26

Recently, I found a user plug a USB Wifi stick on his desktop, and set up an AP without password. How can we detect or block this via firewall rules or other approach?

3
  • 16
    Sadly...You have a User problem not a Security problem. You need to implement a policy that prevents situations like this, up to you, what happens when the policy is broken. Non-Enforcement means the policy will be ignored.
    – Ramhound
    Nov 2, 2012 at 14:02
  • 1-what network infrastructure are you using? Different vendors have different ways of protecting network access. 2-do you have an AD domain that all clients are a member of? If so NAP may be the way to go. As well as group policy to disable device installation. 3-all network devices from a specific manufacturer have a predictable portion of their MAC address identical (OUI address). You could block addresses from belkin/linksys etc. n.b. This requires a firm policy on hardware procurement. If you can share more detail on your infrastructure I can offer more specific implementation details.
    – Arjun Sol
    Nov 2, 2012 at 20:03
  • 1
    Detecing the AP is possible using a software WiFi-scanner such as inSSIDer: metageek.net/products/inssider. Nov 9, 2012 at 8:03

15 Answers 15

45

Something left unsaid, Why is the user wanting a WiFi? As long as the user feels they have a legitimate need they will continue to find workarounds to any of your attempts at blocking it.

Discuss with the users what they are trying to accomplish. Perhaps create an official wifi network ( use all the security methods you wish - it will be 'yours' ). Or, better, two - Guest and Corporate WAPs.

WiFi is not something which needs be banned "just because," however it does need specific attention, just like all other aspects of security.

7
  • 10
    Thank you for pointing out the most important part of this, which I completely glazed over - users don't just do stuff, they do it for a reason. IT and security are support roles, and they need to cater for users' needs.
    – Polynomial
    Nov 2, 2012 at 19:22
  • 13
    @Polynomial And that's not just a one off problem. Once a policy starts forcing users to work around their admins backs as the only practical method to do their job the damage is unlikely to stay contained. Respect from the users to the admins is going to nosedive; and once people are in the mindset of working around policy to solve one problem they're much more likely to do so for other issues in the future instead of trying to get things done through the appropriate channels. Nov 2, 2012 at 20:13
  • 4
    This answer is very good, as is. Both comments make me feel distress though. For @Polynomial Security is a support role, but it is a sweeping generalization to say that security needs to cater to users' needs. Sometimes, the answer must just be "no". Alternatively, defer to management regarding corporate computing and security policy. The reason for having security staff is for their expertise. Users can't pick and choose which things to observe, and then complain when the entire framework is undermined. Actually, they can, and will complain... and blame. Nov 3, 2012 at 12:11
  • @FeralOink Of course - I wasn't implying that every whim must be catered too. But, at the end of the day, all security decisions must include an understanding of the users' needs and business requirements. However, it's also important to remember that security is a business requirement, so it's always about finding the right balance.
    – Polynomial
    Nov 3, 2012 at 12:22
  • 3
    @FeralOink Yeah, I tend to respond pretty quickly; most people generally assume I'm a sentient bash script ^_^
    – Polynomial
    Nov 3, 2012 at 12:30
14

Firewalls can't tell where your traffic is coming from in terms of the physical network - they only see the data that the protocol provides, such as MAC / IP, which aren't much use in this case.

I think you're falling into the trap of looking for a technical solution to a managerial problem. Remember Immutable Law of Security #10: Technology is not a panacea. Whilst technology can do some amazing things, it can't enforce user behaviour.

You have a user that is bringing undue risk to the organisation, and that risk needs to be dealt with. The solution to your problem is policy, not technology. Set up a security policy that details explicitly disallowed behaviours, and have your users sign it. If they violate that policy, you can go to your superiors with evidence of the violation and a penalty can be enforced.

12

There is no firewall rule which can help you there: by construction, the rogue AP provides a network path which bypasses your firewalls. As long as the users have physical access to the machines they use and their USB ports (that's hard to avoid, unless you pour glue in all the USB ports...) and that the installed operating systems allow it (then again, hard to avoid if users are "administrators" on their systems, in particular in BYOD contexts), then the users can setup custom access points which gives access to, at least, their machine.

What you can do is use a laptop, smartphone or tablet to list existing AP, and track them down, using the signal strength as a clue to the AP physical location. However, ultimately, this is a policy issue: educate your users to the dangers of setting custom access points; warn them that this is forbidden by the local security policies, and that they will be held responsible (legally and financially) for what may result from such misbehaviour.

