Iron-cladding your Wi-Fi network

Not too recently, I answered two questions about Wi-Fi security. Although both about different subjects concerning Wi-Fi security, I thought it might be nice to sum up some Wi-Fi security techniques/tips, some known by “the general public” (read: non-superusers), some less known.

Is it a good idea to have Wi-Fi turned on all the time? How to see who is using my Wi-Fi?

So, what do I use to secure my network?

That’s an interesting question… It seems there’s no ultimate measure you can take to completely make your Wi-Fi network bullet proof. Like pretty much any other security method, there’s a way so hack and circumvent the measure taken. The ideal scenario seems to be to use different techniques to secure that oh-so-important wireless connection to the outside world.

In this blog post I’ll try to shed some light on which techniques are available, explain a little about how they work and share some tips that have always helped me.

Keeping “MY PRE-“… I mean “Your precious data” safe

Probably the most commonly known technique available today is data encryption. Basically, your router and your computer first encrypt the data they are sending and decrypt the data they receive. This way, the data payload being transmitted through the public part of your network (the air) looks like a bunch of gibberish to anyone you don’t want to capture your data. There are a couple of data encryption technologies available, the ones known best are probably:

• WEP (Wired Equivalent Privacy) key encryption
• WPA(2) (Wi-Fi Protected Access) key encryption

Both technologies use a private key to encrypt and decrypt the data which should be known by sender and receiver. It is true that sometimes it is unnecessary to input the key at a new client, however this doesn’t mean the new client doesn’t need the key. It just gets the key automatically instead of through human input. (An example of such a technique is called “Wi-Fi Protected Setup”, which will automatically and easily set up an encrypted connection between two devices.)

WEP

WEP is one of the first wireless protection techniques that’s been used. It is also the least secure of the data encryption techniques and WPA is its direct successor. WEP is no longer commonly used on new Wi-Fi devices, however support is often offered to be backwards compatible with older devices. WEP encryption can be cracked within a few minutes with current technologies.

WPA

WPA is the direct successor of WEP encryption. It was designed to quickly fix the security issues that were involved in using WEP until the development of WPA2, which completely conforms to the IEEE 802.11i standard. (WEP was IEEE 802.11)

WPA basically comes in two modes:

• WPA-PSK (Personal or Pre-Shared Key) data encryption through a pre-shared encryption key. This is most commonly used by consumers.
• WPA-Enterprise uses an 802.1X authentication server to assign different encryption keys to each client based on the client’s credentials.

Important security fixes include the usage of TKIP (Temporal Key Integrity Protocol) which replaced the in WEP used CRC (Cyclic redundancy check) which was easily manipulated. TKIP is a key manager protocol which makes sure the rotating keys used in WPA are not extracted/extrapolated from the packets where WEP rotating keys could be. Also, WPA uses an MIC (Message Integrity Code) which checks for any data tampering. If signs of data tampering are detected, the receiver will disconnect from the access point temporarily and will request a re-key. This re-key will reset the WPA rotating keys, rendering the by the hacker obtained keys (if any were) unusable.

The IEEE 802.11i standard also demands the used protocol to disconnect from the access point for at least 60 seconds when more than one MIC error is detected within 60 seconds. However this is not mandatory for WPA certified devices but is for WPA2 certified devices.

WPA2

WPA2 is the finished product of WPA encryption that completely conforms to the 802.11i standard. The Wi-Fi alliance will disallow the use of TKIP on WPA(2) certified devices from 2012 onward. This is replaced by the newer CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) and AES for encryption (Advanced Encryption Standard).

I’ll have a McFiltering with double bacon

Another option of determining who actually has access to the network is “MAC filtering”. This does not encrypt your data, so if this is used without, say, WPA encryption, the data sent between authorized devices is still readable by a third party. MAC filtering is based on the unique MAC address (Media Access Control address) that every NIC has. NIC stands for Network Interface Controller, it’s basically a fancy abbreviation for your (wireless) network card.

