile!" and "pornographer!" stinging like his fresh cuts and bruises, the Buffalo homeowner didn't need long to figure out the reason for the early morning wake-up call from a swarm of federal agents. That new wireless router. He'd gotten fed up trying to set a password. Someone must have used his Internet connection, he thought. "We know who you are! You downloaded thousands of images at 11:30 last night," the man's lawyer, Barry Covert, recounted the agents saying. They referred to a screen name, "Doldrum." ... Law enforcement officials say the case is a cautionary tale. Their advice: Password-protect your wireless router. ... Within three days, investigators determined the homeowner had been telling the truth: If someone was downloading child pornography through his wireless signal, it wasn't him. About a week later, agents arrested a 25-year-old neighbor and charged him with distribution of child pornography."

The Buffalo case is far more common than people realize. In a recent Sarasota, FL, case, " (A Sarasota resident) ... got a similar visit from the FBI last year after someone on a boat docked in a marina outside his building used a potato chip can as an antenna to boost his wireless signal and download an astounding 10 million images of child porn."

These originally accused individuals might not have been guilty of a criminal act, but they were guilty of not properly securing their home wireless networks, thus unknowingly allowing others to use their broadband internet connections for illicit purposes. Virtually all wireless routers manufactured in the last several years have integral security features available, but many users do not implement these features because they feel that it is too complicated, or that the default settings are adequate. That type of blissful ignorance can lead to a lot of trouble, as reflected by the news story above. Older 802.11b wireless routers attempted to provide some security by implementing an encryption protocol called "WEP" (Wired Equivalent Privacy), which was promptly cracked, and readily available hacker utilities can breach WEP security keys in a matter of seconds, rendering the wireless network security null, and allowing unrestricted access to the home network. There was an interim upgraded protocol, Dynamic WEP, which changed the security key every few minutes, but the currently available hacker utilities can easily breach D-WEP in a matter of seconds. The introduction of the faster 802.11g, and the recent 802.11n standards provide much improved security. These newer standards incorporate an much improved Wi-Fi Protected Access 2 (WPA-2) encryption, which while not totally impervious to attack, does significantly harden a home wireless network, making unauthorized intrusion much more difficult. WPA-2 has been around since 2004, and became mandatory on all new standardized Wi-Fi routers in 2006. While WPA-2 encryption provides much improved security, the major flaw is that since it typically requires users to configure it, which many do not, many users leave the barn door open to attack.

The trade association representing the Wi-Fi manufacturers, the Wi-Fi Alliance, has published simple instruction on how to secure a wireless network at home or at work. These instructions are available online at http://www.wi-fi.org/knowledge_center/kc-fivestepsforcreatingwirelessnetwork with a PDF file detailing the process available at http://www.wi-fi.org/files/kc_25_Five Steps to Creating a Wireless Network.pdf. The five steps listed by the Wi-Fi Alliance are: Planning, Equipment Selection, Set Up, Adding Wi-Fi to Desktop Computers, and Security. While an appropriate first step, many users do not really do any Wi-Fi planning, instead using the wireless router provided by their internet service provider, or purchased at a big-box store. Fortunately, most wireless routers available today, especially if they are Wi-Fi certified by the Wi-Fi Alliance, are capable of handling any reasonable networking needs; the "g" standard is adequate for normal household data needs, while the newer and faster "n" standard may be capable of the wireless distribution of TV grade video around the house. One common trap that many purchasers of wireless networks fall into, is that they over-buy, and purchase a Wi-Fi router that is much faster than anything that may be in their home in the foreseeable future; 802.11g has a theoretical maximum raw speed of 54 Mbit/s (really about 19 Mbit/s net throughput), and 802.11n has a theoretical maximum raw speed of 600 Mbit/s (actual throughput is much lower). If used primarily to wirelessly link computers to the internet, the "weakest link in the chain" is often the internet connection itself, which is typically far below the speed capability of the Wi-Fi, thus wasting a lot of potential capacity. Now that video streaming from the likes of Netflix is becoming more common, and HD TV and DVDs can be wirelessly streamed around the house, the faster 802.11n may be appropriate.

It is imperative that whatever Wi-Fi equipment is provided or purchased, that the security features provided by the manufacturer are properly implemented. While each maker may have a different procedure to follow in setting up the security of its products, the basics are fairly similar. One of the most important features to implement is the data encryption, which will make your signal unintelligible by unauthorized users. The newer wireless routers offer WPA-2 encryption, which may require a "key" or phrase to decrypt; do not use anything simple like your name, address. or birth date, as they may be easily guessed by a hacker; instead use a random alpha-numeric key (random letters and numbers) to create a key that will be difficult for others to guess. Almost all wireless routers require a password for access, and by default incorporate a default password. Immediately, change your default password to something that others could not likely guess, such as another random alpha-numeric sequence. Users should be aware that if they do not change the default password to their wireless routers, they may be easy to crack, as many makers use the word "default" as the default password, and there are online directories of default passwords sorted by manufacturer. Since it is often easy to remotely determine the brand and model number of a wireless router, and many users never change the factory default, the network is prone to intrusion. With a complex password, unauthorized users will not likely be able to access or modify your settings.

Almost all wireless routers transmit a SSID, or Service Set Identifier, such that it is easy for other wireless devices to locate the network. According to the Wi-Fi Alliance, "All access points ship with a wireless beacon signal so that wireless PCs can more easily find them. In effect, the signal is shouting, I'm here! Log on!" By turning of the SSID, the network is effectively closed to outsiders, as it becomes somewhat invisible to them.

By default, most wireless routers or access points have a default network name, typically the manufacturer's name and model number, making the network vulnerable in several ways. If possible, change the network name to something that cannot be readily tracked back to you; do not use your name, street address, company name, or other personally identifiable name, but instead use a pseudonym or random alpha-numeric name.

The location of the wireless router in the home or business will have a significant effect on the ability of others on the outside to intercept your radio signal. If the wireless network is intended for use within the house, then locate the wireless router or access point away from windows and open doors; the more hard material between the router and the data thief, the less likely it is for him to intercept your signal.

Many better wireless routers and access points offer a "MAC (Medium Access Control) Control Table", where the unique MAC address of each authorized computer or device can be included in an Access Control List (ACL). By implementing this feature, only the devices with the listed MAC addresses can access your network, and unauthorized computers and devices not included in the ACL list will be blocked from access; this is an effective way of restricting unauthorized access to your network.

There may be some other security features offered by some manufacturers, but these are the most common, and often offer substantial compatibility among the different hardware types likely encountered. Implement as a rule that whatever security features are offered by your hardware that they should be fully implemented to the level of maximum protection.

Failure to do so may result in unauthorized access to your network; and the FBI may be knocking on your door too. Open Attachment EXAMINER 042911 - Secure Your Wireless Network.doc Open WiFiSecurity1-5Steps.jpg

Click here to return to top