1
  • +1 for not only prohibiting it in policy but also making users aware of the possible legal consequences.
    – Luc
    Nov 2, 2012 at 17:39
11

In addition to the answers around the policy side of things there's a couple of technical approaches that can help you here, depending on how tightly controlled your IT environment is.

  1. USB port lockdown - in your particular case the user has made use of a USB Wi-Fi stick to create the AP. If you have software which can lock-down what classes of USB device are allowed (and your users don't have local admin rights to disable them) then this would be one option to restrict this kind of activity.
  2. Network Access Control - another way to see rogue Access Points on the network would be for the user to plug a standard wireless AP into an ethernet port in the network. To help block this NAC could be used to restrict access to the network to approved devices.
  3. As @thomas-pornin mentions above detection of the AP can be done with a handheld scanner, also if you have an existing corporate wireless network then a lot of vendors (e.g. Cisco) will provide a rogue access point detection mechanism which makes use of the legitimate Access points to detect the rogues.

I will mention that all these measures can be bypassed by a determined/savvy attacker, however they would likely be effective with ordinary users.

4
  • 2
    Technical solution is worthless if it is not effective, as in this case, everything on here can be worked around relatively easily by ordinary users and they come at tremendous cost. For instance, locking down USB prevents legitimate user from doing legitimate work. NAC, while a good idea for many problems, adds unnecessary complication to network management. Patrolling AP only work if you know exactly how the user is bypassing your policy, for example, if Wifi is patrolled, users may still use Bluetooth or USB tethering or Serial port, etc. Patrolling also creates a sense of distrust.
    – Lie Ryan
    Nov 3, 2012 at 1:44
  • 2
    Users that feels that they are not being trusted are the ones that are the most likely to try to find a way to workaround technical barriers, instead of working together with it.
    – Lie Ryan
    Nov 3, 2012 at 2:29
  • 3
    Sorry but I don't agree with your blanket assertions that in all cases technical security measures are counter productive. By your argument you wouldn't use any technical controls within a company, just trust all users to do the "right thing". Whilst in some environments that might be the correct approach, in others (and probably the majority) I'd say that it isn't, there's a balance to be had between policy & technical security controls, and each has their place. Nov 3, 2012 at 7:25
  • 2
    to clarify, I'm not saying that all technical measures are worthless, but ineffective technical measures are worse than doing nothing. In many cases, these technical measures comes at a cost, and the cost is not always something that is easy to quantify. If you still think such cost is outweighed by the benefits, then it's probably for the best, but when ineffective measures does not really do much, you're better off not implementing it.
    – Lie Ryan
    Nov 3, 2012 at 7:40
10

I'm actually quite shocked by the number of people dismissing this as a policy or managerial problem.

Yes, a policy needs to be created/enforced so that appropriate disciplinary action can be taken if or when a user is caught violating policy.

However, policy alone is not going to prevent your network/data from being compromised if a user isn't following policy!

If it's within your ability to do so, by all means a technical control should be implemented.

With that being said, if your users are on windows you may take a look at: http://www.wirelessautoswitch.com/about.aspx

Group Policy can be implemented to stop other users on your network from connecting to rogue AP's: http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/7130f1a5-70fd-429f-8d41-575085489bd1 however, this won't stop the bad guys from connecting to your users rogue AP.

As Rory mentioned, you could go the route of disabling USB ports but this is not always practical depending upon your situation.

9

Full disclosure I work for a large Cisco solution partner.

As others have mentioned, a firewall will not help much.

There is a whole class of products called wireless intrusion detection / prevention system (WIDS / WIPS). Cisco, Aruba, Motorola Air Defense, and Airtight Networks Spectraguard are some vendors/products in this category. Not an exhaustive list. For a small customer I had good luck deploying Airtight Networks because they have a hybrid on-premise/cloud model that is inexpensive and easy to get running quickly. It's also very effective. One feature it had was that it could learn the MAC addresses of your organization's endpoints(laptops) and detect when it observed one joining a wireless network not operated by your organization. It could then alert you and/or "jam" the endpoint or AP (be very careful not to break applicable laws in your area!)

Kismet is an open source wireless tool that can be used (among many other things) as a wireless intrusion detection system. See http://www.kismetwireless.net/documentation.shtml

Walking around with a laptop or other handheld scanner certainly works--but only when you are walking around :-) Great for incident response or troubleshooting but not a feasible long-term wireless monitoring solution.

Another technical approach is to prevent this on the offending endpoint computer itself. Others have offered good advice on this so I will not repeat.

Of course creating policy and providing users with legitimate and secure way to meet their justified business needs is very important too. As with so many topics in security it takes a blend of technical and administrative(policy) controls to be successful.

Best of luck!