The MAC address is a hardcoded 48-bit address that is unique for every NIC. The standard format for printing 48-bit MAC (also referred to as MAC-48) addresses in human-friendly form is six groups of two hexadecimal digits, separated by hyphens (-) or colons (:) and in transmission order. So an example of a MAC address would be:

ab:12:34:56:67:89

Because it’s unique, we can “safely” allow access based upon this address. “Safe” in this context meaning another NIC with the same address will not be granted access by accident, simply because there isn’t a second NIC that has the same MAC address. However, MAC filtering can easily be circumvented by spoofing an allowed NIC’s MAC address. The hacker would have to have an allowed MAC addresses to use, this isn’t hard to get since the MAC address is included every data packet. Therefore MAC filtering can be a valuable addition to your network’s security but should not be your only defence.

Close the bay doors capt’n!

Like a port may have limited space for ships to dock, a router can be configured to used a limited amount of IP addresses. (IP addresses are unique addressed within one network that are assigned to the connected network devices.) By limiting the available IP addresses to the bare minimum, a hacker will have no place to dock its computer in your network. Let’s say you have five devices in your network, you could set the available IP range to the below setting.

192.168.1.100 to 192.168.1.104

This leaves for only five devices to be connected simultaneously, namely 192.168.1.100, 192.168.1.101, 192.168.1.102, 192.168.1.103 and last but not least 192.168.1.104. Some routers will even let you assign a static IP to a certain device (e.g. identified by MAC address) and thus allowing for even more security. A device with an unknown MAC address won’t be assigned an IP, simply because there is none available.

Other tips

Don’t use a “key” to protect your diary, use a “k3Y”

When people set their (e.g. WPA) encryption key, they underestimate the quality needed for it to be safe. Just like with normal passwords, an encryption key is as complex, long and well… as “weird” as possible. It’s best to use a key that has at least 8 characters and consists of letters, numbers and special characters. Although this may sound like this will create an ever so hard to remember password, there are ways to help you remember. For example, we could use a key like “superuser”, OR we could use a key like “5Up3Rus3R”. We replace letters with similar numbers and capitalize every first letter after a number.

Now there’s a fair chance “superuser”, or any other dictionary-based password is found within a dictionary brute-force table, leaving a hacker able to crack your key within a matter of hours or even minutes depending on the key used. “5Up3Rus3R” however, will be unlikely to appear in such a table and if the hacker wants to brute-force its way into a network protected with such a key, it will take considerably longer.

Protect yo’ black box

I bet you wouldn’t leave your car parked with the keys still in the door. Like a car, you need to protect your router and not leave the keys in the door. When you do not change the default password (or if you even have none set at all) of the administrative page of your router, it’s basically like leaving your keys in the door. The only thing I’d have to google is “default password linksys” if I want to get into a Linksys router and about two minutes later, I’ll be logging into your router with the default administrator password. Trust me, eight out of ten times, I find the default password still set.

Besides keeping the default administrative password, it is also bad practice to use the default set WEP or WPA key. Some wireless routers set a default key that is generated using the “unique” MAC address or SSID (Service Set Identifier, the name that your router is identified by) of your router. Once this algorithm is known, hackers will be able to calculate your encryption key using those variables.

On a certain interval, your wireless router will send out a beacon, containing its SSID and some other information to let other Wi-Fi devices know “Hey guys! I’m here, and you can call me (e.g.) ‘linksys’!”. Because of this fact (and to prevent hackers identifying your wireless router through the SSID) it’s also wise to change the default SSID of your wireless router or not have your wireless router broadcast its SSID at all.

Save our planet’s recourses

Like every other human being with a wireless router, you’re using electricity to power your wireless router. This electricity is generated by using up our planet’s recourses like oil, coal and the sun! (Okay, I’ll admit, we don’t ACTUALLY use up the sun, but still!) By turning off your router at specified times like at night, you’ll save power, save our planet a few grams of CO₂ a year AND reduce the risk of anyone hacking you at night when you’re fast asleep. What else need I say? If your router has the option, why not use it?

So, I won’t get hacked now?

Even after securing your Wi-Fi network with a decent WPA key and securing your router with an equally decent password, in the end, most of you should probably be asking yourself the following and then ask again.

Who on earth would be interested in going through all the effort of cracking every single security feature of your Wi-Fi network? Are you in a government’s top secret department, are you being watched by any intelligence agency, is what you do on the on your network even worth all the effort a hacker would take?

If you’re still concerned, because, say, you actually ARE being watched by an intelligence agency, then no, there is no way for you to protect your wireless network traffic. If they really want it, they’ll get it. A solution? Stop using your computer.