8

If the rogue access point is operating in bridged mode (which most will be) you'll see the mac addresses of the wireless client(s) on the switch port of the desktop.

You can block these unknown mac addresses on most switches by setting the switches port address filtering to "learn then block" mode - it will learn the 1st mac address seen and then block any new ones. The switch could also log when they block an unknown mac address.

You could also do this by deploying 802.1x and authenticating each device on your network tho that would be more complicated to setup.

0
4

Develop a script which, running on a machine with wireless hardware, periodically scans the wireless environment for the presence of access points, and caches them in a persistent list. The program can raise an alarm (e.g. e-mail to the admins) whenever a hitherto unseen access point emerges and is added to the list. At that point it is the admin's discretion whether that access point goes into the persistent list, or must be hunted down and disabled.

An appropriate response to the alarm might be to send out an e-mail to all staff in the building:

Whoever started an access point with SSID "FooBar" has 10 minutes to take it down, and we will forget the whole thing. Or else you can let us find it. You don't want that.

1
  • Most likely the user who did this secured their private wifi network, so it won't appear to be any different from any other network outside the building. Shutting off the power to the building and watching it go away would reveal it! Apr 2, 2018 at 23:40
2

I'd say it's best if you can work this out between admins and users, since admin is not there to block 'just because' but rather to support the infrastructure of the organization and help users perform their work easier (not harder). Going down the road of measure vs counter-measure for each policy just makes it more likely that users will be less inclined to see network admin as helpful and their respect for admin may nose-dive. That said, if wifi is a very big problem that is absolutely necessary to curtail (not just because that's policy mind you), then you can set up 802.1x and have all nodes that connect by wifi authenticate in before getting access (also this will account for sessions so that anything happening should be monitored). Also, port security can be implemented if the number of nodes in a lan or vlan is known then the rogue router can be detected and neutralized. Port security really isn't a great solution here as a simple wifi usb can get around it (in this situation) but it can at least stifle the activity of rogue routers. So-called 'war-driving' works well and, if necessary and known basically where the AP's might be hiding, admins have been known to send techs to walk around with a laptop or phone searching at random times to hunt down the AP's locations. If you don't mind invading privacy, you can adjust the privileges on any laptops controlled by the organization to monitor activity and get alerts on any attempts to connect to wifi points (and hence rogue AP's).

1

Several previous answers (such as Thomas Pornin's) have emphasized the need for user education and policy enforcement, and noted that, if users have administrator access on their computers (or can plug their own devices to the wired network), a determined user can always set up an unauthorized access point in a way that makes it invisible to the network.

However, I'd argue that such education would nonetheless be most effective if complemented with a technical solution that would stop users from being able to set up unauthorized access points simply by plugging in a USB stick. Sure, a user with admin access can always circumvent it if they really want and know how to, but at least they'll have to work at it, and hopefully won't be able to do it without being aware that they're circumventing a security measure.

It's a bit like protecting your network from viruses: to do it effectively, you really want to both educate your users and run a virus scanner. Either measure alone is sub-optimal.


As for how to implement such a solution, an obvious approach would be to set up a firewall rule on all workstations to reject any IP packets that don't originate on the local host or be destined to it. On Linux systems, for example, I believe the following iptables policy ought to be sufficient:

iptables -F FORWARD
iptables -P FORWARD DROP

This ensures that any packets entering the FORWARD chain (i.e. those that are neither locally generated nor destined to local sockets) will be unconditionally dropped. If you want to be nice, you can also have them generate an ICMP rejection message:

iptables -I FORWARD -j REJECT --reject-with icmp-host-unreachable

Of course, you need to make sure these rules are reapplied on every reboot. Alternatively, you could just disable IPv4 forwarding in the kernel by adding the following line to /etc/sysctl.conf:

net.ipv4.ip_forward = 0

and running sysctl -p to reload the file (which will happen automatically on reboot).

Unfortunately, I'm not familiar enough with Windows network administration to be able to say what might do the same trick there. (Also, I should warn that I haven't actually tested that these solutions work in the OP's scenario. Please do your own testing before relying on them.)

1

As I write this, you have been given a couple of answers. I simply offer a couple more:

1.) Policy - ugh! Many have mentioned the dirty word, but it is true. You need to start with a policy, which exists as a business statement for users to follow. This policy should be clear in its intent and supported by standards and baselines.

2.) I am not a fan of re-inventing the wheel, or building a rocket ship when a simple solution will work just fine. SANS had a webcast series going strong for a while where David Hoelzer taught various quick tricks on auditing. One such episode discussed AP detection and is related to your question. You can view this episode here: http://auditcasts.com/screencasts/4-can-you-hear-me-now

While not completely related, I found that viewing episode #3 was also helpful in understanding Wireless technology. http://auditcasts.com/screencasts/3-auditing-hacking-wpa-wpa2 (I can not be clear enough here, DO NOT do this without explicit permission).

I modified David's solution a bit, but have applied it to my office and it's passed for PCI Compliance.

3.) Nessus offers a plug in, where it scans the wired end of a Rogue AP and reports on it when detected. You'll need to subscribe to Nessus professional feed if you are going to use it in the office. It's affordable at $1,200.00 a year and it'll enable you to scan and support other policies such as patch compliance, build standards, vulnerabilities.

I hope that gives you some direction, let us know what you end up using and how it's implemented.

kind regards,

1
  • Wow, how awesome... my video cited on Stackexchange! Oct 19, 2013 at 19:32
0

The most drastic solution to mitigate this type of risk is to move the network away from the user by implementing VDI/Thin Client (Welcome back to the mainframe era :-) ). Combined with other security functions it should relegate the issue to remote access.

If this is not practical, it is preferable to have a system which detect USB device type insertion and silently raise alert to security team rather than block USB device as the user will find other mean to get what he needs that you may not be protected against (i.e. bring his home wireless router and plug it into your network if you do not have authentication).

0

As has been mentioned user engagement is the best solution here. Yet it should be mentioned that in some situations you might absolutly not want a wifi enabled on your network.

One possible solution not mentioned here. If your are working at some supper high security office. Where wifi has been deemed a high risk.

You could set up a restricted access list based on the mac addresses of the network cards of the devices / work stations that are specifically allows access on that network. This can be quite a lot of work, having to get the mac address of every device that needs access on you system.

There are still ways to work around this by spoofing the mac address of some other work station to allow an unknown device on the network. It still requires some measure of skill and know how. Most Wifi device don't have the option to spoof a mac address unless you know how to change the devices firmware and are comfortable with working the devices configuration at a command line level.

Allot of universities set a network access per a mac address. Before you can access the internet you need to enter your computers mac address on some registration site. This links your system user account with your computers mac address. You need both to be able to access the network and internet. This link explains how that works. http://netreg.sourceforge.net/SysAdmin/

You can do this at the DHCP level, where ip address are assigned on the network. No ip address no access on the network

http://www.yolinux.com/TUTORIALS/DHCP-Server.html

You can also do this at the firewall level, which is much more secure.

http://www.cyberciti.biz/tips/iptables-mac-address-filtering.html

As I have stated this is not full proof as any body with enough time and effort can by pass any type of security. Specifically via mac spoofing.

0

Here's a possibility just waiting for others to find holes in it:

  1. Have all internal network connections use encryption between endpoints and a central (set of) routers/switches. This could be VPN or other solutions.

  2. Have customization of the encryption technology on each endpoint that validates that endpoint does not allow routing/bridging through it.

Now all that is needed is a way to validate that the endpoint's encryption technology is only what you have provided and not hacked.

An example - NOT AN ENDORSEMENT - of available solutions includes http://juniper.net/us/en/solutions/enterprise/security-compliance/

3
  • 1
    Can you give an example implementation? I find this scenario rather hard to imagine.
    – Luc
    Nov 2, 2012 at 23:11
  • This is workable, under the premise of a complete, provably trusted computing chain - starting from cryptographically authenticated hardware checks and building up from there, verifying on each step. Possible, but expensive and difficult to manage. Nov 4, 2012 at 12:42
  • Indeed, as @Piskvor points out you can really only get to 100% if you use a provably trusted computing platform - however you can get fairly close to that ultimate goal with software-based validation methods. It will not deter a truly determined and talented hacker, however it will certainly prevent less concerted efforts without spending huge amounts of money and time. Nov 5, 2012 at 5:26
-1

I guess i have a completely different solution.
One Single Sentence:
Internet access through a VPN that allows only one session per user.

2
  • 1
    One single acronym: NAT. How do you distinguish whether the data comes directly off the VPN-connected computer, or is NAT-ed through that computer and into the VPN? (Note that it looks exactly the same as if it had originated on the computer) Nov 4, 2012 at 12:40
  • @Piskvor I'm a CCNP, you ARE right. but there is no solution to stop NAT in this whole page. The only thing i can think of is a client side program that only allows certain programs to access the network with a too-hard-to-implement custom protocol to avoid any other one implementing it. Unfortunately it may tie people to a single OS, and may not be deployed on some smartphones and make the users angry.
    – Behrooz
    Nov 6, 2012 at 6:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .